@cmmd-center/forge 0.9.6 → 0.9.8

package/dist/bin.cjs

@@ -95950,6 +95950,35 @@ const prepareReplicaSummary = require_Schema$1.fn("prepareReplicaSummary")(funct
 		candidate
 	});
 });
+/**
+* Contains a per-thread hydration failure so it cannot brick the runtime.
+*
+* Hydration is a recovery convenience: it replays durable history into a fresh
+* runtime. One thread that fails identity or generation checks used to fail the
+* WHOLE hydration, which `serverRuntimeStartup` turned into
+* `commandGate.failCommandReady()` — the HTTP server kept serving 200 and the
+* runtime still reported `server_ready`, while every turn was refused with
+* "Could not connect".
+*
+* Observed in production 2026-08-31: a thread replayed from a DESTROYED runtime
+* failed its generation check, and because the poison row lives in CMMD's
+* durable replica rather than on the guest, destroying and reprovisioning the
+* sprite did not clear it. One bad row could brick every future runtime for
+* that user, permanently.
+*
+* Structural failures (index runtime identity changing between pages, a
+* repeated cursor) stay fatal on purpose: those mean the index itself cannot be
+* trusted, so continuing would hydrate an unknown mixture.
+*/
+function skipUnhydratableThread(operation, threadId, state) {
+	return operation.pipe(require_Schema$1.catchTag("RuntimeReplicaHydrationError", (error) => require_Schema$1.gen(function* () {
+		state.unhydratableThreadIds.push(threadId);
+		yield* require_Schema$1.logWarning("skipped a thread that could not be hydrated", {
+			threadId,
+			detail: error.detail
+		});
+	})));
+}
 const applyPreparedReplica = require_Schema$1.fn("applyPreparedReplica")(function* (expectedRuntimeId, prepared, state, dependencies) {
 	const { summary, candidate } = prepared;
 	if (!(yield* dependencies.restoreThreadCursor({
@@ -95975,7 +96004,7 @@ function prepareReplicaPages(expectedRuntimeId, cursor, state, dependencies) {
 		if (index === null) return;
 		if (state.runtimeIdentity === null) state.runtimeIdentity = index.runtime;
 		else if (!replicaRuntimeMatches(state.runtimeIdentity, index.runtime)) return yield* replicaHydrationFailure("index runtime identity changed between pages");
-		yield* require_Schema$1.forEach(index.threads, (summary) => prepareReplicaSummary(expectedRuntimeId, index, summary, state, dependencies), {
+		yield* require_Schema$1.forEach(index.threads, (summary) => skipUnhydratableThread(prepareReplicaSummary(expectedRuntimeId, index, summary, state, dependencies), summary.threadId, state), {
 			concurrency: 1,
 			discard: true
 		});
@@ -95995,16 +96024,19 @@ const hydrateRuntimeReplica = require_Schema$1.fn("hydrateRuntimeReplica")(funct
 		prepared: [],
 		runtimeIdentity: null,
 		hydrated: 0,
-		skippedExisting: 0
+		skippedExisting: 0,
+		unhydratableThreadIds: []
 	};
 	yield* prepareReplicaPages(input.expectedRuntimeId, void 0, state, dependencies);
-	yield* require_Schema$1.forEach(state.prepared, (prepared) => applyPreparedReplica(input.expectedRuntimeId, prepared, state, dependencies), {
