@coool/opencode-adaptive 0.0.0-stage → 1.0.1

package/dist/state/health/parse.d.ts

@@ -0,0 +1,2 @@
+import type { ResourceRecord } from "../../health/resource-health/types.js";
+export declare function parseHealthPayload(raw: unknown): ResourceRecord[];

package/dist/state/health/parse.js

@@ -0,0 +1,137 @@
+/**
+ * Read-side parsing for persisted health records. Every parser is total: it
+ * accepts `unknown` and returns typed records, dropping anything invalid — a
+ * corrupted health file can never take the plugin down (ADP-031). State and
+ * breaker vocabularies are membership-checked; timestamps must be finite
+ * numbers. An older plugin reading newer records may drop unknown-vocabulary
+ * entries — health records are bounded mirrors of an in-memory registry, and
+ * the payload version guards the schema itself.
+ */
+import { BREAKER_STATES } from "../../health/circuit-breaker/types.js";
+import { HEALTH_STATES } from "../../health/resource-health/types.js";
+import { HEALTH_VERSION } from "./types.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFiniteNumber(raw) {
+    return typeof raw === "number" && Number.isFinite(raw);
+}
+function isNonNegativeInt(raw) {
+    return isFiniteNumber(raw) && Number.isInteger(raw) && raw >= 0;
+}
+function parseVocab(raw, vocabulary) {
+    if (typeof raw !== "string")
+        return undefined;
+    return vocabulary.find((entry) => entry === raw);
+}
+/**
+ * A non-empty bounded identifier string (provider/model/variant/account ids).
+ * Over-long values are rejected, not truncated: the writer stores keys as-is,
+ * so a truncated key would name a different resource.
+ */
+function parseIdentifier(raw) {
+    if (typeof raw !== "string" || raw === "" || raw.length > 128)
+        return undefined;
+    return raw;
+}
+function parseKey(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const providerID = parseIdentifier(raw["providerID"]);
+    if (providerID === undefined)
+        return undefined;
+    const accountID = parseIdentifier(raw["accountID"]);
+    const modelID = parseIdentifier(raw["modelID"]);
+    const variantID = parseIdentifier(raw["variantID"]);
+    // A present-but-unusable scope field would silently widen the key.
+    if (raw["accountID"] !== undefined && accountID === undefined)
+        return undefined;
+    if (raw["modelID"] !== undefined && modelID === undefined)
+        return undefined;
+    if (raw["variantID"] !== undefined && variantID === undefined)
+        return undefined;
+    // Scope fields must form a valid prefix: a variant without a model, or a
+    // model without its variant's provider context, is not a real resource.
+    if (variantID !== undefined && modelID === undefined)
+        return undefined;
+    return {
+        providerID,
+        ...(accountID !== undefined ? { accountID } : {}),
+        ...(modelID !== undefined ? { modelID } : {}),
+        ...(variantID !== undefined ? { variantID } : {}),
+    };
+}
+function parseBreaker(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const state = parseVocab(raw["state"], BREAKER_STATES);
+    const failures = raw["failures"];
+    const openCount = raw["openCount"];
+    if (state === undefined)
+        return undefined;
+    if (!(isNonNegativeInt(failures) && isNonNegativeInt(openCount)))
+        return undefined;
+    const reopenAt = raw["reopenAt"];
+    const probeId = parseIdentifier(raw["probeId"]);
+    const probeAt = raw["probeAt"];
+    return {
+        state,
+        failures,
+        openCount,
+        ...(isFiniteNumber(reopenAt) ? { reopenAt } : {}),
+        ...(probeId !== undefined ? { probeId } : {}),
+        ...(isFiniteNumber(probeAt) ? { probeAt } : {}),
+    };
+}
+function parseWindow(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const kind = parseVocab(raw["kind"], ["rate-limit", "quota"]);
+    const until = raw["until"];
+    if (kind === undefined || !isFiniteNumber(until))
+        return undefined;
+    return { kind, until };
+}
+function parseRecord(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const key = parseKey(raw["key"]);
+    const health = parseVocab(raw["health"], HEALTH_STATES);
+    const breaker = parseBreaker(raw["breaker"]);
+    const updatedAt = raw["updatedAt"];
+    if (key === undefined || health === undefined || breaker === undefined)
+        return undefined;
+    if (!isFiniteNumber(updatedAt))
+        return undefined;
+    const window = parseWindow(raw["window"]);
+    // Windowed states lift only when their window elapses: without a valid
+    // window the record would block the resource permanently, so it is dropped
+    // (the resource reads as healthy until fresh evidence arrives).
+    if ((health === "rate_limited" || health === "quota_exhausted") && window === undefined) {
+        return undefined;
+    }
+    return {
+        key,
+        health,
+        breaker,
+        ...(window !== undefined ? { window } : {}),
+        updatedAt,
+    };
+}
+export function parseHealthPayload(raw) {
+    if (!isRecord(raw))
+        return [];
+    if (raw["version"] !== HEALTH_VERSION)
+        return [];
+    const list = raw["records"];
+    if (!Array.isArray(list))
+        return [];
+    const parsed = [];
+    for (const entry of list.slice(0, 512)) {
+        const record = parseRecord(entry);
+        if (record !== undefined)
+            parsed.push(record);
+    }
+    return parsed;
+}
+//# sourceMappingURL=parse.js.map

