@astrosheep/keiyaku 4.6.12 → 4.6.14

package/build/src/akuma/caller.js

@@ -34,3 +34,9 @@ export function decodeAkumaCaller(value) {
         throw new TypeError(`Invalid Akuma caller: ${parsed.error.message}`);
     return parsed.data;
 }
+/** One stable comparison coordinate for stored and queried caller attribution. */
+export function akumaCallerKey(caller) {
+    return caller.kind === "akuma"
+        ? `akuma\u0000${caller.world}\u0000${caller.akuId}`
+        : `external\u0000${caller.integration}\u0000${caller.id}`;
+}

package/build/src/akuma/custody.d.ts

@@ -0,0 +1,11 @@
+import type { KnownAkuma } from "./akuma.js";
+export declare class AkumaResetStopError extends Error {
+    constructor(message: string);
+}
+export declare function removeKnownRegularFile(path: string): Promise<void>;
+export declare function removeEmptyDirectory(path: string): Promise<void>;
+/**
+ * Remove exactly the recognized custody of one Akuma entry. Unknown files and
+ * directories stay; an entry whose unknown bytes remain keeps its directory.
+ */
+export declare function removeAkumaCustody(entry: KnownAkuma): Promise<void>;

package/build/src/akuma/custody.js

@@ -0,0 +1,102 @@
+import { lstat, readdir, rm, rmdir } from "node:fs/promises";
+import { join } from "node:path";
+export class AkumaResetStopError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AkumaResetStopError";
+    }
+}
+export async function removeKnownRegularFile(path) {
+    try {
+        const value = await lstat(path);
+        if (!value.isFile() || value.isSymbolicLink())
+            throw new AkumaResetStopError(`Akuma custody is not a regular file: ${path}`);
+        await rm(path, { force: true });
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+export async function removeEmptyDirectory(path) {
+    try {
+        await rmdir(path);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT" && error.code !== "ENOTEMPTY")
+            throw error;
+    }
+}
+function isRequestSequenceName(name) {
+    const sequence = Number(name);
+    return /^\d+$/u.test(name) && Number.isSafeInteger(sequence) && String(sequence) === name;
+}
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+function isRequestArtifactName(name) {
+    const match = /^(.*)\.(?:request|receipt)\.json$/u.exec(name);
+    return match !== null && UUID_V4.test(match[1]);
+}
+async function removeKnownRequestFile(path) {
+    try {
+        const value = await lstat(path);
+        if (!value.isFile() || value.isSymbolicLink())
+            return;
+        await rm(path, { force: true });
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+async function removeKnownRequestChannel(path) {
+    try {
+        const value = await lstat(path);
+        if (!value.isDirectory() || value.isSymbolicLink())
+            throw new AkumaResetStopError(`Akuma custody is not a directory: ${path}`);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    for (const name of await readdir(path)) {
+        if (!isRequestSequenceName(name))
+            continue;
+        const sequenceDir = join(path, name);
+        try {
+            const sequence = await lstat(sequenceDir);
+            if (!sequence.isDirectory() || sequence.isSymbolicLink())
+                continue;
+            for (const child of await readdir(sequenceDir)) {
+                if (isRequestArtifactName(child))
+                    await removeKnownRequestFile(join(sequenceDir, child));
+            }
+            await removeEmptyDirectory(sequenceDir);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    await removeEmptyDirectory(path);
+}
+/**
+ * Remove exactly the recognized custody of one Akuma entry. Unknown files and
+ * directories stay; an entry whose unknown bytes remain keeps its directory.
+ */
+export async function removeAkumaCustody(entry) {
+    await removeKnownRequestChannel(entry.paths.requests);
+    for (const path of [
+        join(entry.paths.directory, "request-entry.json"),
+        entry.paths.log,
+        `${entry.paths.heart}-wal`,
+        `${entry.paths.heart}-shm`,
+        `${entry.paths.leash}-wal`,
+        `${entry.paths.leash}-shm`,
+        entry.paths.leash,
+        entry.paths.heart,
+    ]) {
+        await removeKnownRegularFile(path);
+    }
+    await removeEmptyDirectory(entry.paths.directory);
+}