+	yield* require_Schema$1.forEach(state.prepared, (prepared) => skipUnhydratableThread(applyPreparedReplica(input.expectedRuntimeId, prepared, state, dependencies), prepared.summary.threadId, state), {
 		concurrency: 1,
 		discard: true
 	});
 	return {
 		hydrated: state.hydrated,
-		skippedExisting: state.skippedExisting
+		skippedExisting: state.skippedExisting,
+		skippedUnhydratable: state.unhydratableThreadIds.length,
+		unhydratableThreadIds: [...state.unhydratableThreadIds]
 	};
 });
 //#endregion
@@ -301957,8 +301989,52 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
+/** The failure activities `appendProviderFailureActivity` emits, all `provider.*.failed`. */
+function isProviderFailureActivity(activity) {
+	return activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
+}
+function failureDetail(activity) {
+	const payload = activity.payload;
+	if (!payload || typeof payload !== "object" || !("detail" in payload)) return null;
+	const detail = payload.detail;
+	return typeof detail === "string" && detail.trim() ? detail.trim() : null;
+}
+/**
+* Replicates why a turn failed.
+*
+* Without this a failure never crossed the replication boundary — only `tool.`
+* activities were serialized — so durable history could not show one and every
+* failure reached the user as an endless "Working" spinner. Measured in
+* production on 2026-08-30: zero failure events had EVER been recorded against
+* 652 tool_call rows, which is how a workspace-path block, a broker-token
+* refusal and a dispatch into a deleted directory all looked identical.
+*
+* `error_summary` is used rather than a new kind because both the Forge
+* protocol and CMMD's ingest schema already accept it; nothing here needed a
+* contract change. The detail carries the actionable sentence, so it is joined
+* onto the summary — the event has no separate detail field.
+*/
+function serializeProviderFailureActivity(activity) {
+	if (!isProviderFailureActivity(activity)) return null;
+	const summary = text(activity.summary, 4e3);
+	if (summary === null) return null;
+	const detail = failureDetail(activity);
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			kind: "error_summary",
+			summary: text(detail === null ? summary : `${summary}: ${detail}`, 4e3) ?? summary
+		}
+	};
+}
 function serializeRuntimeThreadEvents(thread) {
 	const messages = thread.messages.flatMap(serializeThreadMessage);
+	const failureActivities = thread.activities.flatMap((activity) => {
+		const event = serializeProviderFailureActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const replicaActivities = thread.activities.flatMap((activity) => {
 		const event = serializeReplicaActivity(activity);
 		return event === null ? [] : [event];
@@ -301970,7 +302046,8 @@ function serializeRuntimeThreadEvents(thread) {
 	return [
 		...messages,
 		...replicaActivities,
-		...toolActivities
+		...toolActivities,
+		...failureActivities
 	].toSorted((left, right) => {
 		if (left.sourceSequence !== null && right.sourceSequence !== null) return left.sourceSequence - right.sourceSequence;
 		if (left.sourceSequence !== null) return -1;