package/dist/state/health/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../src/state/health/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AAMrE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,UAAU,CACjB,GAAY,EACZ,UAAa;IAEb,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAA;IAC/E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IACrD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IACnD,mEAAmE;IACnE,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/E,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtE,OAAO;QACL,UAAU;QACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9B,OAAO;QACL,KAAK;QACL,QAAQ;QACR,SAAS;QACT,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAU,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxF,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzC,uEAAuE;IACvE,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,iBAAiB,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,MAAM;QACN,OAAO;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS;KACV,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,cAAc;QAAE,OAAO,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["/**\n * Read-side parsing for persisted health records. Every parser is total: it\n * accepts `unknown` and returns typed records, dropping anything invalid — a\n * corrupted health file can never take the plugin down (ADP-031). State and\n * breaker vocabularies are membership-checked; timestamps must be finite\n * numbers. An older plugin reading newer records may drop unknown-vocabulary\n * entries — health records are bounded mirrors of an in-memory registry, and\n * the payload version guards the schema itself.\n */\nimport { BREAKER_STATES } from \"../../health/circuit-breaker/types.js\"\nimport type { BreakerRecord } from \"../../health/circuit-breaker/types.js\"\nimport { HEALTH_STATES } from \"../../health/resource-health/types.js\"\nimport type {\n  ResourceKey,\n  ResourceRecord,\n  ResourceWindow,\n} from \"../../health/resource-health/types.js\"\nimport { HEALTH_VERSION } from \"./types.js\"\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction isFiniteNumber(raw: unknown): raw is number {\n  return typeof raw === \"number\" && Number.isFinite(raw)\n}\n\nfunction isNonNegativeInt(raw: unknown): raw is number {\n  return isFiniteNumber(raw) && Number.isInteger(raw) && raw >= 0\n}\n\nfunction parseVocab<V extends readonly string[]>(\n  raw: unknown,\n  vocabulary: V,\n): V[number] | undefined {\n  if (typeof raw !== \"string\") return undefined\n  return vocabulary.find((entry) => entry === raw)\n}\n\n/**\n * A non-empty bounded identifier string (provider/model/variant/account ids).\n * Over-long values are rejected, not truncated: the writer stores keys as-is,\n * so a truncated key would name a different resource.\n */\nfunction parseIdentifier(raw: unknown): string | undefined {\n  if (typeof raw !== \"string\" || raw === \"\" || raw.length > 128) return undefined\n  return raw\n}\n\nfunction parseKey(raw: unknown): ResourceKey | undefined {\n  if (!isRecord(raw)) return undefined\n  const providerID = parseIdentifier(raw[\"providerID\"])\n  if (providerID === undefined) return undefined\n  const accountID = parseIdentifier(raw[\"accountID\"])\n  const modelID = parseIdentifier(raw[\"modelID\"])\n  const variantID = parseIdentifier(raw[\"variantID\"])\n  // A present-but-unusable scope field would silently widen the key.\n  if (raw[\"accountID\"] !== undefined && accountID === undefined) return undefined\n  if (raw[\"modelID\"] !== undefined && modelID === undefined) return undefined\n  if (raw[\"variantID\"] !== undefined && variantID === undefined) return undefined\n  // Scope fields must form a valid prefix: a variant without a model, or a\n  // model without its variant's provider context, is not a real resource.\n  if (variantID !== undefined && modelID === undefined) return undefined\n  return {\n    providerID,\n    ...(accountID !== undefined ? { accountID } : {}),\n    ...(modelID !== undefined ? { modelID } : {}),\n    ...(variantID !== undefined ? { variantID } : {}),\n  }\n}\n\nfunction parseBreaker(raw: unknown): BreakerRecord | undefined {\n  if (!isRecord(raw)) return undefined\n  const state = parseVocab(raw[\"state\"], BREAKER_STATES)\n  const failures = raw[\"failures\"]\n  const openCount = raw[\"openCount\"]\n  if (state === undefined) return undefined\n  if (!(isNonNegativeInt(failures) && isNonNegativeInt(openCount))) return undefined\n  const reopenAt = raw[\"reopenAt\"]\n  const probeId = parseIdentifier(raw[\"probeId\"])\n  const probeAt = raw[\"probeAt\"]\n  return {\n    state,\n    failures,\n    openCount,\n    ...(isFiniteNumber(reopenAt) ? { reopenAt } : {}),\n    ...(probeId !== undefined ? { probeId } : {}),\n    ...(isFiniteNumber(probeAt) ? { probeAt } : {}),\n  }\n}\n\nfunction parseWindow(raw: unknown): ResourceWindow | undefined {\n  if (!isRecord(raw)) return undefined\n  const kind = parseVocab(raw[\"kind\"], [\"rate-limit\", \"quota\"] as const)\n  const until = raw[\"until\"]\n  if (kind === undefined || !isFiniteNumber(until)) return undefined\n  return { kind, until }\n}\n\nfunction parseRecord(raw: unknown): ResourceRecord | undefined {\n  if (!isRecord(raw)) return undefined\n  const key = parseKey(raw[\"key\"])\n  const health = parseVocab(raw[\"health\"], HEALTH_STATES)\n  const breaker = parseBreaker(raw[\"breaker\"])\n  const updatedAt = raw[\"updatedAt\"]\n  if (key === undefined || health === undefined || breaker === undefined) return undefined\n  if (!isFiniteNumber(updatedAt)) return undefined\n  const window = parseWindow(raw[\"window\"])\n  // Windowed states lift only when their window elapses: without a valid\n  // window the record would block the resource permanently, so it is dropped\n  // (the resource reads as healthy until fresh evidence arrives).\n  if ((health === \"rate_limited\" || health === \"quota_exhausted\") && window === undefined) {\n    return undefined\n  }\n  return {\n    key,\n    health,\n    breaker,\n    ...(window !== undefined ? { window } : {}),\n    updatedAt,\n  }\n}\n\nexport function parseHealthPayload(raw: unknown): ResourceRecord[] {\n  if (!isRecord(raw)) return []\n  if (raw[\"version\"] !== HEALTH_VERSION) return []\n  const list = raw[\"records\"]\n  if (!Array.isArray(list)) return []\n  const parsed: ResourceRecord[] = []\n  for (const entry of list.slice(0, 512)) {\n    const record = parseRecord(entry)\n    if (record !== undefined) parsed.push(record)\n  }\n  return parsed\n}\n"]}

package/dist/state/health/store.d.ts

@@ -0,0 +1,17 @@
+import type { HealthStorage } from "./types.js";
+import type { ResourceRecord } from "../../health/resource-health/types.js";
+export declare class HealthRecordStore {
+    #private;
+    private readonly storage;
+    constructor(storage: HealthStorage);
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load(): Promise<void>;
+    /** All retained records. */
+    snapshot(): readonly ResourceRecord[];
+    /**
+     * Replace the whole record set with a fresh registry snapshot. The bound
+     * keeps the most recently updated records — stale scopes matter less than
+     * the resources that are actually failing right now.
+     */
+    replace(records: readonly ResourceRecord[]): Promise<void>;
+}

package/dist/state/health/store.js

@@ -0,0 +1,69 @@
+/**
+ * Bounded health-record store: a persistence mirror of the in-memory
+ * resource-health registry. The store keeps the newest-updated records
+ * (bounded, least-recently-updated evicted) and persists on every replace.
+ * As everywhere else in `state/`, memory is only advanced after a successful
+ * write, so memory and disk never diverge; write failures propagate to the
+ * caller — the wiring layer's fail-open wrapper decides how to degrade
+ * (ADP-031).
+ */
+import { parseHealthPayload } from "./parse.js";
+import { MAX_HEALTH_RECORDS, HEALTH_VERSION } from "./types.js";
+export class HealthRecordStore {
+    storage;
+    #records = [];
+    #queue = Promise.resolve();
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load() {
+        return this.#serialize(() => this.#load());
+    }
+    async #load() {
+        let raw;
+        try {
+            raw = await this.storage.read();
+        }
+        catch {
+            this.#records = [];
+            return;
+        }
+        this.#records = parseHealthPayload(raw);
+    }
+    /** All retained records. */
+    snapshot() {
+        return this.#records;
+    }
+    /**
+     * Replace the whole record set with a fresh registry snapshot. The bound
+     * keeps the most recently updated records — stale scopes matter less than
+     * the resources that are actually failing right now.
+     */
+    replace(records) {
+        return this.#serialize(() => this.#replace(records));
+    }
+    async #replace(records) {
+        const next = records.length > MAX_HEALTH_RECORDS
+            ? [...records]
+                .sort((left, right) => right.updatedAt - left.updatedAt)
+                .slice(0, MAX_HEALTH_RECORDS)
+            : [...records];
+        // Persist BEFORE committing memory: a write failure must leave memory
+        // and disk consistent (the caller decides how to fail open).
+        const payload = {
+            version: HEALTH_VERSION,
+            records: next,
+        };
+        await this.storage.write(payload);
+        this.#records = next;
+    }
+    // Reloads and writes share one queue; otherwise a slow persistence call
+    // can restore older state after a newer call has already committed.
+    #serialize(operation) {
+        const run = this.#queue.then(operation);
+        this.#queue = run.catch(() => undefined);
+        return run;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/state/health/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/state/health/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI/D,MAAM,OAAO,iBAAiB;IAIC;IAH7B,QAAQ,GAAqB,EAAE,CAAA;IAC/B,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE5C,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAEvD,qFAAqF;IACrF,IAAI;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAA;YAClB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACzC,CAAC;IAED,4BAA4B;IAC5B,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,OAAkC;QACxC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAkC;QAC/C,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,GAAG,kBAAkB;YACjC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;iBACT,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;iBACvD,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;YACjC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;QAClB,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,OAAO,GAAkB;YAC7B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,IAAI;SACd,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,UAAU,CAAC,SAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF","sourcesContent":["/**\n * Bounded health-record store: a persistence mirror of the in-memory\n * resource-health registry. The store keeps the newest-updated records\n * (bounded, least-recently-updated evicted) and persists on every replace.\n * As everywhere else in `state/`, memory is only advanced after a successful\n * write, so memory and disk never diverge; write failures propagate to the\n * caller — the wiring layer's fail-open wrapper decides how to degrade\n * (ADP-031).\n */\nimport { parseHealthPayload } from \"./parse.js\"\nimport { MAX_HEALTH_RECORDS, HEALTH_VERSION } from \"./types.js\"\nimport type { HealthPayload, HealthStorage } from \"./types.js\"\nimport type { ResourceRecord } from \"../../health/resource-health/types.js\"\n\nexport class HealthRecordStore {\n  #records: ResourceRecord[] = []\n  #queue: Promise<unknown> = Promise.resolve()\n\n  constructor(private readonly storage: HealthStorage) {}\n\n  /** Rebuild from storage (restart behavior). A read failure yields an empty store. */\n  load(): Promise<void> {\n    return this.#serialize(() => this.#load())\n  }\n\n  async #load(): Promise<void> {\n    let raw: unknown\n    try {\n      raw = await this.storage.read()\n    } catch {\n      this.#records = []\n      return\n    }\n    this.#records = parseHealthPayload(raw)\n  }\n\n  /** All retained records. */\n  snapshot(): readonly ResourceRecord[] {\n    return this.#records\n  }\n\n  /**\n   * Replace the whole record set with a fresh registry snapshot. The bound\n   * keeps the most recently updated records — stale scopes matter less than\n   * the resources that are actually failing right now.\n   */\n  replace(records: readonly ResourceRecord[]): Promise<void> {\n    return this.#serialize(() => this.#replace(records))\n  }\n\n  async #replace(records: readonly ResourceRecord[]): Promise<void> {\n    const next =\n      records.length > MAX_HEALTH_RECORDS\n        ? [...records]\n            .sort((left, right) => right.updatedAt - left.updatedAt)\n            .slice(0, MAX_HEALTH_RECORDS)\n        : [...records]\n    // Persist BEFORE committing memory: a write failure must leave memory\n    // and disk consistent (the caller decides how to fail open).\n    const payload: HealthPayload = {\n      version: HEALTH_VERSION,\n      records: next,\n    }\n    await this.storage.write(payload)\n    this.#records = next\n  }\n\n  // Reloads and writes share one queue; otherwise a slow persistence call\n  // can restore older state after a newer call has already committed.\n  #serialize(operation: () => Promise<void>): Promise<void> {\n    const run = this.#queue.then(operation)\n    this.#queue = run.catch(() => undefined)\n    return run\n  }\n}\n"]}

