@cluesmith/codev 3.2.3 → 3.3.0

package/dist/agent-farm/servers/mailbox-delivery.js

@@ -0,0 +1,617 @@
+/**
+ * Mailbox delivery orchestration (Spec 1313, Phase 4).
+ *
+ * The single gate-checked delivery path: **persist → serialize → gate → deliver |
+ * hold**. Both the send request (`handleSend`, after it enqueues) and the periodic
+ * backstop drainer route every GATED delivery through {@link deliverAgentMail}, so for
+ * gate-checked delivery a message body reaches a PTY in exactly one place — and only
+ * onto a prompt the render-gate has proven empty. This is what eliminates corruption by
+ * construction for that path: a message can never fuse with a draft, because it is never
+ * delivered while one exists; and there is no force path.
+ *
+ * TWO deliberate exceptions write a body OUTSIDE this path, both explicit human
+ * gate-bypasses documented at their `tower-routes.ts` call sites: immediate `--interrupt`
+ * (Ctrl+C then the message) and `--escape` (a bare ESC). They are the operator's "I am at
+ * this terminal now" actions and take the separate per-terminal submission lock
+ * (`session-submit.ts`), not the per-agent serializer here — every autonomous/scheduled/
+ * held send, by contrast, delivers through this gate.
+ *
+ * This module replaces the in-memory `SendBuffer` (retired in this phase): held
+ * messages now live in the durable `mailbox` table, so nothing is lost to a Tower
+ * crash/restart, and shutdown no longer force-flushes onto the line.
+ *
+ * Everything the delivery logic touches at the edges — resolving the live session
+ * for an agent, resolving its classifier profile (incl. the wrapped-launch
+ * fallback), running the gate, writing, broadcasting — is injected via
+ * {@link DeliveryPorts}, so the orchestration is unit-testable without a live Tower.
+ */
+import path from 'node:path';
+import { findHeldForAgent, getById, listHeld, markDelivered, setHeldReason, pruneTerminal, findEscalatable, markEscalated, findStarvingAgents, } from '../db/mailbox.js';
+import { KeyedSerializer } from './write-queue.js';
+/**
+ * A gate outcome the render gate CANNOT bound to a decision — an unrecognized app
+ * (`no-profile`) or a recognized app whose composer region can't be found
+ * (`no-region-end`/`no-composer-marker` = a drifted TUI layout or an unrenderable #1047
+ * ring). A sustained streak of these means the mail will NEVER deliver on its own, so it
+ * is the class {@link MailboxDrainer.recordStreak} escalates to liveness telemetry; a
+ * `busy`/`user-text` streak is deliberately excluded (a human legitimately at the line).
+ * Shared by `recordStreak` and the cooldown branch of {@link MailboxDrainer.tick} so a
+ * skipped tick and a real pass agree on what counts as classifier-stuck (CMAP round 3).
+ */
+function isClassifierStuck(reason, detail) {
+    return reason === 'no-profile' || detail === 'no-region-end' || detail === 'no-composer-marker';
+}
+/**
+ * Composite key identifying an agent within a workspace, used to dedupe the
+ * backstop's per-agent work and to key the liveness-telemetry streak map (which
+ * Phase 7 consumes). Joined on a NUL — a byte that can appear in neither a
+ * filesystem path nor an agent id — so the key is collision-proof (a space
+ * separator would be ambiguous for paths/ids that contain spaces). Kept explicit
+ * (visible `\0`) and shared so callers never hand-roll the separator.
+ */
+export function agentKey(workspacePath, toAgent) {
+    return `${workspacePath}\0${toAgent}`;
+}
+/**
+ * A cheap, MONOTONE token of the session's rendered state plus the classify inputs
+ * (dimensions + resolved app). `bytesWritten` advances on ANY new output and never falls
+ * (Spec 1313 render-gate round 2 — the fix for the non-monotone `currentSeq:partialBytes`
+ * pair, which aliased once #1205's partial trim made `partialBytes` decrease), and the
+ * geometry catches a resize that reflows the screen without new output. So two samples that
+ * match mean the classified screen is byte-for-byte unchanged. Two consumers rely on that:
+ *   1. gate→write TOCTOU re-validation — sampled before the async classify and re-checked
+ *      after, so a keystroke landing during the classify holds instead of writing onto the
+ *      new draft;
+ *   2. the drainer's verdict memo ({@link CachedVerdict}) — a cached verdict is reused only
+ *      while this token is unchanged, so a static screen is classified once instead of
+ *      re-checked every 1.5 s backstop tick.
+ */
+function ringToken(session, profile) {
+    return `${session.bytesWritten}:${session.info.cols}x${session.info.rows}:${profile.app}`;
+}
+/** Reconstruct the delivered-message broadcast frame from a persisted row. */
+export function broadcastForRow(row, now) {
+    return {
+        type: 'message',
+        from: {
+            project: row.from_workspace ? path.basename(row.from_workspace) : undefined,
+            agent: row.from_agent ?? undefined,
+        },
+        to: { project: path.basename(row.workspace_path), agent: row.to_agent },
+        content: row.body,
+        metadata: { source: 'mailbox' },
+        timestamp: now,
+    };
+}
+/**
+ * Run one delivery pass for a single agent against the live gate.