package/build/src/akuma/lineage-cache.d.ts

@@ -0,0 +1,39 @@
+import { type AkumaCaller } from "./caller.js";
+import { type AkuId, type AkumaPaths } from "./identity.js";
+import type { WorldRoot } from "../world.js";
+/**
+ * The World-local lineage cache is a disposable reconstruction of the frozen
+ * `Soul.caller` edge for born Akuma. It is never authority: every entry can be
+ * rebuilt from Hearts, and an unavailable cache falls back to direct Soul reads.
+ */
+export type AkumaLineage = ReadonlyMap<AkuId, AkumaCaller | null>;
+export type LineageMember = Readonly<{
+    id: AkuId;
+    paths: AkumaPaths;
+}>;
+export declare function akumaLineageCachePath(world: WorldRoot): string;
+/** Authoritative lineage read: every known born Soul, with no cache consultation. */
+export declare function readDirectAkumaLineage(members: readonly LineageMember[]): Promise<AkumaLineage>;
+/**
+ * Discard the disposable record when an offered edge disagrees with a born
+ * Soul. The next caller-scoped answer comes from direct Soul evidence and
+ * rewrites the record, so a wrong edge can never survive as accepted fact.
+ */
+export declare function invalidateAkumaLineage(world: WorldRoot): Promise<void>;
+/** Rewrite every edge from authoritative evidence, dropping any stale entry. */
+export declare function rebuildAkumaLineage(world: WorldRoot, edges: AkumaLineage): Promise<void>;
+/**
+ * Record one born Soul's immutable caller edge. Best-effort: callers never await
+ * this to decide birth, and a failed write is repaired by the next fallback read.
+ */
+export declare function recordAkumaLineage(world: WorldRoot, soul: Readonly<{
+    id: AkuId;
+    caller?: AkumaCaller;
+}>): Promise<void>;
+/**
+ * Load the caller edge of every currently known Akuma. Cache hits avoid opening
+ * their Hearts; misses and unusable caches fall back to the existing Soul seam.
+ * Rows whose Akuma directory no longer exists never join this view, and fresh
+ * edges plus that pruning are written back best-effort.
+ */
+export declare function readAkumaLineage(world: WorldRoot, members: readonly LineageMember[]): Promise<AkumaLineage>;

