@cotal-ai/cli 0.48.2 → 0.50.0

package/dist/lib/delivery-proc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-proc.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AASA,OAAO,EAAuP,KAAK,aAAa,EAA8K,MAAM,qBAAqB,CAAC;AAI1d,OAAO,EAA2F,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAkB3I;;;;kGAIkG;AAClG,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9M;;;qFAGqF;AACrF,wBAAgB,gBAAgB,CAC9B,KAAK,GAAE,aAA6B,EACpC,KAAK,GAAE,MAAsB,GAC5B,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,CAQ5D;AAED;2EAC2E;AAC3E,wBAAgB,UAAU,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAEjE;AAgCD;;0GAE0G;AAC1G,wBAAsB,8BAA8B,CAClD,KAAK,GAAE,aAA6B,EACpC,MAAM,CAAC,EAAE,QAAQ,EACjB,KAAK,GAAE,MAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;6BAG6B;AAC7B,wBAAgB,qBAAqB,CAAC,CAAC,GAAE,IAAS,GAAG,MAAM,CAkC1D;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAAC,CAAC,GAAE,IAAS,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8DtH;AAED;;;mDAGmD;AACnD,wBAAsB,YAAY,CAChC,KAAK,GAAE,aAA6B,EACpC,MAAM,CAAC,EAAE,QAAQ,EACjB,KAAK,GAAE,MAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA+Ef;AAED;;;;+FAI+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAQpF"}
+{"version":3,"file":"delivery-proc.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAUA,OAAO,EAAmS,KAAK,aAAa,EAAE,KAAK,aAAa,EAA8K,MAAM,qBAAqB,CAAC;AAI1hB,OAAO,EAA2F,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAmB3I;;;;kGAIkG;AAClG,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpO;;;;;;;;;;;oDAWoD;AACpD,wBAAgB,gBAAgB,CAC9B,KAAK,GAAE,aAA6B,EACpC,KAAK,GAAE,MAAsB,EAC7B,WAAW,GAAE,aAAkC,GAC9C,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,SAAS,CAYxE;AAED;2EAC2E;AAC3E,wBAAgB,UAAU,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAEjE;AAgCD;;0GAE0G;AAC1G,wBAAsB,8BAA8B,CAClD,KAAK,GAAE,aAA6B,EACpC,MAAM,CAAC,EAAE,QAAQ,EACjB,KAAK,GAAE,MAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;6BAG6B;AAC7B,wBAAgB,qBAAqB,CAAC,CAAC,GAAE,IAAS,GAAG,MAAM,CAoC1D;AAED;;;;;;;;;;kGAUkG;AAClG,wBAAsB,cAAc,CAAC,CAAC,GAAE,IAAS,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAuFhJ;AAED;;;mDAGmD;AACnD,wBAAsB,YAAY,CAChC,KAAK,GAAE,aAA6B,EACpC,MAAM,CAAC,EAAE,QAAQ,EACjB,KAAK,GAAE,MAAsB,EAC7B,WAAW,GAAE,aAAkC,GAC9C,OAAO,CAAC,IAAI,CAAC,CA4Ff;AAED;;;;+FAI+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAa9G"}

package/dist/lib/delivery-proc.js

@@ -1,11 +1,12 @@
 import { spawn } from "node:child_process";
 import { existsSync, openSync, closeSync, writeFileSync, readFileSync, rmSync } from "node:fs";
-import { DEFAULT_SERVER, LEASE_TTL_MS, mintCreds, newIdentity, waitForDeliveryLease, } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KIND, DELIVERY_LOGFILE, DELIVERY_PIDFILE, authDir, canonicalLocalProcessPath, deliveryCredsKey, findCotalRoot, getSpaceAuth, listSpaceAccounts, localProcessPath, parsePid, probeLiveness, reclaimDeadPreUpgradeRecord, segmentedKey, workspaceSecretStore, identityLegacyWarning, identityRefusal, identityUncertaintyRefusal, removeIdentityPin, verifyIdentityPin, writeIdentityPin } from "@cotal-ai/workspace";
-import { selfArgv } from "./self-exec.js";
+import { DEFAULT_SERVER, LEASE_TTL_MS, mintCreds, newIdentity, waitForDeliveryLease, deliveryLeaseHolderFor, } from "@cotal-ai/core";
+import { DELIVERY_CREDS_KIND, DELIVERY_LOGFILE, DELIVERY_PIDFILE, authDir, canonicalLocalProcessPath, commandIsCotalDelivery, deliveryCredsKey, findCotalRoot, getSpaceAuth, listSpaceAccounts, localProcessPath, parsePid, probeLiveness, readProcessCommand, reclaimDeadPreUpgradeRecord, segmentedKey, workspaceSecretStore, identityLegacyWarning, identityRefusal, identityUncertaintyRefusal, removeIdentityPin, verifyIdentityPin, writeIdentityPin } from "@cotal-ai/workspace";
+import { selfArgv, displayCmd } from "./self-exec.js";
 import { resolveRuntimeSpace } from "./status.js";
 import { cotalRoot } from "./paths.js";
 import { MANAGER_PID_PATH, ensureManager, managerHasDeliveryMarker, managerLiveness, stopManager } from "./manager-proc.js";
+import { RESPONDER_UNBOUND_CONSEQUENCE } from "./delivery-responder.js";
 /** The space this folder's commands mean, and the per-space record paths over it. The daemon is
  *  minted a space-scoped cred and binds that space's durables, so a root-scoped record gave one root
  *  one daemon by filename; every helper below therefore takes the space it is answering about. */
@@ -24,8 +25,16 @@ const deliveryCredsKeysToClear = (space) => [segmentedKey(DELIVERY_CREDS_KIND, s
 /** The recorded daemon's liveness, THREE-VALUED plus absent. See {@link managerLiveness} for why the
  *  boolean collapse is the defect: `unknown` is reachable on a real kernel (a seccomp
  *  `SECCOMP_RET_ERRNO` filter or an LSM policy answers `kill(pid, 0)` with an arbitrary errno and
- *  libuv preserves it), and both ways of folding it into a boolean fail silently. */
-export function deliveryLiveness(probe = probeLiveness, space = folderSpace()) {
+ *  libuv preserves it), and both ways of folding it into a boolean fail silently.