+ *
+ * Delivers the **oldest** held message when — and only when — the composer is a
+ * render-verified empty prompt; the rest wait for the next clean gate (the just-
+ * delivered message's Enter submits and makes the line busy, so at most one lands
+ * per pass — never a blob). When it cannot deliver, it refreshes every held row's
+ * `reason` to the current gate verdict so `afx inbox` and the send response stay
+ * accurate. Idempotent and race-safe: `markDelivered` only transitions a still-held
+ * row, so a backstop tick racing a request-path delivery can never double-send.
+ */
+export async function deliverAgentMail(ports, db, workspacePath, toAgent, memo) {
+    // Spec 1313 round 3: ELIGIBLE held rows only — a pre-due delayed send (`not_before > now`)
+    // is excluded, so it neither delivers early nor blocks a later normal message. An agent
+    // whose only mail is pre-due looks "empty" here (reason null → not stuck), and the row
+    // becomes eligible on the first pass at/after its due time (backstop granularity is fine —
+    // the delay is a lower bound).
+    const held = findHeldForAgent(db, workspacePath, toAgent, ports.now());
+    if (held.length === 0)
+        return { delivered: [], reason: null };
+    const hold = (reason) => {
+        for (const row of held) {
+            if (row.reason !== reason)
+                setHeldReason(db, row.id, reason, ports.now());
+        }
+        return { delivered: [], reason };
+    };
+    const session = ports.getSessionForAgent(workspacePath, toAgent);
+    if (!session)
+        return hold('no-live-pty');
+    const profile = ports.resolveProfile(session);
+    if (!profile)
+        return hold('no-profile');
+    // Sample the ring's change-token BEFORE the (possibly memoized) classify, so we can
+    // re-validate afterward that the screen didn't move under us (below).
+    const tokenBefore = ringToken(session, profile);
+    // Verdict memo (Spec 1313 render-gate follow-up). The 1.5 s backstop re-checks every held
+    // agent's screen each tick; for a STATIC screen that classify is pure waste. Reuse the
+    // cached verdict while BOTH the live session instance AND the token are unchanged — the token
+    // advances on ANY new output, so a match means the screen is byte-for-byte what we already
+    // classified, and the session guard closes the PTY-respawn aliasing route (a replacement
+    // session is a DIFFERENT object); the monotone token closes the old `RingBuffer.clear()` route
+    // (see {@link CachedVerdict}). A memo hit does NO await, so the post-classify re-validation
+    // below (`ringToken(...) !== tokenBefore`) passes trivially: no keystroke can land in a
+    // classify window that never opened. The memo is owned + bounded by the drainer's backstop
+    // {@link MailboxDrainer.tick} (pruned to the held-agent set each tick); every OTHER caller —
+    // the request/cron paths and the fast scheduleDrain trigger — passes none and classifies
+    // fresh, so an event-driven re-check is never served a cached verdict.
+    const cacheKey = agentKey(workspacePath, toAgent);
+    const cached = memo?.get(cacheKey);
+    let verdict;
+    if (cached && cached.session === session && cached.token === tokenBefore) {
+        verdict = cached.verdict;
+    }
+    else {
+        verdict = await ports.classify(session, profile);
+        memo?.set(cacheKey, { session, token: tokenBefore, verdict });
+    }
+    if (!verdict.clean) {
+        // Carry the gate detail so a sustained classifier-stuck streak (a drifted profile
+        // or an unrenderable frame) escalates to liveness telemetry instead of holding silently.
+        const reason = verdict.reason ?? 'busy';
+        for (const row of held) {
+            if (row.reason !== reason)
+                setHeldReason(db, row.id, reason, ports.now());
+        }
+        return { delivered: [], reason, detail: verdict.detail };
+    }
+    // Re-validate the SCREEN before writing (Spec 1313 render-gate diff review). The classify
+    // above may have awaited (the mirror flushes its parser, and xterm yields between parse
+    // slices); if the screen advanced since we sampled `tokenBefore`, a draft may have started
+    // under us and the clean verdict is now stale. Writing then would fuse the message into that
+    // draft — the exact false-clean the gate prevents. Hold instead; it delivers on the next
+    // clean tick. (On a memo hit no await occurred, so the token is unchanged and this passes
+    // trivially.)
+    if (ringToken(session, profile) !== tokenBefore)
+        return hold('busy');
+    // Clean, verified-empty prompt → deliver the oldest held message. Await the
+    // write's paced completion so a serialized follow-up delivery never begins
+    // until this message's text + Enter is fully on the wire.
+    const row = held[0];
+    // Re-validate at the delivery instant (Spec 1313 iter-1 review, Codex). The held
+    // list and the gate verdict were read before this point, and dismiss/supersede are
+    // independent DB writes NOT routed through the per-agent delivery serializer — so a
+    // resolve that landed in the gate→write window must not still put bytes on the wire.
+    // better-sqlite3 is synchronous, so this re-read reflects any dismiss/supersede
+    // committed up to now; the irreducible residual (a resolve during the paced write
+    // itself) is the accepted gate→write race in the spec's Risks table.
+    const current = getById(db, row.id);
+    if (!current || current.status !== 'held') {
+        ports.onHeldStateChange(); // the held set changed under us → refresh the indicator
+        return { delivered: [], reason: null };
+    }
+    // Fast-path an already-dead session (#1198: a dead shellper socket still reports
+    // status 'running', and its writes are dropped). This t=0 precheck avoids a pointless
+    // paced write when the PTY is unwritable before we even start; it is NOT the whole
+    // guard — a socket that dies DURING the paced text→…→Enter sequence is invisible here
+    // and surfaces instead as a dropped-write `false` from writeMessage (handled below).