package/dist/bin.mjs

@@ -95649,6 +95649,35 @@ const prepareReplicaSummary = fn$1("prepareReplicaSummary")(function* (expectedR
 		candidate
 	});
 });
+/**
+* Contains a per-thread hydration failure so it cannot brick the runtime.
+*
+* Hydration is a recovery convenience: it replays durable history into a fresh
+* runtime. One thread that fails identity or generation checks used to fail the
+* WHOLE hydration, which `serverRuntimeStartup` turned into
+* `commandGate.failCommandReady()` — the HTTP server kept serving 200 and the
+* runtime still reported `server_ready`, while every turn was refused with
+* "Could not connect".
+*
+* Observed in production 2026-08-31: a thread replayed from a DESTROYED runtime
+* failed its generation check, and because the poison row lives in CMMD's
+* durable replica rather than on the guest, destroying and reprovisioning the
+* sprite did not clear it. One bad row could brick every future runtime for
+* that user, permanently.
+*
+* Structural failures (index runtime identity changing between pages, a
+* repeated cursor) stay fatal on purpose: those mean the index itself cannot be
+* trusted, so continuing would hydrate an unknown mixture.
+*/
+function skipUnhydratableThread(operation, threadId, state) {
+	return operation.pipe(catchTag("RuntimeReplicaHydrationError", (error) => gen(function* () {
+		state.unhydratableThreadIds.push(threadId);
+		yield* logWarning$1("skipped a thread that could not be hydrated", {
+			threadId,
+			detail: error.detail
+		});
+	})));
+}
 const applyPreparedReplica = fn$1("applyPreparedReplica")(function* (expectedRuntimeId, prepared, state, dependencies) {
 	const { summary, candidate } = prepared;
 	if (!(yield* dependencies.restoreThreadCursor({
@@ -95674,7 +95703,7 @@ function prepareReplicaPages(expectedRuntimeId, cursor, state, dependencies) {
 		if (index === null) return;
 		if (state.runtimeIdentity === null) state.runtimeIdentity = index.runtime;
 		else if (!replicaRuntimeMatches(state.runtimeIdentity, index.runtime)) return yield* replicaHydrationFailure("index runtime identity changed between pages");
-		yield* forEach(index.threads, (summary) => prepareReplicaSummary(expectedRuntimeId, index, summary, state, dependencies), {
+		yield* forEach(index.threads, (summary) => skipUnhydratableThread(prepareReplicaSummary(expectedRuntimeId, index, summary, state, dependencies), summary.threadId, state), {
 			concurrency: 1,
 			discard: true
 		});
@@ -95694,16 +95723,19 @@ const hydrateRuntimeReplica = fn$1("hydrateRuntimeReplica")(function* (input, de
 		prepared: [],
 		runtimeIdentity: null,
 		hydrated: 0,
-		skippedExisting: 0
+		skippedExisting: 0,
+		unhydratableThreadIds: []
 	};
 	yield* prepareReplicaPages(input.expectedRuntimeId, void 0, state, dependencies);
-	yield* forEach(state.prepared, (prepared) => applyPreparedReplica(input.expectedRuntimeId, prepared, state, dependencies), {
+	yield* forEach(state.prepared, (prepared) => skipUnhydratableThread(applyPreparedReplica(input.expectedRuntimeId, prepared, state, dependencies), prepared.summary.threadId, state), {
 		concurrency: 1,
 		discard: true
 	});
 	return {
 		hydrated: state.hydrated,
-		skippedExisting: state.skippedExisting
+		skippedExisting: state.skippedExisting,
+		skippedUnhydratable: state.unhydratableThreadIds.length,
+		unhydratableThreadIds: [...state.unhydratableThreadIds]
 	};
 });
 //#endregion
@@ -301412,8 +301444,52 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
+/** The failure activities `appendProviderFailureActivity` emits, all `provider.*.failed`. */
+function isProviderFailureActivity(activity) {
+	return activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
+}
+function failureDetail(activity) {
+	const payload = activity.payload;
+	if (!payload || typeof payload !== "object" || !("detail" in payload)) return null;
+	const detail = payload.detail;
+	return typeof detail === "string" && detail.trim() ? detail.trim() : null;
+}
+/**
+* Replicates why a turn failed.
+*
+* Without this a failure never crossed the replication boundary — only `tool.`
+* activities were serialized — so durable history could not show one and every
+* failure reached the user as an endless "Working" spinner. Measured in
+* production on 2026-08-30: zero failure events had EVER been recorded against
+* 652 tool_call rows, which is how a workspace-path block, a broker-token
+* refusal and a dispatch into a deleted directory all looked identical.
+*
+* `error_summary` is used rather than a new kind because both the Forge
+* protocol and CMMD's ingest schema already accept it; nothing here needed a
+* contract change. The detail carries the actionable sentence, so it is joined
+* onto the summary — the event has no separate detail field.
+*/
+function serializeProviderFailureActivity(activity) {
+	if (!isProviderFailureActivity(activity)) return null;
+	const summary = text(activity.summary, 4e3);
+	if (summary === null) return null;
+	const detail = failureDetail(activity);
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			kind: "error_summary",
+			summary: text(detail === null ? summary : `${summary}: ${detail}`, 4e3) ?? summary
+		}
+	};
+}
 function serializeRuntimeThreadEvents(thread) {
 	const messages = thread.messages.flatMap(serializeThreadMessage);
+	const failureActivities = thread.activities.flatMap((activity) => {
+		const event = serializeProviderFailureActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const replicaActivities = thread.activities.flatMap((activity) => {
 		const event = serializeReplicaActivity(activity);
 		return event === null ? [] : [event];
@@ -301425,7 +301501,8 @@ function serializeRuntimeThreadEvents(thread) {
 	return [
 		...messages,
 		...replicaActivities,
-		...toolActivities
+		...toolActivities,
+		...failureActivities
 	].toSorted((left, right) => {
 		if (left.sourceSequence !== null && right.sourceSequence !== null) return left.sourceSequence - right.sourceSequence;
 		if (left.sourceSequence !== null) return -1;

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },