@cohortapp/agent-sdk 2.18.14 → 2.18.16

package/scripts/daemon/agent-daemon.mjs

@@ -67,6 +67,7 @@ import { classifyItem, isDirectedAtAgent } from "./classifier.mjs";
 // gets a deterministic classification (no LLM triage), no holding ack, and a
 // per-seat jitter so thirteen answers do not land in the same second.
 import { isRollCallItem, rollCallJitterMs } from "../../lib/org/inbound/broadcast.mjs";
+import { stampFirstReplyPlan } from "../../lib/assurance/first-reply.mjs";
 import { isRoomSurface } from "../../lib/org/inbound/surfaces.mjs";
 import { isMembershipReason } from "../../lib/org/inbound/directedness.mjs";
 import { cohortSurfaceOf, cohortSurfaceLabel, cohortSurfaceIsDeclared } from "./deliver.mjs";
@@ -96,7 +97,7 @@ import {
   isPidAlive,
 } from "./assurance.mjs";
 import { recordPoll, recordClassification, recordSession, writeHealthDashboard } from "./health.mjs";
-import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
+import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, threadLockKey, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
 import { markDeferred } from "./inbox-deferral.mjs";
 import { parseQueueItems, rankBacklog, resolveBacklogWeights } from "../../lib/backlog.mjs";
 import { readLatestGaps } from "../../lib/goals/gaps.mjs";
@@ -159,8 +160,10 @@ import { processOne } from "../../lib/execution/pipeline.mjs";
 // of spawning `claude --print`; not live → today's dispatch, unchanged. The
 // gate is pure (lib/session/frontdoor.mjs); the assurance sweep reopens a
 // session claim that was neither replied nor done within 20 min.
-import { shouldReviveFrontDoor, reviveCommand, sessionJobLabelOnDisk } from "../../lib/session/revive.mjs";
-import { makeFrontDoorGate, sessionLiveFromHeartbeat, readFrontDoorState } from "../../lib/session/frontdoor.mjs";
+import { shouldReviveFrontDoor, reviveCommand, sessionJobLabelOnDisk, confirmRevived, isTerminalReviveFailure, detectUnrequestedRestart } from "../../lib/session/revive.mjs";
+import { budgetSpentNote } from "../../lib/telemetry/collect.mjs";
+import { checkLock as checkProcessLock } from "../../lib/singleton.js";
+import { makeFrontDoorGate, sessionLiveFromHeartbeat, readFrontDoorState, DEFAULT_STALE_MS } from "../../lib/session/frontdoor.mjs";
 import { CADENCE_REGISTRY } from "./cadence-handlers.mjs";
 import { sweepSessionInboxForDaemon } from "../../lib/session/inbox-claims.mjs";
 import { defaultEffects, scheduleToQueue } from "../../lib/execution/effects.mjs";
@@ -293,39 +296,283 @@ const _frontDoorGate = makeFrontDoorGate({ agentRoot: AGENT_REPO_DIR });
 // we want rather than a stale count carried across it.
 /** How often the daemon asks whether the front door has gone quiet. */
 const REVIVE_CHECK_INTERVAL_MS = 60 * 1000;
-const _revive = { attempts: 0, lastAt: null };
-async function reviveFrontDoorIfShut(state, deps = {}) {
+// `notLive` is the count of CONSECUTIVE not-live reads — the actor-side
+// hysteresis (Ravi). Takeover is harmless and flips at one read; a kickstart
+// drops a working session, so the FIRST one waits for two consecutive not-live
+// reads. A live read resets it. Per-process and deliberately not persisted: a
+// daemon restart is itself a change of circumstances.
+// `halted` latches when an assert comes back TERMINAL (phantom pid / crash
+// loop): the seat needs a person, and a blind second kickstart would bury the
+// first failure's log under the loop. One attempt on that road, then hand up.
+//
+// `confirmedIdentity` carries the last poll's {pid, startTime} ACROSS the 60s
+// poll cadence, and `kickstartThisInterval` records whether THIS daemon
+// kickstarted the job since that identity was recorded. A within-window
+// continuity check cannot see a crash loop whose period exceeds the settle
+// window — the same identity appears twice inside it. Comparing the confirmed
+// identity against the next poll's observation, with the kickstart flag,
+// catches an UNREQUESTED restart at ANY period, with no window to tune.