package/build/src/akuma/lineage-cache.js

@@ -0,0 +1,162 @@
+import { DatabaseSync } from "node:sqlite";
+import { lstat, mkdir, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { decodeAkumaCaller } from "./caller.js";
+import { readSoul } from "./heart/index.js";
+import { akumaRunRoot, parseAkuId } from "./identity.js";
+import { boundedMap } from "./read-pool.js";
+const CACHE_FILE = "lineage-cache.sqlite";
+const LINEAGE_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS lineage (
+    aku_id TEXT PRIMARY KEY,
+    caller_json TEXT
+  ) STRICT;
+`;
+export function akumaLineageCachePath(world) {
+    return join(akumaRunRoot(world), CACHE_FILE);
+}
+function readCachedEdge(row) {
+    const value = row;
+    if (value === null || typeof value !== "object")
+        throw new Error("Akuma lineage cache row is not an object");
+    if (typeof value.aku_id !== "string")
+        throw new Error("Akuma lineage cache row has no identity");
+    const akuId = parseAkuId(value.aku_id).id;
+    if (value.caller_json === null)
+        return [akuId, null];
+    if (typeof value.caller_json !== "string")
+        throw new Error("Akuma lineage cache row has no caller evidence");
+    const caller = decodeAkumaCaller(JSON.parse(value.caller_json));
+    if (caller === undefined)
+        throw new Error("Akuma lineage cache row has an empty caller");
+    return [akuId, caller];
+}
+/** A readable cache, an empty map for a cache that was never written, or null when unusable. */
+async function readLineageCache(path) {
+    try {
+        await lstat(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return new Map();
+        return null;
+    }
+    let database;
+    try {
+        // Existing custody is opened without a journal-mode constraint: a writer's
+        // WAL side files stay usable, and a busy or unreadable record falls back.
+        database = new DatabaseSync(path);
+    }
+    catch {
+        return null;
+    }
+    try {
+        database.exec("PRAGMA busy_timeout=0");
+        const rows = database.prepare("SELECT aku_id, caller_json FROM lineage").all();
+        return new Map(rows.map(readCachedEdge));
+    }
+    catch {
+        return null;
+    }
+    finally {
+        database.close();
+    }
+}
+async function writeLineageCache(path, fresh, stale, replace = false) {
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        const database = new DatabaseSync(path);
+        try {
+            database.exec("PRAGMA busy_timeout=0");
+            database.exec("PRAGMA journal_mode=WAL");
+            database.exec(LINEAGE_SCHEMA);
+            const insert = database.prepare("INSERT OR REPLACE INTO lineage(aku_id, caller_json) VALUES (?, ?)");
+            const remove = database.prepare("DELETE FROM lineage WHERE aku_id = ?");
+            database.exec("BEGIN IMMEDIATE");
+            try {
+                if (replace)
+                    database.exec("DELETE FROM lineage");
+                for (const [akuId, caller] of fresh)
+                    insert.run(akuId, caller === null ? null : JSON.stringify(caller));
+                for (const akuId of stale)
+                    remove.run(akuId);
+                database.exec("COMMIT");
+            }
+            catch (error) {
+                database.exec("ROLLBACK");
+                throw error;
+            }
+        }
+        finally {
+            database.close();
+        }
+    }
+    catch {
+        /* The cache is disposable; a failed refresh never changes an Akuma result. */
+    }
+}
+async function directEdge(member) {
+    try {
+        const soul = await readSoul(member.paths);
+        return soul === null ? null : [member.id, soul.caller ?? null];
+    }
+    catch {
+        // A hard Heart read failure stays an omitted member, never an empty roster claim.
+        return null;
+    }
+}
+/** Authoritative lineage read: every known born Soul, with no cache consultation. */
+export async function readDirectAkumaLineage(members) {
+    return new Map((await boundedMap(members, directEdge)).filter((edge) => edge !== null));
+}
+/**
+ * Discard the disposable record when an offered edge disagrees with a born
+ * Soul. The next caller-scoped answer comes from direct Soul evidence and
+ * rewrites the record, so a wrong edge can never survive as accepted fact.
+ */
+export async function invalidateAkumaLineage(world) {
+    const path = akumaLineageCachePath(world);
+    for (const file of [path, `${path}-wal`, `${path}-shm`]) {
+        try {
+            await rm(file, { force: true });
+        }
+        catch {
+            /* Best effort: a still-readable record is checked again by the next query. */
+        }
+    }
+}
+/** Rewrite every edge from authoritative evidence, dropping any stale entry. */
+export async function rebuildAkumaLineage(world, edges) {
+    await writeLineageCache(akumaLineageCachePath(world), [...edges], [], true);
+}
+/**
+ * Record one born Soul's immutable caller edge. Best-effort: callers never await
+ * this to decide birth, and a failed write is repaired by the next fallback read.
+ */
+export async function recordAkumaLineage(world, soul) {
+    await writeLineageCache(akumaLineageCachePath(world), [[soul.id, soul.caller ?? null]], []);
+}
+/**
+ * Load the caller edge of every currently known Akuma. Cache hits avoid opening
+ * their Hearts; misses and unusable caches fall back to the existing Soul seam.
+ * Rows whose Akuma directory no longer exists never join this view, and fresh
+ * edges plus that pruning are written back best-effort.
+ */
+export async function readAkumaLineage(world, members) {
+    const path = akumaLineageCachePath(world);
+    const cached = await readLineageCache(path);
+    if (cached === null)
+        return await readDirectAkumaLineage(members);
+    const known = new Set(members.map((member) => member.id));
+    const stale = [...cached.keys()].filter((id) => !known.has(id));
+    const missing = members.filter((member) => !cached.has(member.id));
+    const fresh = (await boundedMap(missing, directEdge)).filter((edge) => edge !== null);
+    // A vanished directory never contributes an edge even if its prune write fails.
+    for (const id of stale)
+        cached.delete(id);
+    for (const [akuId, caller] of fresh)
+        cached.set(akuId, caller);
+    if (fresh.length > 0 || stale.length > 0)
+        await writeLineageCache(path, fresh, stale);
+    return cached;
+}