package/dist/state/health/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Persisted resource health records. Health is otherwise memory-only state,
+ * but the host's TUI-mode plugin reconciliation can load the plugin several
+ * times into one process — hooks (the event pump) and RPC registration can
+ * end up on different instances. Without persistence the status surface is
+ * served by an instance whose registry never observed anything; persisted
+ * records make health readable by every instance, exactly like receipts,
+ * settings and parked work.
+ */
+import type { ResourceRecord } from "../../health/resource-health/types.js";
+export declare const HEALTH_KEY = "coool.adaptive/health";
+export declare const HEALTH_VERSION = 1;
+/** Product bound — not a user knob. Keeps the most recently updated records. */
+export declare const MAX_HEALTH_RECORDS = 512;
+export interface HealthPayload {
+    readonly version: typeof HEALTH_VERSION;
+    readonly records: readonly ResourceRecord[];
+}
+/** Storage seam — the adapter binds `HEALTH_KEY` to `ctx.storage`. */
+export interface HealthStorage {
+    read(): Promise<unknown>;
+    write(payload: HealthPayload): Promise<void>;
+}

package/dist/state/health/types.js

@@ -0,0 +1,5 @@
+export const HEALTH_KEY = "coool.adaptive/health";
+export const HEALTH_VERSION = 1;
+/** Product bound — not a user knob. Keeps the most recently updated records. */
+export const MAX_HEALTH_RECORDS = 512;
+//# sourceMappingURL=types.js.map

package/dist/state/health/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/state/health/types.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAA;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAA;AAC/B,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA","sourcesContent":["/**\n * Persisted resource health records. Health is otherwise memory-only state,\n * but the host's TUI-mode plugin reconciliation can load the plugin several\n * times into one process — hooks (the event pump) and RPC registration can\n * end up on different instances. Without persistence the status surface is\n * served by an instance whose registry never observed anything; persisted\n * records make health readable by every instance, exactly like receipts,\n * settings and parked work.\n */\nimport type { ResourceRecord } from \"../../health/resource-health/types.js\"\n\nexport const HEALTH_KEY = \"coool.adaptive/health\"\nexport const HEALTH_VERSION = 1\n/** Product bound — not a user knob. Keeps the most recently updated records. */\nexport const MAX_HEALTH_RECORDS = 512\n\nexport interface HealthPayload {\n  readonly version: typeof HEALTH_VERSION\n  readonly records: readonly ResourceRecord[]\n}\n\n/** Storage seam — the adapter binds `HEALTH_KEY` to `ctx.storage`. */\nexport interface HealthStorage {\n  read(): Promise<unknown>\n  write(payload: HealthPayload): Promise<void>\n}\n"]}

package/dist/state/parked-work/index.d.ts

@@ -0,0 +1,4 @@
+export { parseParkedPayload } from "./parse.js";
+export { ParkedWorkStore } from "./store.js";
+export { MAX_PARKED, MAX_PARKED_TEXT, PARKED_KEY, PARKED_VERSION } from "./types.js";
+export type { ParkedPayload, ParkedRecord, ParkedStorage } from "./types.js";

package/dist/state/parked-work/index.js

@@ -0,0 +1,4 @@
+export { parseParkedPayload } from "./parse.js";
+export { ParkedWorkStore } from "./store.js";
+export { MAX_PARKED, MAX_PARKED_TEXT, PARKED_KEY, PARKED_VERSION } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/state/parked-work/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/state/parked-work/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA","sourcesContent":["export { parseParkedPayload } from \"./parse.js\"\nexport { ParkedWorkStore } from \"./store.js\"\nexport { MAX_PARKED, MAX_PARKED_TEXT, PARKED_KEY, PARKED_VERSION } from \"./types.js\"\nexport type { ParkedPayload, ParkedRecord, ParkedStorage } from \"./types.js\"\n"]}