+const _revive = { attempts: 0, lastAt: null, notLive: 0, halted: false, confirmedIdentity: null, kickstartThisInterval: false };
+/** TEST-ONLY: clear the per-process revive state between cases. */
+export function _resetRevive() {
+  _revive.attempts = 0; _revive.lastAt = null; _revive.notLive = 0; _revive.halted = false;
+  _revive.confirmedIdentity = null; _revive.kickstartThisInterval = false;
+}
+
+/** Gap between the two settle-window reads that prove the new session did not
+ *  come up and immediately crash. Short — the door was already dark for the
+ *  full grace before we kickstarted, so this only has to outlast a boot wobble. */
+const CONFIRM_SETTLE_MS = 5000;
+
+/**
+ * One observation of the session job: its launchctl pid, whether that pid is a
+ * GENUINELY LIVE process (not a phantom launchctl lists but `ps` says is dead —
+ * a silent crash loop), the process start-time that fingerprints the instance,
+ * and the COMM (the binary running under the pid). A relaunch changes the
+ * start-time even if the pid is reused, so comparing start-times across the
+ * settle window is how a crash loop is told apart from one continuous process;
+ * the comm is the third, complementary check — a live pid running the WRONG
+ * binary is not the process we kickstarted.
+ *
+ * ABSOLUTE `/bin/ps`, never bare `ps`: `ps` is aliased to `pnpm start` on this
+ * fleet, so a bare `ps` is poison. `kill -0` (a builtin/alias-immune existence
+ * signal) decides liveness; `/bin/ps` reads the immutable start-time and comm.
+ */
+async function readSessionSample(label) {
+  let pid = null, alive = false, startTime = null, comm = null;
+  try {
+    const { stdout } = await execFileAsync("launchctl", ["list", label]);
+    const m = /"PID"\s*=\s*(\d+)/.exec(String(stdout || ""));
+    if (m) pid = Number(m[1]);
+  } catch { /* no pid — the kickstart produced no running process */ }
+  if (Number.isInteger(pid) && pid > 0) {
+    try { process.kill(pid, 0); alive = true; } catch { alive = false; } // signal 0 = existence check
+    try {
+      // One /bin/ps call for both the start-time and the comm — absolute path so
+      // the `ps`→`pnpm start` alias cannot poison it.
+      const { stdout } = await execFileAsync("/bin/ps", ["-o", "lstart=,comm=", "-p", String(pid)]);
+      const line = String(stdout || "").trim();
+      // `lstart` is a fixed-width 24-char date ("Wed Sep 25 12:00:00 2026")
+      // followed by the comm; split on the last field boundary the date ends at.
+      const m = /^(.{24})\s+(.*)$/.exec(line);
+      if (m) { startTime = m[1].trim() || null; comm = m[2].trim() || null; }
+      else { startTime = line || null; } // unexpected shape — keep what we have, comm unknown
+    } catch { startTime = null; comm = null; } // ps gone or pid vanished — degrade; pid continuity still carries
+  }
+  return { pid, alive, startTime, comm };
+}
+
+/** The binary the session job should be running — matched by suffix against the
+ *  observed comm. Bare "node" so any install prefix (/opt/homebrew/bin/node,
+ *  /usr/local/bin/node) matches; a live pid running anything else (a `ps`-alias
+ *  stray `pnpm`, a wrong process) fails the comm-check and names `wrong-comm`. */
+const EXPECTED_SESSION_COMM = "node";
+
+/**
+ * After a kickstart, ASSERT the door came back before recording success — a
+ * restart helper's exit code is not a revive (Jacob's drain-then-restart-daemon.sh
+ * exited 0 and left the process stopped with NO pid). A ONE-SHOT read is not
+ * enough: it passes a phantom pid and a come-up-then-crash loop whose local beat
+ * file always looks fresh. So take TWO reads across a settle window (proving the
+ * process is one continuous instance, not a crash loop) and pair them with the
+ * session's OWN beat freshness — for a session that beat IS the after-signal a
+ * wedge kills, because the heartbeat rides tool use, so a session that stops
+ * working stops beating (unlike a daemon, which a crash loop keeps re-stamping).