+ *
+ *  `foreign` is the same fifth state {@link managerLiveness} already carries, for the same reason and
+ *  under the same rule (#1528): a live pid is believed only once the process behind it has been READ
+ *  and names the delivery daemon. A record outliving its daemon is eventually re-pointed at an
+ *  unrelated process by pid reuse, and from `kill(pid, 0)` alone that reads as a healthy daemon
+ *  forever. ATTRIBUTION MAY ONLY DOWNGRADE ON PROOF: a read that failed, a platform with no argv
+ *  source, and a process that died during the read all leave the record trusted, which is exactly
+ *  how every caller behaved before this existed. */
+export function deliveryLiveness(probe = probeLiveness, space = folderSpace(), readCommand = readProcessCommand) {
     const p = PID_PATH(space);
     if (!existsSync(p))
         return "absent";
@@ -35,7 +44,13 @@ export function deliveryLiveness(probe = probeLiveness, space = folderSpace()) {
     const pid = parsePid(raw);
     if (pid === undefined)
         return "unattributable"; // see managerLiveness: never fold this into absent
-    return probe(pid);
+    const liveness = probe(pid);
+    if (liveness !== "alive")
+        return liveness;
+    const cmd = readCommand(pid);
+    if (cmd.kind !== "command")
+        return "alive"; // gone/unreadable: nothing was established about it
+    return commandIsCotalDelivery(cmd.command) ? "alive" : "foreign";
 }
 /** True only if the daemon is PROVABLY running. Callers that ACT on the answer take
  *  {@link deliveryLiveness} instead; this cannot express "cannot tell". */
@@ -94,8 +109,10 @@ export function startDeliveryDetached(o = {}) {
     // See startManagerDetached: reclaim a provably dead pre-upgrade record before claiming the
     // canonical slot, and refuse rather than start a second daemon beside a live one.
     reclaimDeadPreUpgradeRecord(DELIVERY_PIDFILE, ctx(space));
-    const fd = openSync(canonicalLocalProcessPath(DELIVERY_LOGFILE, ctx(space)), "a");
+    // Before the log is opened, for the reason startManagerDetached states: a `selfArgv` refusal
+    // (#1629) must not leave a delivery log and a leaked descriptor behind.
     const [node, ...self] = selfArgv();
+    const fd = openSync(canonicalLocalProcessPath(DELIVERY_LOGFILE, ctx(space)), "a");
     const args = [
         ...self,
         "deliver",
@@ -128,7 +145,13 @@ export function startDeliveryDetached(o = {}) {
  *  while an old Plane-3-hosting manager is live (the preflight should have stopped it) so the daemon
  *  never double-binds. Mints a SCOPED `delivery` cred from the local signer ONCE, writes it to
  *  `.cotal/delivery.creds` (0600), and launches the daemon WITHOUT signer access. Best-effort — callers
- *  treat it as non-fatal (a missing daemon degrades durable delivery, never live). */
+ *  treat it as non-fatal (a missing daemon degrades durable delivery, never live).
+ *
+ *  RETURNS TWO FACTS, NOT ONE (#1576). `running` is about the PROCESS; `responderBound` is about the
+ *  `ctl.delivery` responder, which is what spawn, retirement and join actually require. They are not
+ *  the same question, and collapsing them into one boolean is how a mesh came to report healthy for
+ *  22 hours while none of those three operations could complete. `responderBound` is false when the
+ *  readiness wait elapsed without the lease flipping ready, and absent when no daemon applies. */
 export async function ensureDelivery(o = {}, probe = probeLiveness) {
     if (!hasAuth())
         return { running: false }; // open dev mode — no daemon, agents are live-only
@@ -169,11 +192,17 @@ export async function ensureDelivery(o = {}, probe = probeLiveness) {
     // responder for their boot self-join. Non-fatal on timeout: the boot self-join reconciles with backoff,
     // which is the real safety net for a slow start or a later outage.
     //
-    // WHOSE readiness matters. A fresh launch waits for THE DAEMON IT JUST STARTED: its lease holder is
-    // the endpoint id of the cred written above (the daemon adopts `idFromCreds` of that file), so the
-    // wait cannot be answered by some other daemon's — or a dead one's — leftover `ready:true` record.
-    // A reuse adopts a daemon that was already running and cannot know its id, so it waits for any.
-    const ready = await waitForDeliveryLease({ servers: server, space, creds, id: id.id, holder: launched !== undefined ? id.id : undefined });
+    // WHOSE readiness matters. A fresh launch waits for THE DAEMON IT JUST STARTED, so the wait cannot
+    // be answered by some other daemon's - or a dead one's - leftover `ready:true` record. A reuse
+    // adopts a daemon that was already running and cannot know its id, so it waits for any.
+    //
+    // THROUGH `deliveryLeaseHolderFor`, NOT `id.id`. This asked for the bare nkey, while the daemon's
+    // endpoint stamps the PRINCIPAL dot-form into the row, so the comparison could never be true: every
+    // fresh launch ran the full 8s timeout and then reported a ready daemon as not-ready. It failed in
+    // the safe direction, which is why it went unnoticed, but the #837 guarantee this argument exists
+    // to enforce was not actually in force - it was defeated by always-false rather than by accepting
+    // anything. Found in review (#1318), where the same two namespaces were confused a third time.
+    const ready = await waitForDeliveryLease({ servers: server, space, creds, id: id.id, holder: launched !== undefined ? deliveryLeaseHolderFor(creds) : undefined });
     // A launch we performed whose process is GONE is not a slow start, and reporting it as one is the
     // #837 false-green: the daemon lost the single-flight CAS to a live-or-stale lease and exited (it
     // says so in `.cotal/delivery.log`), while this returned `running: true` over a pidfile fronting a
@@ -184,14 +213,31 @@ export async function ensureDelivery(o = {}, probe = probeLiveness) {
             `Refusing to report a daemon that is not running. The daemon logged its own reason to ${canonicalLocalProcessPath(DELIVERY_LOGFILE, ctx(space))}.\n` +
             `NEXT: read that log; if no other daemon is running, wait for the stale lease to expire and re-run.`);
     if (!ready)
-        console.error("• delivery daemon not yet ready (responder not bound) - boot durable joins will reconcile when it is");
-    return { running: true };
+        // #1576. THIS USED TO PRINT A PROMISE AND RETURN SUCCESS, and that combination is the defect.