package/dist/state/parked-work/parse.d.ts

@@ -0,0 +1,6 @@
+import type { ParkedRecord } from "./types.js";
+/**
+ * Parse a persisted parked payload. Accepts the versioned shape and a
+ * versionless draft array; anything else yields no records.
+ */
+export declare function parseParkedPayload(raw: unknown): ParkedRecord[];

package/dist/state/parked-work/parse.js

@@ -0,0 +1,83 @@
+/**
+ * Read-side parsing for persisted parked records (ADP-024). Total: accepts
+ * `unknown`, drops invalid entries, never throws (ADP-031). Vocabulary is
+ * membership-checked (the write path is typed); free-text is re-bounded.
+ */
+import { PARK_REASONS } from "../../core/scheduler/types.js";
+import { TIERS } from "../../core/tier-policy/types.js";
+import { MAX_PARKED, MAX_PARKED_TEXT, PARKED_VERSION } from "./types.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function boundString(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    return raw.length > MAX_PARKED_TEXT ? raw.slice(0, MAX_PARKED_TEXT) : raw;
+}
+function parseOptionalBounded(raw) {
+    const value = boundString(raw);
+    return value === "" ? undefined : value;
+}
+/** Free-text detail keeps empty strings (round-trips through the store). */
+function parseDetailBounded(raw) {
+    return boundString(raw) ?? undefined;
+}
+function parseParked(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const id = parseOptionalBounded(raw["id"]);
+    const sessionID = parseOptionalBounded(raw["sessionID"]);
+    const tierRaw = raw["tier"];
+    const reasonRaw = raw["reason"];
+    const parkedAt = raw["parkedAt"];
+    if (id === undefined ||
+        sessionID === undefined ||
+        typeof tierRaw !== "string" ||
+        typeof reasonRaw !== "string" ||
+        typeof parkedAt !== "number" ||
+        !Number.isFinite(parkedAt) ||
+        parkedAt < 0) {
+        return undefined;
+    }
+    const tier = TIERS.find((entry) => entry === tierRaw);
+    const reason = PARK_REASONS.find((entry) => entry === reasonRaw);
+    if (tier === undefined || reason === undefined)
+        return undefined;
+    const detail = parseDetailBounded(raw["detail"]);
+    const attemptsRaw = raw["attempts"];
+    const attempts = typeof attemptsRaw === "number" && Number.isInteger(attemptsRaw) && attemptsRaw >= 0
+        ? attemptsRaw
+        : undefined;
+    return {
+        id,
+        sessionID,
+        tier,
+        reason,
+        ...(detail !== undefined ? { detail } : {}),
+        parkedAt,
+        ...(attempts !== undefined ? { attempts } : {}),
+    };
+}
+/**
+ * Parse a persisted parked payload. Accepts the versioned shape and a
+ * versionless draft array; anything else yields no records.
+ */
+export function parseParkedPayload(raw) {
+    let list;
+    if (isRecord(raw)) {
+        const version = raw["version"];
+        if (version !== PARKED_VERSION && version !== undefined)
+            return [];
+        list = raw["parked"];
+    }
+    else if (Array.isArray(raw)) {
+        list = raw;
+    }
+    if (!Array.isArray(list))
+        return [];
+    const parsed = list
+        .map(parseParked)
+        .filter((record) => record !== undefined);
+    return parsed.length > MAX_PARKED ? parsed.slice(-MAX_PARKED) : parsed;
+}
+//# sourceMappingURL=parse.js.map