+ */
+async function defaultConfirmAfter({ label, now, staleMs, sleep }) {
+  const _sleep = sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const s1 = await readSessionSample(label);
+  await _sleep(CONFIRM_SETTLE_MS);
+  const s2 = await readSessionSample(label);
+  // serverBeatFresh for the SESSION: is the heartbeat it should now be writing
+  // fresh? undefined (couldn't read) does not block — continuity carries it.
+  let serverBeatFresh;
+  try {
+    const st = readFrontDoorState(AGENT_REPO_DIR, { now, staleMs });
+    if (st && st.liveness && Number.isFinite(st.liveness.ageMs)) {
+      serverBeatFresh = st.liveness.ageMs < (staleMs || DEFAULT_STALE_MS);
+    }
+  } catch { /* still stale — a fresh session has not beaten yet; leave undefined */ }
+  return { samples: [s1, s2], serverBeatFresh };
+}
+
+// A failed revive has to reach the FLEET, not just this log: a kickstart that
+// returned with no live pid is a failure to escalate — the seat needs a person.
+// collect.mjs reads this into `machine.reviveNote`, so the presence beat carries
+// it. Best-effort (the console line already fired); cleared on a confirmed revive.
+const REVIVE_NOTE_PATH = join(AGENT_REPO_DIR, "state", "telemetry", "revive-note.json");
+function writeReviveNote({ reason, target, detail, at }) {
+  try {
+    mkdirSync(join(AGENT_REPO_DIR, "state", "telemetry"), { recursive: true });
+    const tmp = `${REVIVE_NOTE_PATH}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ reason, target: target || null, detail: detail || "", at }));
+    renameSync(tmp, REVIVE_NOTE_PATH);
+  } catch { /* the beat surface is best-effort; the log line already fired */ }
+}
+function clearReviveNote() { try { unlinkSync(REVIVE_NOTE_PATH); } catch { /* nothing to clear */ } }
+
+export async function reviveFrontDoorIfShut(state, deps = {}) {
   const now = deps.now ? deps.now() : Date.now();
+  // TEST-ONLY seam: seed the per-process ladder state so a case can start on a
+  // given rung (e.g. budget already spent) without threading a dozen polls.
+  if (deps.seedRevive && typeof deps.seedRevive === "object") Object.assign(_revive, deps.seedRevive);
+  // A latched terminal failure (a prior kickstart came up and crash-looped, or
+  // produced a phantom pid) means the seat is a person's problem now — do not
+  // fire another blind kickstart on top of a loop that would bury the evidence.
+  if (_revive.halted) return { revive: false, reason: "halted-escalated" };
   const live = sessionLiveFromHeartbeat(state && state.heartbeat, { now });
+  const label = deps.label || sessionJobLabelOnDisk(readdirSync, homedir());
+
+  // ── CROSS-POLL CRASH-LOOP CATCH (unbounded, no threshold) ─────────────────
+  //
+  // The within-window continuity check inside confirmRevived cannot see a crash
+  // loop whose period EXCEEDS the settle window: it shows the same identity
+  // twice inside a few seconds and false-confirms. Between two 60s polls,
+  // though, the loop has restarted — so if we hold a previously CONFIRMED
+  // identity and this poll observes a DIFFERENT one with no kickstart issued in
+  // the interval, that is an unrequested restart at ANY period. HALT and note it
+  // rather than blindly re-confirm/re-kickstart a loop forever.
+  //
+  // Armed ONLY while the door is still in trouble (not reading live). A door
+  // that is healthily answering again has recovered — a later identity change is
+  // ordinary churn (an SDK upgrade, a `session restart`, a supervisor resume
+  // rotation), none of which this daemon should police as a crash loop. So a
+  // healthy live read DISARMS the check; the loop this hunts is precisely one
+  // whose relaunched instance never beats a full grace, so it stays not-live.