+        // The promise was true — `reconcileBootJoin` really does retry with capped backoff and really
+        // does establish the memberships once a daemon binds — but it was the ONLY thing said, at info
+        // level, once, and it described the RECOVERY rather than the state. A reporter's fleet then ran
+        // 22 hours in exactly this condition: `cotal up` alive, systemctl green, and spawn, retirement
+        // and join all failing, with nothing anywhere naming the responder.
+        //
+        // So the line now names the CONSEQUENCE first (what does not work while this holds), then the
+        // recovery, and it says the wait is open-ended rather than implying it has been handled. The
+        // reconcile keeps its sentence because an operator who respawns agents over this loses live
+        // sessions for nothing — the daemon re-mints and the agents rejoin on their own.
+        console.error(`! delivery daemon started but its responder is NOT BOUND yet (the shard-0 lease has not flipped ready) - ${RESPONDER_UNBOUND_CONSEQUENCE}.\n` +
+            `  This does not time out on its own: the boot durable joins retry with backoff and WILL reconcile when the responder binds, however long that takes, and agents rejoin WITHOUT being respawned.\n` +
+            `  Check it with \`${displayCmd()} status --components\` (delivery row) and read ${canonicalLocalProcessPath(DELIVERY_LOGFILE, ctx(space))} for the daemon's own reason.`);
+    // The caller hears WHICH of the two states it got. `running` still means "a daemon process is
+    // there" (unchanged for every existing caller), but a caller that needs the responder — anything
+    // that is about to spawn, retire or join — can now ask instead of assuming, which it could not do
+    // when this returned a bare `running: true` over an admittedly unbound responder.
+    return { running: true, responderBound: ready };
 }
 /** Stop the detached delivery daemon if we started one, and drop its creds from the store. The pid
  *  kill runs even if the creds delete fails (finally) — a delete error must never leave the daemon
  *  alive to outlive the teardown and reattach to a restarted broker; the error still propagates
  *  after the kill so the caller can surface it. */
-export async function stopDelivery(probe = probeLiveness, signal, space = folderSpace()) {
+export async function stopDelivery(probe = probeLiveness, signal, space = folderSpace(), readCommand = readProcessCommand) {
     const send = signal ?? ((pid, sig) => process.kill(pid, sig));
     const p = PID_PATH(space);
     // ORDER MATTERS, AND IT USED TO BE BACKWARDS. The credential was deleted FIRST, in a try whose
@@ -235,6 +281,19 @@ export async function stopDelivery(probe = probeLiveness, signal, space = folder
         await removeRecords();
         return;
     }
+    // A LIVE pid that is provably NOT a delivery daemon is never signalled, the same rule
+    // `stopManager` applies (#1528). The record outlived its daemon and the number was reused, so
+    // SIGTERM here would kill an unrelated process. The record is removed because it is PROVABLY
+    // stale, and what was found is printed: an operator told only "already stopped" would not learn
+    // that their pidfile was pointing at a stranger.
+    if (before === "alive") {
+        const cmd = readCommand(pid);
+        if (cmd.kind === "command" && !commandIsCotalDelivery(cmd.command)) {
+            console.error(`! recorded delivery daemon pid ${pid} is alive but is running \`${cmd.command}\`, which is not a delivery daemon - not signalling it; removing the stale record instead.`);
+            await removeRecords();
+            return;
+        }
+    }
     if (before === "unknown")
         throw new Error(`refusing to stop the delivery daemon (pid ${pid}): its liveness cannot be determined (a seccomp filter or LSM policy answers kill(pid,0) with an arbitrary errno).\n` +
             `The pidfile and standing credential are LEFT IN PLACE: removing them would strand a daemon that may still be connected, with its renewal source gone.\n` +
@@ -280,7 +339,12 @@ export async function ensureControlPlane(o = {}) {
     // start another's.
     const space = o.space ?? folderSpace();
     await stopOldHostingManagerIfPresent(probeLiveness, undefined, space);
-    await ensureDelivery({ ...o, space });
-    return ensureManager({ ...o, space });
+    // The delivery answer is CARRIED, not discarded (#1576). This used to drop `ensureDelivery`'s
+    // result on the floor and return only the manager's, so `cotal up` had no way to say that the
+    // dependency every spawn/retirement/join needs had not come up — the boot line inside
+    // `ensureDelivery` was the only trace, and it read as a progress note.