+    // Either way the row is held ("an errored PTY write leaves the row held"), never marked
+    // delivered off the paced-write timer.
+    if (!session.writable)
+        return hold('no-live-pty');
+    // Default false so an unobserved result is the SAFE failure mode (hold, never a false
+    // delivery); the try either assigns the real boolean or throws past this point.
+    let written = false;
+    try {
+        written = await ports.writeMessage(session, current.formatted_message, current.no_enter === 1);
+    }
+    finally {
+        // Invalidate the memo on EVERY write outcome — a clean `true`, a dropped-write `false`, OR a
+        // rejection — and BEFORE the markDelivered/held decisions below (CMAP round 3 moved it above the
+        // guard; round 4 — Codex — made it rejection-safe via this finally). The write is what makes the
+        // cached CLEAN verdict stale (it put the submitted line + a fresh prompt on the wire, or some of
+        // its bytes), regardless of whether the row then transitions, holds, or the write completes
+        // cleanly. Ways a leftover CLEAN would leak, all closed here: (a) a dismiss/supersede lands during
+        // the paced write → markDelivered returns false and we early-return below, bytes already out;
+        // (b) a dropped write reports `false` (Spec 1313 integration review — silent-loss fix) after
+        // putting SOME bytes on the wire, e.g. the text landed but the Enter dropped → we hold below;
+        // (c) writeMessage REJECTS after partial bytes — its port contract (`boolean | Promise<boolean>`)
+        // permits a binding to throw, and a bare throw would skip a delete placed after the await. In
+        // every case a leftover CLEAN would let a follow-up held message memo-hit the SAME token (PTY
+        // INPUT does not advance the ring — only OUTPUT does) and write onto the not-yet-echoed line, so
+        // the memo must die here. The deeper input-echo-lag window — a fresh classify racing the echo — is
+        // the pre-existing gate→write INPUT race in the review's Technical Debt.
+        memo?.delete(cacheKey);
+    }
+    // A dropped PTY write (#1198) means zero-or-partial bytes reached the terminal — the exact silent
+    // loss this spec exists to prevent (Spec 1313 integration review — Codex). The t=0 `writable`
+    // precheck above cannot catch a socket that dies mid-pace (the text/lines/Enter fire across
+    // setTimeout gaps), so writeMessage threads the per-write result: `false` → no complete submit
+    // landed. Hold the row (`no-live-pty`, retried on the next clean gate pass) instead of marking it
+    // delivered. Any bytes already on the wire only make the line dirty; the render gate then holds on
+    // that draft until the session recovers or is torn down — it can never be marked delivered on a
+    // dead PTY.
+    if (!written)
+        return hold('no-live-pty');
+    // markDelivered is guarded (held→delivered only). If it did NOT transition, the row
+    // was dismissed/superseded during the paced write — accept that terminal state and
+    // do not broadcast a delivery for it.
+    if (!markDelivered(db, row.id, ports.now())) {
+        ports.onHeldStateChange();
+        return { delivered: [], reason: null };
+    }
+    ports.broadcast(broadcastForRow(current, ports.now()));
+    ports.onHeldStateChange(); // a held row left the set → refresh the indicator count
+    ports.log(`[mailbox] delivered ${row.id} → ${toAgent} @ ${path.basename(workspacePath)}`);
+    return { delivered: [row.id], reason: null };
+}
+/**
+ * Shared per-agent delivery serializer (Spec 1313, Phase 4). Every live caller —
+ * the `afx send` request path and the backstop drainer — funnels delivery for a
+ * given agent through this one instance, so a `pick → gate → write → mark`
+ * critical section can never overlap another for the same agent. That is what
+ * makes the spike `w1a` blob (two concurrent sends fusing into one submit)
+ * impossible: the second delivery cannot even read the gate until the first has
+ * fully written its text + Enter (see {@link KeyedSerializer}).
+ */
+const deliverySerializer = new KeyedSerializer();
+/**
+ * {@link deliverAgentMail}, serialized per agent through the shared
+ * {@link KeyedSerializer}. This is the entry point every live caller must use;
+ * the bare `deliverAgentMail` is exported only so unit tests can drive a single
+ * pass deterministically.
+ */
+export function deliverAgentMailSerialized(ports, db, workspacePath, toAgent, memo) {
+    return deliverySerializer.run(agentKey(workspacePath, toAgent), () => deliverAgentMail(ports, db, workspacePath, toAgent, memo));
+}
+const DEFAULT_BACKSTOP_INTERVAL_MS = 1500;
+// Spec 1313 (baked decision 7): terminal rows are pruned after a bounded window,
+// default 30 days, configurable via `.codev/config.json` (mailbox.retentionDays) —
+// `startMailboxDrainer` reads it and passes it in. This constant is the fallback
+// when the drainer is constructed without an explicit value (e.g. unit tests).
+const DEFAULT_PRUNE_RETENTION_DAYS = 30;
+// Spec 1313 (Phase 7): a held row older than this crosses the escalation age — the
+// drainer flags it `escalated` and emits the visibility broadcast (NEVER delivers).
+// Default 60s (matches today's max-age); `startMailboxDrainer` overrides from config.
+const DEFAULT_ESCALATION_MS = 60_000;
+// Spec 1313 (Phase 7): after this many consecutive not-clean gate verdicts for an agent
+// whose reason is `no-profile`, the drainer logs a loud liveness warning — a sustained
+// no-profile streak means the session's app is unrecognized (broken/unknown classifier),
+// so its mail will never deliver. The threshold filters transient boot/relaunch screens,
+// which resolve well before it.