+  if (label && _revive.confirmedIdentity && state && state.sessionLive !== true) {
+    const readSample = deps.readSessionSample || readSessionSample;
+    let curr = null;
+    try { curr = await readSample(label); } catch { curr = null; }
+    const drift = detectUnrequestedRestart({
+      prev: _revive.confirmedIdentity,
+      curr,
+      kickstartIssuedSince: _revive.kickstartThisInterval,
+    });
+    if (drift.restarted) {
+      _revive.halted = true;
+      const detail = `crash-loop-cross-poll: pid ${_revive.confirmedIdentity.pid}(${_revive.confirmedIdentity.startTime}) → pid ${curr && curr.pid}(${curr && curr.startTime}) with no kickstart since`;
+      console.error(`[daemon] ${label} identity changed across the poll cadence with no kickstart issued (${detail}) — a crash loop whose period outran the settle window; halting and escalating (this seat needs a person)`);
+      writeReviveNote({ reason: "session-revive-failed", target: label, detail, at: new Date(now).toISOString() });
+      return { revive: false, reason: "crash-loop-cross-poll", confirmed: { ok: false, reason: "crash-loop-cross-poll" } };
+    }
+  } else if (state && state.sessionLive === true && _revive.confirmedIdentity) {
+    // Recovered and answering — disarm; a healthy session's later identity
+    // changes are churn, not the loop.
+    _revive.confirmedIdentity = null;
+    _revive.kickstartThisInterval = false;
+  }
+
+  // Track the consecutive not-live streak BEFORE the decision; a live read
+  // resets it so a session that beats between two quiet reads never accrues.
+  const notLiveNow = !(state && state.sessionLive === true);
+  _revive.notLive = notLiveNow ? _revive.notLive + 1 : 0;
+  const reviveAfterMs = Number(process.env.MAESTRO_SESSION_STALE_S || 0) * 1000 || undefined;
   const verdict = shouldReviveFrontDoor({
     frontDoor: state && state.frontDoor,
     sessionLive: state && state.sessionLive,
     silentMs: live.ageMs,
+    notLiveReads: _revive.notLive,
     attempts: _revive.attempts,
     lastAttemptAt: _revive.lastAt,
     now,
-    reviveAfterMs: Number(process.env.MAESTRO_SESSION_STALE_S || 0) * 1000 || undefined,
+    reviveAfterMs,
   });
-  if (!verdict.revive) return verdict;
-  const label = sessionJobLabelOnDisk(readdirSync, homedir());
+  if (!verdict.revive) {
+    // A ladder that spent its whole budget and STOPPED is a failure that does
+    // not name itself — the seat goes quiet and a quiet system looks healthy.
+    // Turn that silence into a beat note through the same reviveNote channel.
+    if (verdict.reason === "budget-spent") {
+      const note = budgetSpentNote({ verdict: verdict.reason, target: label || null, attempts: _revive.attempts, at: new Date(now).toISOString() });
+      if (note) writeReviveNote(note);
+    }
+    return verdict;
+  }
   if (!label) return { revive: false, reason: "no-session-job" };
+
+  // Supervisor coordination via the resume loop's OWN lock, not a soft note
+  // (Jacob). The supervisor holds the `session` singleton for its whole life
+  // and writes the heartbeat as a healthy resume makes progress. We only reach
+  // here after the door has been dark past the FULL grace AND confirmed over
+  // two reads 60s apart — so a resume gap is already excluded by time, and a
+  // live holder here is a supervisor PARKED in its launch probe (the 3.5-day /
+  // 15-day case this module exists for), for which the hard kickstart is
+  // exactly right. Consulting the lock tells a parked supervisor (override,
+  // logged) apart from a dead one (a clean restart), and never blocks the
+  // parked case — the failure that a hard "skip if held" would reintroduce.
+  const supervisor = (deps.checkSessionLock || (() => checkProcessLock("session")))();
+  if (supervisor && supervisor.running) {
+    console.error(`[daemon] ${label} front door dark past grace while a supervisor (pid ${supervisor.pid}) still holds the session lock — parked in its launch probe; hard-kickstarting over it`);
+  }
+
   _revive.attempts += 1;
   _revive.lastAt = now;
+  // This daemon is now the one that asked for the restart, so a new identity on
+  // the NEXT poll is expected, not the crash loop the cross-poll check hunts.