+    const delivery = await ensureDelivery({ ...o, space });
+    const manager = await ensureManager({ ...o, space });
+    return { ...manager, responderBound: delivery.responderBound };
 }
 //# sourceMappingURL=delivery-proc.js.map

package/dist/lib/delivery-proc.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,WAAW,EACX,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,2BAA2B,EAAE,YAAY,EAAgD,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1d,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EAAE,eAAe,EAAE,WAAW,EAAiB,MAAM,mBAAmB,CAAC;AAE3I;;kGAEkG;AAClG,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAuB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACnF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,CAAC,QAAgB,WAAW,EAAE,EAAU,EAAE,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3G,gGAAgG;AAChG,kGAAkG;AAClG,2DAA2D;AAC3D,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/D;;qGAEqG;AACrG,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AASpH;;;qFAGqF;AACrF,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,aAAa,EACpC,QAAgB,WAAW,EAAE;IAE7B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,CAAC,mDAAmD;IACnG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAgB,WAAW,EAAE;IACtD,OAAO,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC;AAC5D,CAAC;AAID;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,SAAS,wBAAwB,CAC/B,QAAuB,aAAa,EACpC,QAAgB,WAAW,EAAE;IAE7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB;QAAE,OAAO,eAAe,CAAC;IAC9E,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,6CAA6C;IACtF,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,4BAA4B;AAC9F,CAAC;AAED;;0GAE0G;AAC1G,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAuB,aAAa,EACpC,MAAiB,EACjB,QAAgB,WAAW,EAAE;IAE7B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,wFAAwF;IACxF,IAAI,OAAO,KAAK,eAAe;QAC7B,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,uMAAuM;YACtR,0NAA0N;YAC1N,gFAAgF,gBAAgB,CAAC,KAAK,CAAC,qEAAqE,CAC/K,CAAC;IACJ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,+FAA+F;QAC/F,kGAAkG;QAClG,mGAAmG;QACnG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,2FAA2F;IAC3F,kFAAkF;IAClF,2BAA2B,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,QAAQ,CAAC,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,KAAK;QACL,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;QAC1B,+FAA+F;QAC/F,gGAAgG;QAChG,wFAAwF;QACxF,kGAAkG;QAClG,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,OAAO,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sCAAsC;IACjF,sFAAsF;IACtF,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,EAAE,QAAuB,aAAa;IACrF,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAE,CAAC;IACxD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,gBAAgB;QACnE,MAAM,IAAI,KAAK,CACb,qCAAqC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,wFAAwF;YACvK,sIAAsI;YACtI,wIAAwI;YACxI,gFAAgF,QAAQ,CAAC,KAAK,CAAC,qDAAqD,CACvJ,CAAC;IACJ,IAAI,QAA4B,CAAC;IACjC,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,gEAAgE;QAChE,+FAA+F;QAC/F,gGAAgG;QAChG,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,UAAU,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnG,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,EAAE;IACF,oGAAoG;IACpG,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3I,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,+CAA+C;IAC/C,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;QAChE,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,UAAU,QAAQ,6EAA6E;YAC5I,oJAAoJ,YAAY,GAAG,IAAI,OAAO;YAC9K,wFAAwF,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK;YACpJ,oGAAoG,CACvG,CAAC;IACJ,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;mDAGmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAuB,aAAa,EACpC,MAAiB,EACjB,QAAgB,WAAW,EAAE;IAE7B,MAAM,IAAI,GAAa,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,+FAA+F;IAC/F,2DAA2D;IAC3D,kGAAkG;IAClG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;QAC9C,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,wEAAwE;QAC9F,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,SAAS,EAAE,CAAC,CAAC,4CAA4C;QAC/D,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,aAAa,EAAE,CAAC,CAAC,uCAAuC;YAC9D,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,yEAAyE;QACzE,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D;YACnI,0FAA0F;YAC1F,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,sHAAsH;YACpK,yJAAyJ;YACzJ,6BAA6B,GAAG,yCAAyC,CAAC,mBAAmB,CAChG,CAAC;IACJ,8FAA8F;IAC9F,+FAA+F;IAC/F,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,eAAe,CAAC,qBAAqB,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvH,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1F,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,0BAA0B,CAAC,qBAAqB,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrI,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,aAAa,EAAE,CAAC,CAAC,yCAAyC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,+BAA+B,IAAI,IAAI,eAAe,MAAM;YAC1G,yIAAyI;YACzI,2CAA2C,CAAC,mCAAmC,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM;QACvB,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,sJAAsJ,CACtL,CAAC;IACJ,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,kGAAkG;IAClG,oGAAoG;IACpG,mBAAmB;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,MAAM,8BAA8B,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,aAAa,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,WAAW,EACX,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,YAAY,EAAoE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1hB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EAAE,eAAe,EAAE,WAAW,EAAiB,MAAM,mBAAmB,CAAC;AAC3I,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAExE;;kGAEkG;AAClG,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACrE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAuB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACnF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,CAAC,QAAgB,WAAW,EAAE,EAAU,EAAE,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3G,gGAAgG;AAChG,kGAAkG;AAClG,2DAA2D;AAC3D,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/D;;qGAEqG;AACrG,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AASpH;;;;;;;;;;;oDAWoD;AACpD,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,aAAa,EACpC,QAAgB,WAAW,EAAE,EAC7B,cAA6B,kBAAkB;IAE/C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,CAAC,mDAAmD;IACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,CAAC,oDAAoD;IAChG,OAAO,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAgB,WAAW,EAAE;IACtD,OAAO,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC;AAC5D,CAAC;AAID;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,SAAS,wBAAwB,CAC/B,QAAuB,aAAa,EACpC,QAAgB,WAAW,EAAE;IAE7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB;QAAE,OAAO,eAAe,CAAC;IAC9E,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,6CAA6C;IACtF,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,4BAA4B;AAC9F,CAAC;AAED;;0GAE0G;AAC1G,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAuB,aAAa,EACpC,MAAiB,EACjB,QAAgB,WAAW,EAAE;IAE7B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,wFAAwF;IACxF,IAAI,OAAO,KAAK,eAAe;QAC7B,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,uMAAuM;YACtR,0NAA0N;YAC1N,gFAAgF,gBAAgB,CAAC,KAAK,CAAC,qEAAqE,CAC/K,CAAC;IACJ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,+FAA+F;QAC/F,kGAAkG;QAClG,mGAAmG;QACnG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,2FAA2F;IAC3F,kFAAkF;IAClF,2BAA2B,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,6FAA6F;IAC7F,