+const LIVENESS_STREAK_THRESHOLD = 10;
+// Spec 1313 round 3 (change 3): the owner-notice threshold is a small MULTIPLE of the
+// escalation age — a row must be deliverable-but-stuck for this much longer than the basic
+// `escalated` flag before its owner architect is alarmed, so a briefly-busy line does not
+// spam owners. Derived from escalationMs (default 60s → 180s), so it scales with the
+// configured `mailbox.escalationSeconds` without a separate config knob.
+const DEFAULT_OWNER_NOTICE_MULTIPLE = 3;
+/**
+ * The poll backstop that replaces `SendBuffer`'s flush timer. On each tick it walks
+ * every agent with held mail and runs {@link deliverAgentMail}, so a message held
+ * on a busy line delivers on the first tick after the line clears (Phase 5 adds the
+ * fast submit/quiescence triggers on top). It also prunes terminal rows on boot and
+ * per tick, and tracks a per-agent consecutive-not-clean streak for liveness
+ * telemetry (Phase 7 surfaces it as a loud log/broadcast). Shutdown just stops the
+ * timer — nothing is force-flushed, because every held row is already persisted.
+ */
+export class MailboxDrainer {
+    timer;
+    ticking = false;
+    ports;
+    db;
+    intervalMs;
+    retentionDays;
+    escalationMs;
+    ownerNoticeMs;
+    notCleanStreak = new Map();
+    // Spec 1313 round 3 (change 3): agents for which an owner starvation notice has already been
+    // raised this Tower lifetime — so the notice fires ONCE per episode, not once per tick. An
+    // entry is cleared when the agent's eligible held set drains (its starvation is over), which
+    // also fires `clearHeldOwnerNotice`. In-memory (like the streak map); after a restart a still-
+    // starving agent re-notifies once, and `supersede` keeps that to a single pending row.
+    notifiedAgents = new Set();
+    // Spec 1313 Phase 5: agents with a fast-trigger drain already queued. A burst of
+    // submit/quiescence signals for one agent coalesces onto the same pending promise
+    // (one gate check, not one per trigger); the slot is released when the pass begins.
+    scheduledDrains = new Map();
+    // Spec 1313 render-gate verdict memo: a cached gate verdict per agent, keyed on the session
+    // instance + monotone change-token, so a STATIC held screen skips its re-classify every tick.
+    // Owned here so it stays bounded — {@link tick} prunes it to the current held-agent set. (The
+    // CMAP-round-1 big-ring backstop backoff that used to sit alongside this is retired in round 2:
+    // with the persistent bounded mirror, a classify is O(viewport) regardless of history, so there
+    // is no expensive whole-ring render left to throttle — every tick just re-classifies cheaply.)
+    verdictMemo = new Map();
+    // Lifecycle generation (CMAP round 2 — Codex/Claude): the drainer instance is REUSED across
+    // stop()/start() (mailbox-wiring `ensureDrainer`), and the tests do start/stop/start. Bumped on
+    // stop() so an in-flight tick/scheduleDrain that resumes after a restart bails before mutating
+    // this generation's state.
+    generation = 0;
+    constructor(opts = {}) {
+        this.intervalMs = opts.intervalMs ?? DEFAULT_BACKSTOP_INTERVAL_MS;
+        this.retentionDays = opts.pruneRetentionDays ?? DEFAULT_PRUNE_RETENTION_DAYS;
+        this.escalationMs = opts.escalationMs ?? DEFAULT_ESCALATION_MS;
+        this.ownerNoticeMs = opts.ownerNoticeMs ?? this.escalationMs * DEFAULT_OWNER_NOTICE_MULTIPLE;
+    }
+    start(ports, db) {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.ports = ports;
+        this.db = db;
+        pruneTerminal(db, this.retentionDays, ports.now()); // boot prune
+        this.timer = setInterval(() => void this.tick(), this.intervalMs);
+        if (typeof this.timer.unref === 'function')
+            this.timer.unref();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+        this.ports = undefined;
+        this.db = undefined;
+        // Drop all per-agent transient state (CMAP round 1/2 — Codex/Claude): the drainer instance is
+        // REUSED across stop()/start(), so a restart must not carry a stale verdict/streak/backoff, nor
+        // let a post-restart trigger coalesce onto a dead scheduled-drain promise. NB clearing
+        // `scheduledDrains` does NOT cancel an already-running drain — its promise captured the old
+        // ports/db and runs to completion; it only stops a new trigger from coalescing onto it. Two
+        // guards make that resumption safe (CMAP round 3): (1) the `generation` bump below — checked by
+        // both `tick` and `scheduleDrain` right after each await — stops an in-flight pass from re-seeding
+        // THIS generation's freshly-cleared streak/scheduled-drain slot. (The verdict memo can still be
+        // seeded from INSIDE a resumed `deliverAgentMail`, before that check, but that is benign: the memo
+        // is bound to its session instance + change token and re-pruned to the held-agent set at the top of
+        // every tick, so a cross-generation entry is self-correcting, not a leak.) And (2) both passes now
+        // run their work under a try/catch, so a throw on the old (closed) DB is logged, not an
+        // unhandledRejection that would exit(1). (Pre-round-3, `tick` had no catch, so a closed-DB throw
+        // there was NOT harmless.)
+        this.verdictMemo.clear();
+        this.notCleanStreak.clear();
+        this.scheduledDrains.clear();
+        this.notifiedAgents.clear();
+        this.generation++;
+    }
+    /** Per-agent consecutive not-clean count (liveness telemetry; Phase 7 reads this). */
+    get streaks() {
+        return this.notCleanStreak;
+    }
+    /**
+     * Agent keys that currently hold a cached gate verdict (render-gate memo).
+     * Observability/test only: {@link tick} prunes this to the current held-agent set, so
+     * it never grows past the number of agents holding mail.
+     */
+    get memoizedAgents() {
+        return [...this.verdictMemo.keys()];
+    }
+    /** One backstop pass. Guarded against re-entry so a slow gate can't overlap ticks. */
+    async tick() {
+        const ports = this.ports;
+        const db = this.db;
+        if (!ports || !db || this.ticking)
+            return;
+        this.ticking = true;
+        const gen = this.generation; // bail if stop() runs mid-tick (the drainer instance is reused)
+        try {
+            const agents = new Map();
+            for (const row of listHeld(db)) {
+                agents.set(agentKey(row.workspace_path, row.to_agent), {
+                    workspacePath: row.workspace_path,
+                    toAgent: row.to_agent,
+                });
+            }
+            // Prune the verdict memo to the current held-agent set before the pass: an agent whose
+            // mail all delivered/dismissed is no longer walked here, so its cached verdict would
+            // otherwise leak for the life of the process. Bounds the memo to |held agents|.
+            for (const key of this.verdictMemo.keys()) {
+                if (!agents.has(key))
+                    this.verdictMemo.delete(key);
+            }
+            for (const [key, { workspacePath, toAgent }] of agents) {
+                if (this.generation !== gen)
+                    return; // stop() ran mid-tick → bail before more work
+                // Isolate each agent's pass (CMAP round 3 — Claude): a throw from classify/writeMessage/DB
+                // for ONE agent must not abort the others, and — critically — must never escape this
+                // setInterval-invoked tick, where the tower-server `unhandledRejection` handler would
+                // exit(1) and take Tower + every terminal down. scheduleDrain already wraps its drain the
+                // same way; this mirrors it so the round-2 stop() comment's "throws harmlessly" is true
+                // for the backstop tick too, not just the scheduled drain.
+                try {
+                    // Every tick re-classifies cheaply now (Spec 1313 round 2): the persistent mirror makes a
+                    // classify O(viewport), independent of history, so there is no expensive whole-ring render
+                    // to throttle — the CMAP-round-1 big-ring cooldown is retired. The verdict memo still skips
+                    // the re-classify for a STATIC screen (unchanged token); a moving screen just re-checks.
+                    const outcome = await deliverAgentMailSerialized(ports, db, workspacePath, toAgent, this.verdictMemo);
+                    if (this.generation !== gen)
+                        return; // stop() landed during the await → do NOT mutate the
+                    // NEW generation's freshly-cleared streak map
+                    this.recordStreak(key, outcome);
+                }
+                catch (err) {
+                    ports.log(`[mailbox] backstop delivery failed for ${toAgent}: ${String(err)}`);
+                }
+            }
+            if (this.generation !== gen)
+                return; // stop() ran during the loop → skip escalation/prune
+            this.escalateOverdue(ports, db);
+            this.noticeOverdue(ports, db);
+            pruneTerminal(db, this.retentionDays, ports.now());
+        }
+        catch (err) {
+            // Backstop for escalateOverdue/pruneTerminal (DB ops) or anything the per-agent guard missed:
+            // a tick runs under setInterval, so an unhandled throw becomes an unhandledRejection → exit(1)
+            // (tower-server). Log and let the next tick retry (CMAP round 3 — Claude).
+            ports?.log(`[mailbox] backstop tick failed: ${String(err)}`);
+        }
+        finally {
+            this.ticking = false;
+        }
+    }
+    /**
+     * Escalation pass (Spec 1313, Phase 7). Flags every held row that has crossed the
+     * escalation age (`escalationMs`, default 60s) as `escalated` and emits the
+     * `onEscalation` visibility broadcast + a loud log. **VISIBILITY ONLY — it never
+     * delivers.** `findEscalatable` returns only not-yet-escalated held rows and
+     * `markEscalated` is idempotent, so each row escalates (and broadcasts) exactly
+     * once; the row still delivers only on a later clean gate pass, and the attention
+     * state clears when it resolves (the row leaves the held set).
+     */
+    escalateOverdue(ports, db) {
+        const now = ports.now();
+        let escalatedAny = false;
+        for (const row of findEscalatable(db, this.escalationMs, now)) {
+            if (!markEscalated(db, row.id, now))
+                continue;
+            escalatedAny = true;
+            // Age from the escalation START (max(created_at, not_before)) so a delayed row's clock
+            // runs from its DUE time, not its enqueue time (Spec 1313 round 3). For a normal row
+            // not_before is null → this is created_at, unchanged from before.
+            const ageMs = now - Math.max(row.created_at, row.not_before ?? row.created_at);
+            ports.onEscalation({
+                workspacePath: row.workspace_path,
+                toAgent: row.to_agent,
+                mailboxId: row.id,
+                ageMs,
+                reason: row.reason,
+            });
+            ports.log(`[mailbox] ESCALATED ${row.id.slice(0, 8)}… → ${row.to_agent} @ ${path.basename(row.workspace_path)} ` +
+                `(held ${Math.round(ageMs / 1000)}s, reason ${row.reason ?? 'held'}) — visibility only, not delivered`);
+        }
+        // A row's escalated flag flipped → the overview-derived `mailboxEscalated` attention
+        // bit changed. Fire the held-state-change event too (in addition to the per-row
+        // `mailbox-escalation` above) so a client that refetches /api/overview on
+        // `overview-changed` picks up the new attention state and never shows a stale flag.