package/dist/state/parked-work/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../src/state/parked-work/parse.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAGxE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AACzC,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,SAAS,CAAA;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IAChC,IACE,EAAE,KAAK,SAAS;QAChB,SAAS,KAAK,SAAS;QACvB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,QAAQ,GAAG,CAAC,EACZ,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IACnC,MAAM,QAAQ,GACZ,OAAO,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;QAClF,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,EAAE;QACF,SAAS;QACT,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,IAAa,CAAA;IACjB,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,OAAO,KAAK,cAAc,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QAClE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI;SAChB,GAAG,CAAC,WAAW,CAAC;SAChB,MAAM,CAAC,CAAC,MAAM,EAA0B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACxE,CAAC","sourcesContent":["/**\n * Read-side parsing for persisted parked records (ADP-024). Total: accepts\n * `unknown`, drops invalid entries, never throws (ADP-031). Vocabulary is\n * membership-checked (the write path is typed); free-text is re-bounded.\n */\nimport { PARK_REASONS } from \"../../core/scheduler/types.js\"\nimport { TIERS } from \"../../core/tier-policy/types.js\"\nimport { MAX_PARKED, MAX_PARKED_TEXT, PARKED_VERSION } from \"./types.js\"\nimport type { ParkedRecord } from \"./types.js\"\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction boundString(raw: unknown): string | undefined {\n  if (typeof raw !== \"string\") return undefined\n  return raw.length > MAX_PARKED_TEXT ? raw.slice(0, MAX_PARKED_TEXT) : raw\n}\n\nfunction parseOptionalBounded(raw: unknown): string | undefined {\n  const value = boundString(raw)\n  return value === \"\" ? undefined : value\n}\n\n/** Free-text detail keeps empty strings (round-trips through the store). */\nfunction parseDetailBounded(raw: unknown): string | undefined {\n  return boundString(raw) ?? undefined\n}\n\nfunction parseParked(raw: unknown): ParkedRecord | undefined {\n  if (!isRecord(raw)) return undefined\n  const id = parseOptionalBounded(raw[\"id\"])\n  const sessionID = parseOptionalBounded(raw[\"sessionID\"])\n  const tierRaw = raw[\"tier\"]\n  const reasonRaw = raw[\"reason\"]\n  const parkedAt = raw[\"parkedAt\"]\n  if (\n    id === undefined ||\n    sessionID === undefined ||\n    typeof tierRaw !== \"string\" ||\n    typeof reasonRaw !== \"string\" ||\n    typeof parkedAt !== \"number\" ||\n    !Number.isFinite(parkedAt) ||\n    parkedAt < 0\n  ) {\n    return undefined\n  }\n  const tier = TIERS.find((entry) => entry === tierRaw)\n  const reason = PARK_REASONS.find((entry) => entry === reasonRaw)\n  if (tier === undefined || reason === undefined) return undefined\n  const detail = parseDetailBounded(raw[\"detail\"])\n  const attemptsRaw = raw[\"attempts\"]\n  const attempts =\n    typeof attemptsRaw === \"number\" && Number.isInteger(attemptsRaw) && attemptsRaw >= 0\n      ? attemptsRaw\n      : undefined\n  return {\n    id,\n    sessionID,\n    tier,\n    reason,\n    ...(detail !== undefined ? { detail } : {}),\n    parkedAt,\n    ...(attempts !== undefined ? { attempts } : {}),\n  }\n}\n\n/**\n * Parse a persisted parked payload. Accepts the versioned shape and a\n * versionless draft array; anything else yields no records.\n */\nexport function parseParkedPayload(raw: unknown): ParkedRecord[] {\n  let list: unknown\n  if (isRecord(raw)) {\n    const version = raw[\"version\"]\n    if (version !== PARKED_VERSION && version !== undefined) return []\n    list = raw[\"parked\"]\n  } else if (Array.isArray(raw)) {\n    list = raw\n  }\n  if (!Array.isArray(list)) return []\n  const parsed = list\n    .map(parseParked)\n    .filter((record): record is ParkedRecord => record !== undefined)\n  return parsed.length > MAX_PARKED ? parsed.slice(-MAX_PARKED) : parsed\n}\n"]}

package/dist/state/parked-work/store.d.ts

@@ -0,0 +1,17 @@
+import type { ParkedRecord, ParkedStorage } from "./types.js";
+export declare class ParkedWorkStore {
+    #private;
+    private readonly storage;
+    constructor(storage: ParkedStorage);
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load(): Promise<void>;
+    /** All parked records, insertion order. */
+    list(): readonly ParkedRecord[];
+    count(): number;
+    park(record: ParkedRecord): Promise<void>;
+    /**
+     * Remove a parked record and return it so the execution layer knows what
+     * to continue. `undefined` (no record, no write) when the id is unknown.
+     */
+    resume(id: string): Promise<ParkedRecord | undefined>;
+}

package/dist/state/parked-work/store.js

@@ -0,0 +1,98 @@
+/**
+ * Parked-work store (ADP-024). Records are keyed by unit id — parking the
+ * same unit again replaces the record (latest park wins). The cap
+ * `MAX_PARKED` evicts the oldest `parkedAt` first: parked work is waiting
+ * work, and unbounded growth would mean recovery never happens. Write
+ * failures propagate to the caller (fail-open is the wiring layer's call), and
+ * the in-memory list is only advanced after a successful write — memory and
+ * disk never diverge.
+ */
+import { parseParkedPayload } from "./parse.js";
+import { MAX_PARKED, MAX_PARKED_TEXT, PARKED_VERSION } from "./types.js";
+function boundDetail(raw) {
+    return raw.length > MAX_PARKED_TEXT ? raw.slice(0, MAX_PARKED_TEXT) : raw;
+}
+export class ParkedWorkStore {
+    storage;
+    #records = [];
+    #queue = Promise.resolve();
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load() {
+        return this.#serialize(() => this.#load());
+    }
+    async #load() {
+        let raw;
+        try {
+            raw = await this.storage.read();
+        }
+        catch {
+            this.#records = [];
+            return;
+        }
+        this.#records = parseParkedPayload(raw);
+    }
+    /** All parked records, insertion order. */
+    list() {
+        return this.#records;
+    }
+    count() {
+        return this.#records.length;
+    }
+    park(record) {
+        return this.#serialize(() => this.#park(record));
+    }
+    async #park(record) {
+        const bounded = {
+            ...record,
+            ...(record.detail !== undefined ? { detail: boundDetail(record.detail) } : {}),
+        };
+        const withoutId = this.#records.filter((entry) => entry.id !== bounded.id);
+        const next = this.#evictOldest([...withoutId, bounded]);
+        // Persist BEFORE committing memory: a failed resume must not silently
+        // drop the parked unit (memory and disk stay consistent on failure).
+        await this.#persist(next);
+        this.#records = next;
+    }
+    /**
+     * Remove a parked record and return it so the execution layer knows what
+     * to continue. `undefined` (no record, no write) when the id is unknown.
+     */
+    resume(id) {
+        return this.#serialize(() => this.#resume(id));
+    }
+    async #resume(id) {
+        const record = this.#records.find((entry) => entry.id === id);
+        if (record === undefined)
+            return undefined;
+        const next = this.#records.filter((entry) => entry.id !== id);
+        await this.#persist(next);
+        this.#records = next;
+        return record;
+    }
+    #evictOldest(records) {
+        if (records.length <= MAX_PARKED)
+            return records;
+        const byOldest = [...records].sort((a, b) => a.parkedAt - b.parkedAt);
+        const dropped = new Set(byOldest.slice(0, records.length - MAX_PARKED).map((r) => r.id));
+        return records.filter((record) => !dropped.has(record.id));
+    }
+    // Reads share the queue so reloads cannot overwrite newer commits. Recover
+    // the queue after rejection while preserving the failing caller's promise.
+    #serialize(operation) {
+        const run = this.#queue.then(operation);
+        this.#queue = run.catch(() => undefined);
+        return run;
+    }
+    /** Writes the given next state; the caller commits memory only on success. */
+    async #persist(parked) {
+        const payload = {
+            version: PARKED_VERSION,
+            parked,
+        };
+        await this.storage.write(payload);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/state/parked-work/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/state/parked-work/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAGxE,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3E,CAAC;AAED,MAAM,OAAO,eAAe;IAIG;IAH7B,QAAQ,GAAmB,EAAE,CAAA;IAC7B,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE5C,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAEvD,qFAAqF;IACrF,IAAI;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAA;YAClB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACzC,CAAC;IAED,2CAA2C;IAC3C,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAA;IAC7B,CAAC;IAED,IAAI,CAAC,MAAoB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,MAAM,OAAO,GAAiB;YAC5B,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAA;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAAuB;QAClC,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,OAAO,CAAA;QAChD,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;QACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,UAAU,CAAI,SAA2B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,QAAQ,CAAC,MAA+B;QAC5C,MAAM,OAAO,GAAkB;YAC7B,OAAO,EAAE,cAAc;YACvB,MAAM;SACP,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;CACF","sourcesContent":["/**\n * Parked-work store (ADP-024). Records are keyed by unit id — parking the\n * same unit again replaces the record (latest park wins). The cap\n * `MAX_PARKED` evicts the oldest `parkedAt` first: parked work is waiting\n * work, and unbounded growth would mean recovery never happens. Write\n * failures propagate to the caller (fail-open is the wiring layer's call), and\n * the in-memory list is only advanced after a successful write — memory and\n * disk never diverge.\n */\nimport { parseParkedPayload } from \"./parse.js\"\nimport { MAX_PARKED, MAX_PARKED_TEXT, PARKED_VERSION } from \"./types.js\"\nimport type { ParkedPayload, ParkedRecord, ParkedStorage } from \"./types.js\"\n\nfunction boundDetail(raw: string): string {\n  return raw.length > MAX_PARKED_TEXT ? raw.slice(0, MAX_PARKED_TEXT) : raw\n}\n\nexport class ParkedWorkStore {\n  #records: ParkedRecord[] = []\n  #queue: Promise<unknown> = Promise.resolve()\n\n  constructor(private readonly storage: ParkedStorage) {}\n\n  /** Rebuild from storage (restart behavior). A read failure yields an empty store. */\n  load(): Promise<void> {\n    return this.#serialize(() => this.#load())\n  }\n\n  async #load(): Promise<void> {\n    let raw: unknown\n    try {\n      raw = await this.storage.read()\n    } catch {\n      this.#records = []\n      return\n    }\n    this.#records = parseParkedPayload(raw)\n  }\n\n  /** All parked records, insertion order. */\n  list(): readonly ParkedRecord[] {\n    return this.#records\n  }\n\n  count(): number {\n    return this.#records.length\n  }\n\n  park(record: ParkedRecord): Promise<void> {\n    return this.#serialize(() => this.#park(record))\n  }\n\n  async #park(record: ParkedRecord): Promise<void> {\n    const bounded: ParkedRecord = {\n      ...record,\n      ...(record.detail !== undefined ? { detail: boundDetail(record.detail) } : {}),\n    }\n    const withoutId = this.#records.filter((entry) => entry.id !== bounded.id)\n    const next = this.#evictOldest([...withoutId, bounded])\n    // Persist BEFORE committing memory: a failed resume must not silently\n    // drop the parked unit (memory and disk stay consistent on failure).\n    await this.#persist(next)\n    this.#records = next\n  }\n\n  /**\n   * Remove a parked record and return it so the execution layer knows what\n   * to continue. `undefined` (no record, no write) when the id is unknown.\n   */\n  resume(id: string): Promise<ParkedRecord | undefined> {\n    return this.#serialize(() => this.#resume(id))\n  }\n\n  async #resume(id: string): Promise<ParkedRecord | undefined> {\n    const record = this.#records.find((entry) => entry.id === id)\n    if (record === undefined) return undefined\n    const next = this.#records.filter((entry) => entry.id !== id)\n    await this.#persist(next)\n    this.#records = next\n    return record\n  }\n\n  #evictOldest(records: ParkedRecord[]): ParkedRecord[] {\n    if (records.length <= MAX_PARKED) return records\n    const byOldest = [...records].sort((a, b) => a.parkedAt - b.parkedAt)\n    const dropped = new Set(byOldest.slice(0, records.length - MAX_PARKED).map((r) => r.id))\n    return records.filter((record) => !dropped.has(record.id))\n  }\n\n  // Reads share the queue so reloads cannot overwrite newer commits. Recover\n  // the queue after rejection while preserving the failing caller's promise.\n  #serialize<T>(operation: () => Promise<T>): Promise<T> {\n    const run = this.#queue.then(operation)\n    this.#queue = run.catch(() => undefined)\n    return run\n  }\n\n  /** Writes the given next state; the caller commits memory only on success. */\n  async #persist(parked: readonly ParkedRecord[]): Promise<void> {\n    const payload: ParkedPayload = {\n      version: PARKED_VERSION,\n      parked,\n    }\n    await this.storage.write(payload)\n  }\n}\n"]}