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,KAAK;QACL,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;QAC1B,+FAA+F;QAC/F,gGAAgG;QAChG,wFAAwF;QACxF,kGAAkG;QAClG,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,OAAO,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sCAAsC;IACjF,sFAAsF;IACtF,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;kGAUkG;AAClG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,EAAE,QAAuB,aAAa;IACrF,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAE,CAAC;IACxD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,gBAAgB;QACnE,MAAM,IAAI,KAAK,CACb,qCAAqC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,wFAAwF;YACvK,sIAAsI;YACtI,wIAAwI;YACxI,gFAAgF,QAAQ,CAAC,KAAK,CAAC,qDAAqD,CACvJ,CAAC;IACJ,IAAI,QAA4B,CAAC;IACjC,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,gEAAgE;QAChE,+FAA+F;QAC/F,gGAAgG;QAChG,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,UAAU,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnG,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,oGAAoG;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnK,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,+CAA+C;IAC/C,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;QAChE,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,UAAU,QAAQ,6EAA6E;YAC5I,oJAAoJ,YAAY,GAAG,IAAI,OAAO;YAC9K,wFAAwF,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK;YACpJ,oGAAoG,CACvG,CAAC;IACJ,IAAI,CAAC,KAAK;QACR,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,+FAA+F;QAC/F,oEAAoE;QACpE,EAAE;QACF,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,iFAAiF;QACjF,OAAO,CAAC,KAAK,CACX,4GAA4G,6BAA6B,KAAK;YAC5I,mMAAmM;YACnM,qBAAqB,UAAU,EAAE,kDAAkD,yBAAyB,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,+BAA+B,CAC5K,CAAC;IACJ,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,kFAAkF;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED;;;mDAGmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAuB,aAAa,EACpC,MAAiB,EACjB,QAAgB,WAAW,EAAE,EAC7B,cAA6B,kBAAkB;IAE/C,MAAM,IAAI,GAAa,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,+FAA+F;IAC/F,2DAA2D;IAC3D,kGAAkG;IAClG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;QAC9C,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,wEAAwE;QAC9F,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,SAAS,EAAE,CAAC,CAAC,4CAA4C;QAC/D,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,aAAa,EAAE,CAAC,CAAC,uCAAuC;YAC9D,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,yEAAyE;QACzE,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D;YACnI,0FAA0F;YAC1F,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,sFAAsF;IACtF,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,iDAAiD;IACjD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,8BAA8B,GAAG,CAAC,OAAO,4FAA4F,CAAC,CAAC;YAC1L,MAAM,aAAa,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,sHAAsH;YACpK,yJAAyJ;YACzJ,6BAA6B,GAAG,yCAAyC,CAAC,mBAAmB,CAChG,CAAC;IACJ,8FAA8F;IAC9F,+FAA+F;IAC/F,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,eAAe,CAAC,qBAAqB,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvH,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1F,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,0BAA0B,CAAC,qBAAqB,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrI,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,aAAa,EAAE,CAAC,CAAC,yCAAyC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,+BAA+B,IAAI,IAAI,eAAe,MAAM;YAC1G,yIAAyI;YACzI,2CAA2C,CAAC,mCAAmC,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM;QACvB,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,sJAAsJ,CACtL,CAAC;IACJ,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,kGAAkG;IAClG,oGAAoG;IACpG,mBAAmB;IACnB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IACvC,MAAM,8BAA8B,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtE,8FAA8F;IAC9F,8FAA8F;IAC9F,sFAAsF;IACtF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;AACjE,CAAC"}

package/dist/lib/delivery-responder.d.ts

@@ -0,0 +1,92 @@
+/**
+ * THE DELIVERY RESPONDER AXIS (#1576) — one reader, used by every surface that answers
+ * "can this mesh spawn, retire and join right now".
+ *
+ * THE DEFECT THIS MODULE EXISTS TO REMOVE. The delivery daemon's PROCESS and its RESPONDER are two
+ * different facts, and every operator-facing surface used to report the first while the second was
+ * what the mesh actually depends on. A reporter ran a 30-agent fleet for 22 hours against a daemon
+ * that never bound: `systemctl is-active` said active (the PARENT `cotal up` was alive), `cotal ps`
+ * listed the agents, and bare `cotal status` printed `delivery  running (pid 291)` — the identical
+ * line it prints when the responder IS bound. Spawn, retirement and join were all failing the whole
+ * time, and the only place the real cause was ever named was inside one PTY, on one operation.
+ *
+ * THE SOURCE OF TRUTH IS THE SHARD-0 LEASE `ready` FLAG, and it is not a new one: the daemon
+ * CAS-creates its lease `ready:false` BEFORE binding (the single-flight gate that stops two daemons
+ * splitting a durable), then flips it to `ready:true` only AFTER `startPlane3` has bound the
+ * `ctl.delivery` responder and the fan-out/reader loops. So `ready === true` is the only fact that
+ * distinguishes "the responder is bound" from "a process exists" (pidfile) or "a slot was claimed"
+ * (lease present, not ready). See `DeliveryLeaseInfo` in core and the flip site in the daemon.
+ *
+ * WHY A SHARED MODULE RATHER THAN A SECOND READ. `--components` already computed this correctly and
+ * bare `status` did not, which is precisely how the two surfaces came to disagree about a mesh's
+ * health. Both now reduce through {@link deliveryResponderFromLease}, so a future change cannot fix
+ * one and leave the other green. It reads; it never mints, writes or repairs.
+ *
+ * The two surfaces differ in ONE deliberate respect, and the split is in the read, not the grading.
+ * Bare `status` reduces a failed read to `unchecked` and so calls {@link deliveryResponderState},
+ * which wraps the read. `--components` must tell a missing lease stream apart from a refused read
+ * and reports them as different verdicts, so it does its own read and calls the pure classifier
+ * directly. Neither surface grades a lease by any other rule.
+ */
+import type { DeliveryLeaseInfo } from "@cotal-ai/core";
+/** What is known about the responder, as opposed to the process.
+ *
+ *  `unknown` IS A FIRST-CLASS ANSWER AND MUST NOT BE FOLDED INTO `bound`. A lease read can fail for
+ *  reasons that say nothing about the daemon (no target resolved, broker unreachable, a denied read
+ *  on a mesh whose creds predate the read grant). Reporting any of those as health is the original
+ *  defect in a new place, so the renderer says the axis was not checked and names the surface that
+ *  can check it.
+ *
+ *  `stale` IS ALSO NOT `bound`. A ready record whose holder is not the daemon this workspace launched
+ *  is a dead or foreign daemon's leftover, and the mesh it describes cannot spawn, retire or join. It
+ *  is kept distinct from `unbound` because the OPERATOR'S NEXT MOVE DIFFERS: an unbound responder is
+ *  usually still starting and wants waiting, while a stale record wants the TTL to expire (or a real
+ *  replacement to take the slot) and is evidence the daemon DIED rather than never arrived. */
+export type DeliveryResponderState = "bound" | "unbound" | "stale" | "unknown";
+/** The consequence, in the operator's terms rather than the daemon's.