+        if (escalatedAny)
+            ports.onHeldStateChange();
+    }
+    /** Agents with a pending owner starvation notice this lifetime (test/observability). */
+    get notifiedOwnerAgents() {
+        return [...this.notifiedAgents];
+    }
+    /**
+     * Owner starvation-notice pass (Spec 1313 round 3, change 3). When an agent's OLDEST eligible
+     * held row has been deliverable-but-stuck past the owner-notice threshold, alarm the agent's
+     * OWNER exactly once per episode via {@link DeliveryPorts.escalateHeldToOwner} — the live
+     * binding resolves the recipient architect (spawning → workspace `main` → first-registered),
+     * skips agents that are themselves architects, and enqueues ONE coalesced, gate-delivered
+     * notice. When a previously-notified agent's eligible held set drains, the pending notice is
+     * cleared via {@link DeliveryPorts.clearHeldOwnerNotice}. VISIBILITY ONLY — never delivers.
+     *
+     * The two spec guards hold by construction: {@link findStarvingAgents} excludes PRE-DUE
+     * delayed rows (a scheduled send is not stuck) and NOTICE rows themselves (a notice can never
+     * trigger a notice). The once-per-episode guard is {@link notifiedAgents}, armed ONLY after a
+     * notice is actually enqueued (an `escalateHeldToOwner` that no-ops — no architect yet, or the
+     * recipient is itself an architect — leaves the guard unset and retries next tick);
+     * `escalateHeldToOwner` additionally coalesces via a supersede key, so even a post-restart
+     * re-notify stays a single pending row.
+     */
+    noticeOverdue(ports, db) {
+        // No notice wiring (a unit fake without these ports) → nothing to do.
+        if (!ports.escalateHeldToOwner && !ports.clearHeldOwnerNotice)
+            return;
+        const now = ports.now();
+        const cutoff = now - this.ownerNoticeMs;
+        const withEligibleHeld = new Set();
+        for (const agent of findStarvingAgents(db, now)) {
+            const key = agentKey(agent.workspacePath, agent.toAgent);
+            withEligibleHeld.add(key);
+            if (agent.stuckSince <= cutoff && !this.notifiedAgents.has(key)) {
+                // Arm the once-per-episode guard ONLY when a notice was actually enqueued. The binding
+                // no-ops (returns false) when the recipient is itself an architect or no architect is
+                // registered yet; marking the agent notified on that no-op would suppress the alarm for
+                // the rest of the episode even after an architect appears. A falsy/absent return leaves
+                // the key unset so the next tick retries.
+                const enqueued = ports.escalateHeldToOwner?.({
+                    workspacePath: agent.workspacePath,
+                    toAgent: agent.toAgent,
+                    reason: agent.reason,
+                    ageMs: now - agent.stuckSince,
+                    heldCount: agent.count,
+                });
+                if (enqueued)
+                    this.notifiedAgents.add(key);
+            }
+        }
+        // A previously-notified agent with no eligible non-notice held row left has drained
+        // (delivered/dismissed, or only pre-due scheduled rows remain) → clear the moot notice.
+        for (const key of [...this.notifiedAgents]) {
+            if (withEligibleHeld.has(key))
+                continue;
+            this.notifiedAgents.delete(key);
+            const [ws, agent] = key.split('\0');
+            ports.clearHeldOwnerNotice?.(ws, agent);
+        }
+    }
+    /**
+     * Update the per-agent liveness streak from a delivery outcome (Phase 7 surfaces
+     * it): a delivered or empty pass clears the streak; a held pass grows it. Shared by
+     * the backstop {@link tick} and the fast {@link scheduleDrain} trigger so both feed
+     * the same telemetry.
+     */
+    recordStreak(key, outcome) {
+        if (outcome.delivered.length > 0 || outcome.reason === null) {
+            this.notCleanStreak.delete(key);
+            return;
+        }
+        const next = (this.notCleanStreak.get(key) ?? 0) + 1;
+        this.notCleanStreak.set(key, next);
+        // Liveness telemetry (Spec 1313, Phase 7 — spec line 91; extended in the render-gate
+        // hardening): a sustained streak that the gate CANNOT verify means the mail will
+        // NEVER deliver on its own — surface it instead of holding silently. Two such classes:
+        //   • `no-profile` — the app is unrecognized (a net-new or drifted classifier);
+        //   • a classifier-stuck gate detail — a recognized app whose composer can't be bounded
+        //     (`no-region-end`/`no-composer-marker` = a drifted TUI layout or an unrenderable
+        //     frame — e.g. a pathological #1047 ring whose whole-render yields no bounded
+        //     composer; this is the liveness net that replaced the removed over-ceiling hold).
+        // Scoped to those on purpose: a `busy`/`user-text` streak is a human legitimately at the
+        // line (Constraint 1 — must not false-alarm), and `no-live-pty` is no session at all.
+        // Reported once at the crossing (not per tick); the threshold filters transient boot/
+        // relaunch screens. The pure module only reports the crossing — the live binding
+        // ({@link DeliveryPorts.onLiveness}) applies the spec's "with recent output" gate and
+        // does the loud log + broadcast, so an idle unknown session does not false-alarm.