package/dist/state/parked-work/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Durable parked work (ADP-024): admission-time records for work with no
+ * compatible healthy resource, persisted so they survive restart. A parked
+ * record carries only identity and routing context — resumption (T-13) is a
+ * clean continuation that re-runs routing fresh; it is never the resurrection
+ * of a failed network call.
+ */
+import type { ParkReason } from "../../core/scheduler/types.js";
+import type { TierName } from "../../core/tier-policy/types.js";
+export declare const PARKED_KEY = "coool.adaptive/parked";
+export declare const PARKED_VERSION = 1;
+/** Product bound — not a user knob. Eviction drops the oldest parkedAt. */
+export declare const MAX_PARKED = 64;
+/** Free-text detail is bounded like every other persisted string. */
+export declare const MAX_PARKED_TEXT = 128;
+export interface ParkedRecord {
+    /** Unit id (`${sessionID}#${episode}`) — one parked record per unit. */
+    readonly id: string;
+    readonly sessionID: string;
+    /** Required tier at park time; resumption re-runs routing fresh. */
+    readonly tier: TierName;
+    readonly reason: ParkReason;
+    readonly detail?: string | undefined;
+    /** Park timestamp (adapter clock, ms epoch). */
+    readonly parkedAt: number;
+    /**
+     * Failed resume attempts (absent = never retried). The resume planner
+     * drops records whose attempts reach the planner's budget so a
+     * persistently failing continuation cannot retry forever (ADP-011).
+     */
+    readonly attempts?: number | undefined;
+}
+export interface ParkedPayload {
+    readonly version: typeof PARKED_VERSION;
+    readonly parked: readonly ParkedRecord[];
+}
+/** Storage seam — the adapter binds `PARKED_KEY` to `ctx.storage`. */
+export interface ParkedStorage {
+    read(): Promise<unknown>;
+    write(payload: ParkedPayload): Promise<void>;
+}

package/dist/state/parked-work/types.js

@@ -0,0 +1,7 @@
+export const PARKED_KEY = "coool.adaptive/parked";
+export const PARKED_VERSION = 1;
+/** Product bound — not a user knob. Eviction drops the oldest parkedAt. */
+export const MAX_PARKED = 64;
+/** Free-text detail is bounded like every other persisted string. */
+export const MAX_PARKED_TEXT = 128;
+//# sourceMappingURL=types.js.map

package/dist/state/parked-work/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/state/parked-work/types.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAA;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAA;AAC/B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAA;AAC5B,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA","sourcesContent":["/**\n * Durable parked work (ADP-024): admission-time records for work with no\n * compatible healthy resource, persisted so they survive restart. A parked\n * record carries only identity and routing context — resumption (T-13) is a\n * clean continuation that re-runs routing fresh; it is never the resurrection\n * of a failed network call.\n */\nimport type { ParkReason } from \"../../core/scheduler/types.js\"\nimport type { TierName } from \"../../core/tier-policy/types.js\"\n\nexport const PARKED_KEY = \"coool.adaptive/parked\"\nexport const PARKED_VERSION = 1\n/** Product bound — not a user knob. Eviction drops the oldest parkedAt. */\nexport const MAX_PARKED = 64\n/** Free-text detail is bounded like every other persisted string. */\nexport const MAX_PARKED_TEXT = 128\n\nexport interface ParkedRecord {\n  /** Unit id (`${sessionID}#${episode}`) — one parked record per unit. */\n  readonly id: string\n  readonly sessionID: string\n  /** Required tier at park time; resumption re-runs routing fresh. */\n  readonly tier: TierName\n  readonly reason: ParkReason\n  readonly detail?: string | undefined\n  /** Park timestamp (adapter clock, ms epoch). */\n  readonly parkedAt: number\n  /**\n   * Failed resume attempts (absent = never retried). The resume planner\n   * drops records whose attempts reach the planner's budget so a\n   * persistently failing continuation cannot retry forever (ADP-011).\n   */\n  readonly attempts?: number | undefined\n}\n\nexport interface ParkedPayload {\n  readonly version: typeof PARKED_VERSION\n  readonly parked: readonly ParkedRecord[]\n}\n\n/** Storage seam — the adapter binds `PARKED_KEY` to `ctx.storage`. */\nexport interface ParkedStorage {\n  read(): Promise<unknown>\n  write(payload: ParkedPayload): Promise<void>\n}\n"]}

package/dist/state/receipts/bound.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Bounding for receipts (ADP-030). Receipts are built from typed scheduler
+ * decisions, but every string they can carry is truncated to
+ * `MAX_RECEIPT_TEXT` before persisting — including identifiers. Boundedness
+ * is what makes the no-secrets invariant checkable: no field accepts
+ * unbounded text, so nothing unbounded can be persisted.
+ */
+import type { Decision } from "../../core/scheduler/types.js";
+export declare function boundText(raw: string): string;
+/**
+ * Structural copy of a decision with every string bounded. `depth` guards
+ * the `observe-only` recursion (max one nesting level is ever produced).
+ */
+export declare function boundDecision(decision: Decision, depth?: number): Decision;