package/build/src/akuma/nuke.d.ts

@@ -1,5 +1,3 @@
 import type { WorldRoot } from "../world.js";
-export declare class AkumaResetStopError extends Error {
-    constructor(message: string);
-}
+export { AkumaResetStopError } from "./custody.js";
 export declare function stopAkuma(world: WorldRoot): Promise<() => Promise<void>>;

package/build/src/akuma/nuke.js

@@ -1,17 +1,14 @@
-import { lstat, readdir, rm, rmdir } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { lstat, readdir } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
 import { nukeAliases } from "../alias/index.js";
 import { knownAkuma } from "./akuma.js";
+import { akumaLineageCachePath } from "./lineage-cache.js";
 import { settleAkumaKill } from "./akuma-owner.js";
 import { acquireLeash } from "./control.js";
+import { AkumaResetStopError, removeAkumaCustody, removeEmptyDirectory, removeKnownRegularFile } from "./custody.js";
 import { classifyHeartSchema, readHeart } from "./heart/index.js";
 import { akumaRunRoot } from "./identity.js";
-export class AkumaResetStopError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "AkumaResetStopError";
-    }
-}
+export { AkumaResetStopError } from "./custody.js";
 async function hasAkumaCustody(paths) {
     try {
         const value = await lstat(paths.heart);
@@ -29,98 +26,10 @@ async function stopRunningAkuma(entry) {
         return settled.leash;
     throw new AkumaResetStopError(`Akuma ${entry.id} could not be stopped: ${settled.evidence}`);
 }
-async function removeKnownRegularFile(path) {
-    try {
-        const value = await lstat(path);
-        if (!value.isFile() || value.isSymbolicLink())
-            throw new AkumaResetStopError(`Akuma custody is not a regular file: ${path}`);
-        await rm(path, { force: true });
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function removeEmptyDirectory(path) {
-    try {
-        await rmdir(path);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT" && error.code !== "ENOTEMPTY")
-            throw error;
-    }
-}
-function isRequestSequenceName(name) {
-    const sequence = Number(name);
-    return /^\d+$/u.test(name) && Number.isSafeInteger(sequence) && String(sequence) === name;
-}
-const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
-function isRequestArtifactName(name) {
-    const match = /^(.*)\.(?:request|receipt)\.json$/u.exec(name);
-    return match !== null && UUID_V4.test(match[1]);
-}
-async function removeKnownRequestFile(path) {
-    try {
-        const value = await lstat(path);
-        if (!value.isFile() || value.isSymbolicLink())
-            return;
-        await rm(path, { force: true });
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function removeKnownRequestChannel(path) {
-    try {
-        const value = await lstat(path);
-        if (!value.isDirectory() || value.isSymbolicLink())
-            throw new AkumaResetStopError(`Akuma custody is not a directory: ${path}`);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    for (const name of await readdir(path)) {
-        if (!isRequestSequenceName(name))
-            continue;
-        const sequenceDir = join(path, name);
-        try {
-            const sequence = await lstat(sequenceDir);
-            if (!sequence.isDirectory() || sequence.isSymbolicLink())
-                continue;
-            for (const child of await readdir(sequenceDir)) {
-                if (isRequestArtifactName(child))
-                    await removeKnownRequestFile(join(sequenceDir, child));
-            }
-            await removeEmptyDirectory(sequenceDir);
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-    }
-    await removeEmptyDirectory(path);
-}
-async function removeAkumaEntry(entry) {
-    await removeKnownRequestChannel(entry.paths.requests);
-    for (const path of [
-        join(entry.paths.directory, "request-entry.json"),
-        entry.paths.log,
-        `${entry.paths.heart}-wal`,
-        `${entry.paths.heart}-shm`,
-        `${entry.paths.leash}-wal`,
-        `${entry.paths.leash}-shm`,
-        entry.paths.leash,
-        entry.paths.heart,
-    ]) {
-        await removeKnownRegularFile(path);
-    }
-    await removeEmptyDirectory(entry.paths.directory);
-}
 async function removeEmptyAkumaRunRoot(world) {
     const runRoot = akumaRunRoot(world);
+    const cache = basename(akumaLineageCachePath(world));
+    const custody = new Set([".gitignore", cache, `${cache}-wal`, `${cache}-shm`]);
     let names;
     try {
         names = await readdir(runRoot);
@@ -130,10 +39,10 @@ async function removeEmptyAkumaRunRoot(world) {
             return;
         throw error;
     }
-    if (names.some((name) => name !== ".gitignore"))
+    if (names.some((name) => !custody.has(name)))
         return;
-    if (names.includes(".gitignore"))
-        await removeKnownRegularFile(join(runRoot, ".gitignore"));
+    for (const name of names)
+        await removeKnownRegularFile(join(runRoot, name));
     await removeEmptyDirectory(runRoot);
     await removeEmptyDirectory(dirname(runRoot));
 }
@@ -177,7 +86,7 @@ export async function stopAkuma(world) {
             try {
                 await nukeAliases(world);
                 for (const entry of entries)
-                    await removeAkumaEntry(entry);
+                    await removeAkumaCustody(entry);
                 await removeEmptyAkumaRunRoot(world);
             }
             finally {

package/build/src/akuma/providers/pi/index.js

@@ -1,6 +1,6 @@
 import { abortable } from "../../abort.js";
 import { akumaExecutionEnvironment } from "../execution-environment.js";
-import { AgentEventChannel, createProviderAttempt, launchPrompt, modelEvent, tellRegistry, } from "../../provider.js";
+import { AgentEventChannel, createProviderAttempt, launchPrompt, modelEvent, noteEvent, tellRegistry, } from "../../provider.js";
 import { piSessionModel, piTerminalFailure, translatePiEvent } from "./events.js";
 const PI_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high", "xhigh", "max"]);
 const MODEL_PATTERN = /^[^/\s]+\/[^\s]+$/u;
@@ -70,9 +70,13 @@ async function createPiSession(sdk, execution, input) {
                     : { systemPromptOverride: () => input.options.systemPrompt },
             }),
     });
+    const extensionErrors = services.resourceLoader.getExtensions().errors ?? [];
+    for (const failure of extensionErrors)
+        console.error(`Pi extension load failed: ${failure.path}\n${failure.error}`);
     try {
         input.signal?.throwIfAborted();
-        return await sdk.createAgentSessionFromServices(piCreateOptions(sdk, input, services));
+        const created = await sdk.createAgentSessionFromServices(piCreateOptions(sdk, input, services));
+        return { created, extensionErrors };
     }
     catch (error) {
         // Before a session owns the extension runtime, failed selection/setup must
@@ -139,7 +143,7 @@ async function retirePiSession(native) {
         throw failure;
 }
 async function drivePi(sdk, execution, input, signal, custody) {
-    const created = await createPiSession(sdk, execution, input);
+    const { created, extensionErrors } = await createPiSession(sdk, execution, input);
     const native = created.session;
     let settleRetired;
     let failRetired;
@@ -248,6 +252,9 @@ async function drivePi(sdk, execution, input, signal, custody) {
     await abortable(binding, signal);
     signal.throwIfAborted();
     events.emit({ type: "session", coordinate: { sessionFile: native.sessionFile, sessionId: native.sessionId } });
+    for (const failure of extensionErrors) {
+        events.emit(noteEvent(`Pi extension load failed: ${failure.path}: ${failure.error}`));
+    }
     const sessionModel = piSessionModel(native.model);
     if (sessionModel !== undefined)
         events.emit(modelEvent(sessionModel));