+        if (isClassifierStuck(outcome.reason, outcome.detail) && next === LIVENESS_STREAK_THRESHOLD) {
+            const [ws, agent] = key.split('\0');
+            this.ports?.onLiveness({ workspacePath: ws, toAgent: agent, streak: next });
+        }
+    }
+    /**
+     * Fast, event-driven delivery trigger (Spec 1313, Phase 5). A submit (Enter) or
+     * output-quiescence signal for a session schedules a single coalesced delivery pass
+     * for that agent, so a held message delivers within a microtask of the line
+     * clearing instead of waiting up to one backstop interval.
+     *
+     * Triggers are schedulers, never authority (spec Constraint): this runs the SAME
+     * gated {@link deliverAgentMailSerialized} the backstop does, so a spurious trigger
+     * on a still-busy screen simply re-holds, and a missed trigger only defers delivery
+     * to the next backstop tick — a trigger can never corrupt anything.
+     *
+     * Coalescing: while a pass is already queued for an agent, further triggers return
+     * the same in-flight promise (the gate runs once, not once per trigger). The slot is
+     * released just before the pass runs, so a trigger arriving *during* a pass queues
+     * exactly one follow-up; the per-agent {@link KeyedSerializer} keeps passes from
+     * overlapping. No-op (resolved) until the drainer is started, and never rejects — a
+     * gate/write error is logged and left for the backstop, mirroring the tick.
+     */
+    scheduleDrain(workspacePath, toAgent) {
+        const ports = this.ports;
+        const db = this.db;
+        if (!ports || !db)
+            return Promise.resolve();
+        const gen = this.generation; // bail if stop() runs before this queued drain executes
+        const key = agentKey(workspacePath, toAgent);
+        const existing = this.scheduledDrains.get(key);
+        if (existing)
+            return existing;
+        const run = Promise.resolve().then(async () => {
+            // Bail before touching ANY shared state if the generation moved (stopped/restarted before we
+            // ran → old ports/db), and release our coalescing slot only if it is still OURS (CMAP round 3
+            // — Codex). The old code deleted `scheduledDrains[key]` unconditionally and BEFORE the
+            // generation check: a stop()/start()+new scheduleDrain for the same key installs a NEW-
+            // generation run in that slot, and the unconditional delete would drop that live slot.
+            if (this.generation !== gen)
+                return;
+            if (this.scheduledDrains.get(key) === run)
+                this.scheduledDrains.delete(key);
+            try {
+                // NB: the fast trigger classifies FRESH (no verdict memo). A submit/quiescence
+                // trigger fires precisely because the ring just changed, so it must re-check the
+                // gate — the memo is the backstop tick's optimization for a STATIC ring, not this
+                // event-driven re-check. tick owns and prunes the memo alone.
+                const outcome = await deliverAgentMailSerialized(ports, db, workspacePath, toAgent);
+                if (this.generation !== gen)
+                    return; // stop() landed during the await → do NOT mutate the
+                // NEW generation's freshly-cleared streak map
+                this.recordStreak(key, outcome);
+            }
+            catch (err) {
+                ports.log(`[mailbox] scheduled drain failed for ${toAgent}: ${String(err)}`);
+            }
+        });
+        this.scheduledDrains.set(key, run);
+        return run;
+    }
+}
+//# sourceMappingURL=mailbox-delivery.js.map

package/dist/agent-farm/servers/mailbox-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox-delivery.js","sourceRoot":"","sources":["../../../src/agent-farm/servers/mailbox-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,QAAQ,EACR,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA4LnD;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CACxB,MAA4B,EAC5B,MAAyC;IAEzC,OAAO,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,oBAAoB,CAAC;AAClG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,aAAqB,EAAE,OAAe;IAC7D,OAAO,GAAG,aAAa,KAAK,OAAO,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAAC,OAAwB,EAAE,OAAoB;IAC/D,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAC5F,CAAC;AAuBD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,GAAW;IACzD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,KAAK,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;SACnC;QACD,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;QACvE,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC/B,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoB,EACpB,EAAqB,EACrB,aAAqB,EACrB,OAAe,EACf,IAAiC;IAEjC,2FAA2F;IAC3F,wFAAwF;IACxF,uFAAuF;IACvF,2FAA2F;IAC3F,+BAA+B;IAC/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE9D,MAAM,IAAI,GAAG,CAAC,MAAqB,EAAmB,EAAE;QACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;IAExC,oFAAoF;IACpF,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEhD,0FAA0F;IAC1F,uFAAuF;IACvF,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAyF;IACzF,+FAA+F;IAC/F,4FAA4F;IAC5F,wFAAwF;IACxF,2FAA2F;IAC3F,6FAA6F;IAC7F,yFAAyF;IACzF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,OAAoB,CAAC;IACzB,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACzE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,kFAAkF;QAClF,yFAAyF;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,0FAA0F;IAC1F,wFAAwF;IACxF,2FAA2F;IAC3F,6FAA6F;IAC7F,yFAAyF;IACzF,0FAA0F;IAC1F,cAAc;IACd,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IAErE,4EAA4E;IAC5E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpB,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,kFAAkF;IAClF,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,wDAAwD;QACnF,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,iFAAiF;IACjF,sFAAsF;IACtF,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,wFAAwF;IACxF,uCAAuC;IACvC,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAElD,sFAAsF;IACtF,gFAAgF;IAChF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IACjG,CAAC;YAAS,CAAC;QACT,6FAA6F;QAC7F,iGAAiG;QACjG,iGAAiG;QACjG,iGAAiG;QACjG,4FAA4F;QAC5F,mGAAmG;QACnG,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,kGAAkG;QAClG,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,mGAAmG;QACnG,yEAAyE;QACzE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,kGAAkG;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,+FAA+F;IAC/F,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,YAAY;IACZ,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAEzC,oFAAoF;IACpF,mFAAmF;IACnF,sCAAsC;IACtC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,wDAAwD;IACnF,KAAK,CAAC,GAAG,CAAC,uBAAuB,GAAG,CAAC,EAAE,MAAM,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAoB,EACpB,EAAqB,EACrB,aAAqB,EACrB,OAAe,EACf,IAAiC;IAEjC,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CACnE,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,wFAAwF;AACxF,uFAAuF;AACvF,yFAAyF;AACzF,yFAAyF;AACzF,gCAAgC;AAChC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,sFAAsF;AACtF,2FAA2F;AAC3F,0FAA0F;AAC1F,qFAAqF;AACrF,yEAAyE;AACzE,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,OAAO,cAAc;IACjB,KAAK,CAA6C;IAClD,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,CAA4B;IACjC,EAAE,CAAgC;IACzB,UAAU,CAAS;IACnB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,6FAA6F;IAC7F,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,uFAAuF;IACtE,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACpD,iFAAiF;IACjF,kFAAkF;IAClF,oFAAoF;IACnE,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpE,4FAA4F;IAC5F,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,+FAA+F;IAC9E,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChE,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,2BAA2B;IACnB,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,OAA4G,EAAE;QACxH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QAC7E,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAC/D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,GAAG,6BAA6B,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,KAAoB,EAAE,EAAqB;QAC/C,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa;QACjE,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;QACpB,8FAA8F;QAC9F,gGAAgG;QAChG,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,gGAAgG;QAChG,mGAAmG;QACnG,gGAAgG;QAChG,mGAAmG;QACnG,oGAAoG;QACpG,mGAAmG;QACnG,wFAAwF;QACxF,iGAAiG;QACjG,2BAA2B;QAC3B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,sFAAsF;IACtF,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,IAAI,cAAc;QAChB,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,gEAAgE;QAC7F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsD,CAAC;YAC7E,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;oBACrD,aAAa,EAAE,GAAG,CAAC,cAAc;oBACjC,OAAO,EAAE,GAAG,CAAC,QAAQ;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,qFAAqF;YACrF,gFAAgF;YAChF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvD,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,8CAA8C;gBACnF,2FAA2F;gBAC3F,qFAAqF;gBACrF,sFAAsF;gBACtF,0FAA0F;gBAC1F,wFAAwF;gBACxF,2DAA2D;gBAC3D,IAAI,CAAC;oBACH,0FAA0F;oBAC1F,2FAA2F;oBAC3F,4FAA4F;oBAC5F,yFAAyF;oBACzF,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtG,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;wBAAE,OAAO,CAAC,qDAAqD;oBACrD,8CAA8C;oBACnF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,KAAK,CAAC,GAAG,CAAC,0CAA0C,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO,CAAC,qDAAqD;YAC1F,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8FAA8F;YAC9F,+FAA+F;YAC/F,2EAA2E;YAC3E,KAAK,EAAE,GAAG,CAAC,mCAAmC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,KAAoB,EAAE,EAAqB;QACjE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC9C,YAAY,GAAG,IAAI,CAAC;YACpB,uFAAuF;YACvF,qFAAqF;YACrF,kEAAkE;YAClE,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,YAAY,CAAC;gBACjB,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,KAAK;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CACP,uBAAuB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG;gBACpG,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,MAAM,oCAAoC,CACzG,CAAC;QACJ,CAAC;QACD,qFAAqF;QACrF,gFAAgF;QAChF,0EAA0E;QAC1E,oFAAoF;QACpF,IAAI,YAAY;YAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IAC9C,CAAC;IAED,wFAAwF;IACxF,IAAI,mBAAmB;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,aAAa,CAAC,KAAoB,EAAE,EAAqB;QAC/D,sEAAsE;QACtE,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,oBAAoB;YAAE,OAAO;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACzD,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,uFAAuF;gBACvF,sFAAsF;gBACtF,wFAAwF;gBACxF,wFAAwF;gBACxF,0CAA0C;gBAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAC3C,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC,UAAU;oBAC7B,SAAS,EAAE,KAAK,CAAC,KAAK;iBACvB,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,oFAAoF;QACpF,wFAAwF;QACxF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,GAAW,EAAE,OAAwB;QACxD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,qFAAqF;QACrF,iFAAiF;QACjF,uFAAuF;QACvF,gFAAgF;QAChF,wFAAwF;QACxF,sFAAsF;QACtF,kFAAkF;QAClF,uFAAuF;QACvF,yFAAyF;QACzF,sFAAsF;QACtF,sFAAsF;QACtF,iFAAiF;QACjF,sFAAsF;QACtF,kFAAkF;QAClF,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC5F,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,aAAqB,EAAE,OAAe;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,wDAAwD;QACrF,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5C,6FAA6F;YAC7F,8FAA8F;YAC9F,uFAAuF;YACvF,wFAAwF;YACxF,uFAAuF;YACvF,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO;YACpC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,+EAA+E;gBAC/E,iFAAiF;gBACjF,kFAAkF;gBAClF,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,qDAAqD;gBACrD,8CAA8C;gBACnF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,GAAG,CAAC,wCAAwC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}