+ *
+ *  This sentence is the whole point of the fix. The boot path used to print a PROMISE
+ *  ("boot durable joins will reconcile when it is") and nothing else: true, but it told an operator
+ *  nothing about what was broken MEANWHILE, so a 22-hour outage read as a progress note. The
+ *  reconcile is real and does run once a daemon binds; what nobody was told is that until it binds,
+ *  these three operations cannot complete. */
+export declare const RESPONDER_UNBOUND_CONSEQUENCE = "no spawn, no retirement, no join until it binds";
+/** Classify a shard-0 lease record. `undefined` means the lease key is absent, which on a mesh that
+ *  HAS a delivery daemon recorded is an unbound responder, not a missing opinion: the daemon creates
+ *  its lease before it binds, so no lease at all means nothing has even claimed the slot.
+ *
+ *  `expectedHolder` IS NOT OPTIONAL INFORMATION WHEN IT IS KNOWABLE, and leaving it out was a real
+ *  defect in the first cut of this fix, caught by walking the one path no cell walked. A daemon that
+ *  is SIGKILLed (or dies any way that skips `releaseDeliveryLease`) leaves its `ready:true` record in
+ *  the bucket for the REST OF THE BUCKET TTL. Measured on a real broker: the record survives the
+ *  holder's death and `ready` stays true for seconds afterwards. `ready` alone therefore answers
+ *  "did SOME daemon bind, recently enough that its record has not expired", which is NOT the question
+ *  an operator is asking. Core learned this at #837 — `waitForDeliveryLease` demands a named holder
+ *  for exactly this reason — and a surface whose whole purpose is to stop reporting false health had
+ *  no business asking the weaker question.
+ *
+ *  THE REALISTIC SHAPE IS A RESTART, not a contrived kill: the daemon dies, `cotal up` starts a
+ *  replacement, and for the rest of the TTL the corpse's ready record sits in front of a live pid
+ *  that has not bound anything yet. Reporting `bound` there is the reported incident with a new
+ *  cause. When the caller can name the daemon it means (its creds file is on disk, and the daemon
+ *  adopts `idFromCreds` of that file as its card id and lease holder), a foreign or dead holder's
+ *  record classifies as `stale` rather than as health. When it genuinely cannot know — an adopted
+ *  daemon whose creds this process never wrote — pass `undefined` and the holder is not checked,
+ *  which is the same concession core makes and no worse than before. */
+export declare function deliveryResponderFromLease(lease: DeliveryLeaseInfo | undefined, expectedHolder?: string): DeliveryResponderState;
+/** Read the axis through a caller-supplied lease reader, mapping a FAILED read to `unknown` rather
+ *  than to either health state. The reader is injected so the offline surfaces (which must not open
+ *  a connection) and the connected ones share one classification without sharing a transport.
+ *
+ *  `expectedHolder` is threaded through rather than applied by the caller so the staleness rule lives
+ *  with the classification: a second surface that reads the lease gets the holder check by using this
+ *  function, instead of having to remember that `ready` alone is not the question. */
+export declare function deliveryResponderState(readLease: () => Promise<DeliveryLeaseInfo | undefined>, expectedHolder?: string): Promise<DeliveryResponderState>;
+/** The bare-`status` process row's delivery suffix: what the recorded PROCESS means once the
+ *  responder axis is known.
+ *
+ *  A LIVE PID WITH AN UNBOUND RESPONDER IS THE REPORTED DEFECT, so it is the case that must never
+ *  render as a bare "running". A live pid whose responder is bound is genuinely serving and says so.
+ *  An unchecked axis says it is unchecked and names `--components`; it never implies either. */
+export declare function deliveryRowSuffix(live: boolean, state: DeliveryResponderState, componentsHint: string): string;
+//# sourceMappingURL=delivery-responder.d.ts.map

package/dist/lib/delivery-responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-responder.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;;;;;+FAY+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/E;;;;;;8CAM8C;AAC9C,eAAO,MAAM,6BAA6B,oDACS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;wEAqBwE;AACxE,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,cAAc,CAAC,EAAE,MAAM,GACtB,sBAAsB,CAKxB;AAED;;;;;;sFAMsF;AACtF,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,EACvD,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAMjC;AAED;;;;;gGAKgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAe9G"}

package/dist/lib/delivery-responder.js

@@ -0,0 +1,78 @@
+/** The consequence, in the operator's terms rather than the daemon's.
+ *
+ *  This sentence is the whole point of the fix. The boot path used to print a PROMISE
+ *  ("boot durable joins will reconcile when it is") and nothing else: true, but it told an operator
+ *  nothing about what was broken MEANWHILE, so a 22-hour outage read as a progress note. The
+ *  reconcile is real and does run once a daemon binds; what nobody was told is that until it binds,
+ *  these three operations cannot complete. */
+export const RESPONDER_UNBOUND_CONSEQUENCE = "no spawn, no retirement, no join until it binds";
+/** Classify a shard-0 lease record. `undefined` means the lease key is absent, which on a mesh that
+ *  HAS a delivery daemon recorded is an unbound responder, not a missing opinion: the daemon creates
+ *  its lease before it binds, so no lease at all means nothing has even claimed the slot.
+ *
+ *  `expectedHolder` IS NOT OPTIONAL INFORMATION WHEN IT IS KNOWABLE, and leaving it out was a real
+ *  defect in the first cut of this fix, caught by walking the one path no cell walked. A daemon that
+ *  is SIGKILLed (or dies any way that skips `releaseDeliveryLease`) leaves its `ready:true` record in
+ *  the bucket for the REST OF THE BUCKET TTL. Measured on a real broker: the record survives the
+ *  holder's death and `ready` stays true for seconds afterwards. `ready` alone therefore answers
+ *  "did SOME daemon bind, recently enough that its record has not expired", which is NOT the question
+ *  an operator is asking. Core learned this at #837 — `waitForDeliveryLease` demands a named holder
+ *  for exactly this reason — and a surface whose whole purpose is to stop reporting false health had
+ *  no business asking the weaker question.