package/build/src/akuma/retention.d.ts

@@ -0,0 +1,44 @@
+import type { KnownAkuma } from "./akuma.js";
+/** The one default age after which an inactive Akuma entry may be retired. */
+export declare const AKUMA_RETENTION_MAX_IDLE_MS: number;
+/** The retention owner's one clock reading; the sweep itself never reads ambient time. */
+export declare function retentionNow(): number;
+export type AkumaRetentionReceipt = "retired" | "retained" | "busy";
+/** A cross-authority custody decision that may hold its locks across the effect. */
+export type AkumaRetirementCustody = (retire: () => Promise<boolean>) => Promise<AkumaRetentionReceipt>;
+/**
+ * The later durable life or activity instant, or null when either present
+ * timestamp cannot be read. A missing timestamp contributes nothing; a
+ * malformed one means this observation cannot prove age.
+ */
+export declare function latestRetentionActivity(lifeAtValue: string | null, lastActivityAt: string | null): number | null;
+/**
+ * A cheap metadata bound, never semantic proof. Only a Heart whose last
+ * filesystem write is already older than the retention age reaches a Heart
+ * open; unreadable metadata stays conservative and skips the candidate.
+ */
+export declare function retentionCandidateBound(paths: KnownAkuma["paths"], now: number): Promise<boolean>;
+/**
+ * One born, readable, stopped entry whose durable activity is strictly older
+ * than the default retention age. Unborn, stillborn, running, pending-input,
+ * malformed, and missing-age entries never become candidates.
+ */
+export declare function readRetentionCandidate(entry: KnownAkuma, now: number): Promise<KnownAkuma | null>;
+/**
+ * Revalidate one candidate under exclusive stopped custody and remove its
+ * recognized custody. The caller's custody action runs while the leash is
+ * held and may hold Alias or Dispatch publication custody across the `retire`
+ * action, so a concurrent wake, alias move, or new Dispatch cannot interleave
+ * between the final judgment and removal. `retire` itself re-reads Heart as the
+ * last step before deleting and refuses when the entry is no longer eligible.
+ * Tell admission has no shared custody here: a pending Tell observed by that
+ * final read is preserved, but an admission immediately after it is a
+ * documented best-effort boundary, not an atomic guarantee. A busy leash,
+ * changed Heart, admitted pending input, or refused judgment leaves the entry
+ * intact.
+ */
+export declare function retireInactiveAkuma(input: Readonly<{
+    entry: KnownAkuma;
+    now: number;
+    retireUnderCustody: AkumaRetirementCustody;
+}>): Promise<AkumaRetentionReceipt>;

package/build/src/akuma/retention.js

@@ -0,0 +1,106 @@
+import { lstat } from "node:fs/promises";
+import { rosterListRow } from "./akuma-observe.js";
+import { removeAkumaCustody } from "./custody.js";
+import { HeldAkumaLeash, life, lifeAt, readHeart } from "./heart/index.js";
+/** The one default age after which an inactive Akuma entry may be retired. */
+export const AKUMA_RETENTION_MAX_IDLE_MS = 15 * 24 * 60 * 60 * 1_000;
+/** The retention owner's one clock reading; the sweep itself never reads ambient time. */
+export function retentionNow() {
+    return new Date().getTime();
+}
+/**
+ * The later durable life or activity instant, or null when either present
+ * timestamp cannot be read. A missing timestamp contributes nothing; a
+ * malformed one means this observation cannot prove age.
+ */
+export function latestRetentionActivity(lifeAtValue, lastActivityAt) {
+    const instants = [lifeAtValue, lastActivityAt].flatMap((value) => (value === null ? [] : [Date.parse(value)]));
+    if (instants.some((instant) => !Number.isFinite(instant)))
+        return null;
+    return instants.length === 0 ? null : Math.max(...instants);
+}
+/** The strict age cutoff shared by candidate reading and final revalidation. */
+function isStale(now, activityAt) {
+    return activityAt !== null && now - activityAt > AKUMA_RETENTION_MAX_IDLE_MS;
+}
+/**
+ * A cheap metadata bound, never semantic proof. Only a Heart whose last
+ * filesystem write is already older than the retention age reaches a Heart
+ * open; unreadable metadata stays conservative and skips the candidate.
+ */
+export async function retentionCandidateBound(paths, now) {
+    const read = async (path) => {
+        try {
+            const value = await lstat(path);
+            return value.isFile() ? value.mtimeMs : Number.POSITIVE_INFINITY;
+        }
+        catch (error) {
+            return error.code === "ENOENT" ? 0 : Number.POSITIVE_INFINITY;
+        }
+    };
+    const bound = Math.max(await read(paths.heart), await read(`${paths.heart}-wal`));
+    if (!Number.isFinite(bound))
+        return false;
+    return bound < now - AKUMA_RETENTION_MAX_IDLE_MS;
+}
+/**
+ * One born, readable, stopped entry whose durable activity is strictly older
+ * than the default retention age. Unborn, stillborn, running, pending-input,
+ * malformed, and missing-age entries never become candidates.
+ */
+export async function readRetentionCandidate(entry, now) {
+    const row = await rosterListRow(entry.paths, entry.id);
+    if (!("lifeAt" in row) || row.life === "running" || row.pending.length > 0)
+        return null;
+    return isStale(now, latestRetentionActivity(row.lifeAt, row.lastActivityAt)) ? entry : null;
+}
+function currentStoppedActivity(snapshot) {
+    const soul = snapshot.soul;
+    if (soul === null)
+        return null;
+    if (snapshot.latestBody?.end === undefined)
+        return null;
+    if (snapshot.pending.length > 0)
+        return null;
+    const currentLife = life({ leash: "free", body: snapshot.latestBody, kill: snapshot.latestKill });
+    if (currentLife === "running")
+        return null;
+    return latestRetentionActivity(lifeAt(currentLife, snapshot.latestBody, snapshot.latestKill, soul.createdAt), snapshot.lastActivityAt);
+}
+/**
+ * Revalidate one candidate under exclusive stopped custody and remove its
+ * recognized custody. The caller's custody action runs while the leash is
+ * held and may hold Alias or Dispatch publication custody across the `retire`
+ * action, so a concurrent wake, alias move, or new Dispatch cannot interleave
+ * between the final judgment and removal. `retire` itself re-reads Heart as the
+ * last step before deleting and refuses when the entry is no longer eligible.
+ * Tell admission has no shared custody here: a pending Tell observed by that
+ * final read is preserved, but an admission immediately after it is a
+ * documented best-effort boundary, not an atomic guarantee. A busy leash,
+ * changed Heart, admitted pending input, or refused judgment leaves the entry
+ * intact.
+ */
+export async function retireInactiveAkuma(input) {
+    const leash = await HeldAkumaLeash.try(input.entry.paths);
+    if (leash === null)
+        return "busy";
+    try {
+        const eligible = async () => {
+            const snapshot = await readHeart(input.entry.paths);
+            if (snapshot.soul === null || snapshot.soul.id !== input.entry.id)
+                return false;
+            return isStale(input.now, currentStoppedActivity(snapshot));
+        };
+        if (!(await eligible()))
+            return "retained";
+        return await input.retireUnderCustody(async () => {
+            if (!(await eligible()))
+                return false;
+            await removeAkumaCustody(input.entry);
+            return true;
+        });
+    }
+    finally {
+        leash.release();
+    }
+}