+  _revive.kickstartThisInterval = true;
   const cmd = reviveCommand(label, typeof process.getuid === "function" ? process.getuid() : 0);
   console.error(`[daemon] front door shut — ${verdict.reason}; restarting ${label}`);
   try {
     await (deps.execFile || execFileAsync)(cmd.file, cmd.args);
-    console.error(`[daemon] ${label} restarted; a fresh session clears whatever the old one was sitting on`);
   } catch (err) {
     console.error(`[daemon] could not restart ${label}: ${err && err.message ? err.message : err} — this seat needs a person`);
+    return { ...verdict, confirmed: { ok: false, reason: "kickstart-threw" } };
+  }
+  // The kickstart returned. Now prove it actually came back — across a settle
+  // window, not a one-shot read that a phantom pid or a come-up-then-crash
+  // would pass.
+  const staleMs = reviveAfterMs;
+  const after = deps.confirmAfter
+    ? await deps.confirmAfter({ label, now, staleMs })
+    : await defaultConfirmAfter({ label, now, staleMs });
+  const confirmed = confirmRevived({ ...after, staleMs, expectedComm: EXPECTED_SESSION_COMM });
+  if (confirmed.ok) {
+    console.error(`[daemon] ${label} restarted and answering (${confirmed.reason}); a fresh session clears whatever the old one was sitting on`);
+    clearReviveNote();
+    // Record the identity this revive confirmed so the NEXT poll can tell one
+    // continuous instance from a crash loop whose period outran the settle
+    // window. Reset the kickstart flag: the interval it justified is over.
+    const alive = Array.isArray(after && after.samples) ? after.samples.find((s) => s && Number.isInteger(s.pid) && s.pid > 0 && s.alive === true) : null;
+    _revive.confirmedIdentity = alive ? { pid: alive.pid, startTime: alive.startTime } : null;
+    _revive.kickstartThisInterval = false;
+  } else if (isTerminalReviveFailure(confirmed)) {
+    // Phantom pid or a restart boundary inside the settle window: the kickstart
+    // produced no living, continuous process. STOP — one attempt, then hand up
+    // with what we saw, rather than kickstart again into a loop that buries it.
+    _revive.halted = true;
+    const evidence = describeSamples(after && after.samples);
+    console.error(`[daemon] ${label} kickstart did NOT revive it (${confirmed.reason}): ${evidence} — a helper's exit code is not a revive; this seat needs a person (failure to escalate)`);
+    writeReviveNote({ reason: "session-revive-failed", target: label, detail: `${confirmed.reason}: ${evidence}`, at: new Date(now).toISOString() });
+  } else {
+    console.error(`[daemon] ${label} restarted; awaiting its first beat (${confirmed.reason}) — the next check confirms or re-attempts within budget`);
   }
-  return verdict;
+  return { ...verdict, confirmed };
+}
+
+/** One-line evidence of what the settle-window reads actually saw, for the log
+ *  and the beat note — so a failed escalation carries the fingerprint, not just
+ *  a verdict. */
+function describeSamples(samples) {
+  if (!Array.isArray(samples) || !samples.length) return "no reads";
+  return samples.map((s) => `pid=${s && s.pid != null ? s.pid : "none"}${s && s.alive ? "(alive)" : "(dead)"}`).join(" then ");
 }
 
-async function pollService(svc) {
+/**
+ * Drain one service's inbox: poll, dedup, stamp the flurry plan, process.
+ *
+ * @param {{name:string, fn:Function}} svc
+ * @param {object} [deps] TEST-ONLY seams; PRODUCTION PASSES NOTHING, so the
+ *   defaults are the real collaborators and behaviour is byte-identical. The
+ *   same idiom as `processItem`/`sweepBacklog` above. Exported (and seamed) so
+ *   the ONE-FIRST-REPLY-PER-FLURRY stamping has a test that fails when the call
+ *   is removed — see `notice-emission.test.mjs`.
+ *   @param {object} [deps.frontDoorGate] override the front-door gate
+ *   @param {Function} [deps.processItem] override processItem
+ */
+export async function pollService(svc, deps = {}) {
+  const processItemImpl = deps.processItem || processItem;
   try {
     // Front door: a live main session owns this service's inbox — leave it.