+ *
+ *  THE REALISTIC SHAPE IS A RESTART, not a contrived kill: the daemon dies, `cotal up` starts a
+ *  replacement, and for the rest of the TTL the corpse's ready record sits in front of a live pid
+ *  that has not bound anything yet. Reporting `bound` there is the reported incident with a new
+ *  cause. When the caller can name the daemon it means (its creds file is on disk, and the daemon
+ *  adopts `idFromCreds` of that file as its card id and lease holder), a foreign or dead holder's
+ *  record classifies as `stale` rather than as health. When it genuinely cannot know — an adopted
+ *  daemon whose creds this process never wrote — pass `undefined` and the holder is not checked,
+ *  which is the same concession core makes and no worse than before. */
+export function deliveryResponderFromLease(lease, expectedHolder) {
+    if (lease === undefined)
+        return "unbound";
+    if (lease.ready !== true)
+        return "unbound";
+    if (expectedHolder !== undefined && lease.holder !== expectedHolder)
+        return "stale";
+    return "bound";
+}
+/** Read the axis through a caller-supplied lease reader, mapping a FAILED read to `unknown` rather
+ *  than to either health state. The reader is injected so the offline surfaces (which must not open
+ *  a connection) and the connected ones share one classification without sharing a transport.
+ *
+ *  `expectedHolder` is threaded through rather than applied by the caller so the staleness rule lives
+ *  with the classification: a second surface that reads the lease gets the holder check by using this
+ *  function, instead of having to remember that `ready` alone is not the question. */
+export async function deliveryResponderState(readLease, expectedHolder) {
+    try {
+        return deliveryResponderFromLease(await readLease(), expectedHolder);
+    }
+    catch {
+        return "unknown";
+    }
+}
+/** The bare-`status` process row's delivery suffix: what the recorded PROCESS means once the
+ *  responder axis is known.
+ *
+ *  A LIVE PID WITH AN UNBOUND RESPONDER IS THE REPORTED DEFECT, so it is the case that must never
+ *  render as a bare "running". A live pid whose responder is bound is genuinely serving and says so.
+ *  An unchecked axis says it is unchecked and names `--components`; it never implies either. */
+export function deliveryRowSuffix(live, state, componentsHint) {
+    if (!live)
+        return "";
+    switch (state) {
+        case "bound":
+            return " · responder bound";
+        case "unbound":
+            return ` · RESPONDER NOT BOUND - ${RESPONDER_UNBOUND_CONSEQUENCE}`;
+        case "stale":
+            // NAME THE CORPSE, not just the symptom. An operator who is told "not bound" while a ready
+            // record exists will reasonably go looking for a daemon that is doing something; saying the
+            // record belongs to a daemon that is gone points at the actual next move.
+            return ` · RESPONDER NOT BOUND - a DEAD daemon's ready record is still in the lease (it expires on its own) - ${RESPONDER_UNBOUND_CONSEQUENCE}`;
+        case "unknown":
+            return ` · responder state unchecked (${componentsHint})`;
+    }
+}
+//# sourceMappingURL=delivery-responder.js.map

package/dist/lib/delivery-responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-responder.js","sourceRoot":"","sources":["../../src/lib/delivery-responder.ts"],"names":[],"mappings":"AA+CA;;;;;;8CAM8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GACxC,iDAAiD,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;wEAqBwE;AACxE,MAAM,UAAU,0BAA0B,CACxC,KAAoC,EACpC,cAAuB;IAEvB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;sFAMsF;AACtF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAuD,EACvD,cAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,MAAM,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;gGAKgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAA6B,EAAE,cAAsB;IACpG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,oBAAoB,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,4BAA4B,6BAA6B,EAAE,CAAC;QACrE,KAAK,OAAO;YACV,2FAA2F;YAC3F,4FAA4F;YAC5F,0EAA0E;YAC1E,OAAO,yGAAyG,6BAA6B,EAAE,CAAC;QAClJ,KAAK,SAAS;YACZ,OAAO,iCAAiC,cAAc,GAAG,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/lib/manager-proc.d.ts

@@ -1,4 +1,13 @@
 import { type CommandReader, type LivenessProbe } from "@cotal-ai/workspace";
+/** The `--max-sessions` value a live `cotal supervise` argv is actually serving.
+ *
+ *  The manager reads that flag only at start. A refresh that records a different number while this
+ *  process stays up is a durable lie: MeshEntry claims a ceiling the live plane is not enforcing.
+ *  Absent from argv means the plane default of 64, not a recorded decision. */
+export declare function maxSessionsFromSuperviseArgv(command: string): number | undefined;
+/** True only when the live supervisor argv is proven to already be serving `requested`.