-    const fd = _frontDoorGate.check(svc.name);
+    const fd = (deps.frontDoorGate || _frontDoorGate).check(svc.name);
     if (fd.changed) console.log(`[daemon] front door for ${svc.name}: ${fd.dispatch ? "daemon dispatches" : "main session owns intake"} (${fd.reason})`);
     if (!fd.dispatch) return 0;
     const result = await svc.fn();
@@ -358,8 +605,33 @@ async function pollService(svc) {
       return lock.acquired;
     });
 
+    // ── ONE FIRST REPLY PER FLURRY ───────────────────────────────────────
+    // "If there's a flurry of 4 messages in one go by others, instead of having
+    // a generic reply per message, it would be responding to the batch of
+    // messages." (owner, 2026-09-25.) The batch is computed HERE, over the whole
+    // poll, because this is the only place that sees more than one item at a
+    // time — `processItem` is called per item and structurally cannot know it is
+    // the third of four. Every non-leader carries `covered_by_batch`, which
+    // `assurance.shouldAcknowledge` turns into `ack:false` and the daemon makes
+    // durable as `interimForbidden`, so no later sweep in any process speaks for
+    // it either. The leader is told how many it stands for, so the one line it
+    // writes can answer all of them.
+    //
+    // WORK IS UNAFFECTED. Every item still gets its own `processItem`, its own
+    // obligation and its own answer; what is batched is only the FIRST thing
+    // said. Silence about timing is not silence about outcome.
+    //
+    // The stamping itself is `assurance/first-reply.stampFirstReplyPlan`, not
+    // four lines here, because four lines here had NO TEST THAT COULD SEE THEM:
+    // the only call site was inside this module-internal function, so deleting
+    // them left the whole suite green — including a test named "wired, not just
+    // available". `first-reply.test.mjs` now exercises the stamp and
+    // `notice-emission.test.mjs` drives THIS function through `pollService`'s
+    // injected seams, so removing the call is red in both.
+    stampFirstReplyPlan(newItems);
+
     for (const item of newItems) {
-      await processItem(item, svc.name);
+      await processItemImpl(item, svc.name);
     }
 
     if (result.errors.length > 0) {
@@ -1107,7 +1379,38 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
     // This check runs BEFORE quick reply to prevent ALL duplicate responses.
     {
       const channel = item.channel_id || (item.raw_ref ? item.raw_ref.match(/slack:([^:]+):/)?.[1] : null) || item.channel;
-      const threadTs = item.thread_id || (isDm ? `dm-channel` : null);
+      // THE UNTREADED CHANNEL POST USED TO TAKE NO LOCK AT ALL.
+      //
+      // `item.thread_id || (isDm ? "dm-channel" : null)` is null for exactly
+      // one shape: a message posted to the main surface of a channel or group,
+      // not in a thread, not a DM. That is the shape the owner screenshotted —
+      // a flurry of messages into a room — and it was the one shape with no
+      // dedup: each message cleared this block, spawned its own session, and
+      // opened its own obligation, so the room got N sessions and N chances at
+      // a holding line for one conversation.
+      //
+      // `channel-main` is the DM lock's counterpart for that surface: one
+      // session at a time on a room's main feed, the rest deferred and
+      // promoted at session close exactly like a DM burst.
+      //
+      // THIS IS ONLY SAFE BECAUSE OF THE BUNDLING FIX BESIDE IT. Deferral ends
+      // in `promoteDeferred`, which collapses a group to its latest member and
+      // marks the rest `.processed-bundled`. On a shared channel the deferred
+      // set is several PEOPLE, not one person's flurry, so an unconditional
+      // collapse here would silently bin a colleague's question — which is why
+      // inbox-deferral.mjs now splits a group by sender unless the winner
+      // actually carries the room's history. Widening this lock without that
+      // change would trade a message storm for lost messages.
+      //
+      // The off-switch is real and deliberate: MAESTRO_CHANNEL_MAIN_LOCK=0
+      // restores the previous behaviour on a seat without a code change, in
+      // the same style as every other threshold in the assurance stack.
+      const threadTs = threadLockKey({
+        channel,
+        threadId: item.thread_id,
+        isDm,
+        channelMainLock: String(process.env.MAESTRO_CHANNEL_MAIN_LOCK ?? "1") !== "0",
+      });
       if (threadTs && channel) {
         const threadCheck = acquireThreadLock(channel, threadTs);
         if (!threadCheck.allowed) {