+ *  An unreadable command line cannot prove that, so it is a refusal — persist would guess. */
+export declare function liveManagerWouldApplyMaxSessions(command: string | undefined, requested: number): boolean;
 /** The exact logfile the detached-manager writer opens. Exported so operator guidance names the
  *  writer-owned path instead of copying its filename template into command output. */
 export declare const managerLogPath: (space: string, root?: string) => string;
@@ -61,7 +70,7 @@ export declare function managerHasDeliveryMarker(space?: string): boolean;
  *  composed `cotal` binary registers it; `process.execArgv` carries the tsx loader in dev and is
  *  empty in prod. `supervise`'s auto runtime resolves to pty when detached, which answers the
  *  control plane (`cotal_spawn`/`despawn`/`purge`/`persona`) with no tmux/cmux needed. */
-export declare function startManagerDetached(o?: {
+export type ManagerStartOpts = {
     space?: string;
     server?: string;
     spawn?: string[];
@@ -71,7 +80,10 @@ export declare function startManagerDetached(o?: {
     resumeAttempt?: string;
     resumeCommitToken?: string;
     wsPort?: number;
-}): number;
+    /** Live-session ceiling forwarded as `supervise --max-sessions`. */
+    maxSessions?: number;
+};
+export declare function startManagerDetached(o?: ManagerStartOpts): number;
 /** Make the control plane available: reuse a manager already running for this folder, else start
  *  one detached. Best-effort — callers treat it as non-fatal. A caller that needs THE manager to
  *  carry a runtime/launch spec (`up -f`) must stop any leftover manager first — a reused one is
@@ -84,17 +96,7 @@ export declare function startManagerDetached(o?: {
  *  unattributable record is the same defect as deleting it, reached through a different verb, which
  *  is the third time that shape has appeared in this change. Any future starter calls this first. */
 export declare function assertManagerRecordReplaceable(probe?: LivenessProbe, readCommand?: CommandReader, space?: string): void;
-export declare function ensureManager(o?: {
-    space?: string;
-    server?: string;
-    spawn?: string[];
-    runtime?: string;
-    launch?: string;
-    attachHost?: string;
-    resumeAttempt?: string;
-    resumeCommitToken?: string;
-    wsPort?: number;
-}, probe?: LivenessProbe, readCommand?: CommandReader): {
+export declare function ensureManager(o?: ManagerStartOpts, probe?: LivenessProbe, readCommand?: CommandReader): {
     running: boolean;
 };
 /** A signal, injectable for the same reason the probe is: `EPERM` from `kill` is producible only by

package/dist/lib/manager-proc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,aAAa,EAAE,KAAK,aAAa,EAEvC,MAAM,qBAAqB,CAAC;AAW7B;sFACsF;AACtF,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,OAAM,MAAoB,KAAG,MACd,CAAC;AAE9D,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,OAAM,MAAoB,KAAG,MACrC,CAAC;AAE9C;;uFAEuF;AACvF,eAAO,MAAM,gBAAgB,GAAI,QAAO,MAAsB,KAAG,MAAuD,CAAC;AAWzH;;;;;;;;;;;;gGAYgG;AAChG,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAExG;4FAC4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;qBAOqB;AACrB,wBAAgB,kBAAkB,CAChC,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,aAAa,CAgBf;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAC7B,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,kBAAkB,CAEpB;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAK9D;AAED;;;;0BAI0B;AAC1B,wBAAgB,SAAS,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAEhE;AAID;;;;2CAI2C;AAC3C,wBAAgB,wBAAwB,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAO/E;AAED;;;;0FAI0F;AAC1F,wBAAgB,oBAAoB,CAClC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACzL,MAAM,CAwDR;AAED;;;mBAGmB;AACnB;;;;;;qGAMqG;AACrG,wBAAgB,8BAA8B,CAC5C,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,IAAI,CA2BN;AAED,wBAAgB,aAAa,CAC3B,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,EAC1L,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,GAC9C;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAOtB;AAED;;8CAE8C;AAC9C,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;AAErE,uGAAuG;AACvG,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;AAErD;;iGAEiG;AAGjG;;;;;;;;;;0FAU0F;AAC1F,wBAAsB,WAAW,CAC/B,KAAK,GAAE,aAA6B,EACpC,MAAM,GAAE,QAAQ,GAAG,SAAqB,EACxC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA+FtB"}
+{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,aAAa,EAAE,KAAK,aAAa,EAEvC,MAAM,qBAAqB,CAAC;AAC7B;;;;+EAI+E;AAC/E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAehF;AAED;8FAC8F;AAC9F,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGxG;AAWD;sFACsF;AACtF,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,OAAM,MAAoB,KAAG,MACd,CAAC;AAE9D,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,OAAM,MAAoB,KAAG,MACrC,CAAC;AAE9C;;uFAEuF;AACvF,eAAO,MAAM,gBAAgB,GAAI,QAAO,MAAsB,KAAG,MAAuD,CAAC;AAWzH;;;;;;;;;;;;gGAYgG;AAChG,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAExG;4FAC4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;qBAOqB;AACrB,wBAAgB,kBAAkB,CAChC,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,aAAa,CAgBf;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAC7B,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,kBAAkB,CAEpB;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAK9D;AAED;;;;0BAI0B;AAC1B,wBAAgB,SAAS,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAEhE;AAID;;;;2CAI2C;AAC3C,wBAAgB,wBAAwB,CAAC,KAAK,GAAE,MAAsB,GAAG,OAAO,CAO/E;AAED;;;;0FAI0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,CAAC,GAAE,gBAAqB,GACvB,MAAM,CA4DR;AAED;;;mBAGmB;AACnB;;;;;;qGAMqG;AACrG,wBAAgB,8BAA8B,CAC5C,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,IAAI,CA2BN;AAED,wBAAgB,aAAa,CAC3B,CAAC,GAAE,gBAAqB,EACxB,KAAK,GAAE,aAA6B,EACpC,WAAW,GAAE,aAAkC,GAC9C;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAOtB;AAED;;8CAE8C;AAC9C,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;AAErE,uGAAuG;AACvG,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;AAErD;;iGAEiG;AAGjG;;;;;;;;;;0FAU0F;AAC1F,wBAAsB,WAAW,CAC/B,KAAK,GAAE,aAA6B,EACpC,MAAM,GAAE,QAAQ,GAAG,SAAqB,EACxC,WAAW,GAAE,aAAkC,EAC/C,KAAK,GAAE,MAAsB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA+FtB"}

package/dist/lib/manager-proc.js

@@ -5,7 +5,39 @@ import { DEFAULT_SERVER } from "@cotal-ai/core";
 import { selfArgv } from "./self-exec.js";
 import { resolveRuntimeSpace } from "./status.js";
 import { cotalRoot } from "./paths.js";
-import { canonicalLocalProcessPath, commandIsCotalSupervisor, localProcessPath, parsePid, probeLiveness, readProcessCommand, reclaimDeadPreUpgradeRecord, MANAGER_DELIVERY_AWARE_MARKER, MANAGER_LOGFILE, MANAGER_PIDFILE, identityLegacyWarning, identityRefusal, identityUncertaintyRefusal, removeIdentityPin, verifyIdentityPin, writeIdentityPin, } from "@cotal-ai/workspace";
+import { canonicalLocalProcessPath, commandIsCotalSupervisor, localProcessPath, parsePid, probeLiveness, readProcessCommand, reclaimDeadPreUpgradeRecord, MANAGER_DELIVERY_AWARE_MARKER, MANAGER_LOGFILE, MANAGER_PIDFILE, identityLegacyWarning, identityRefusal, identityUncertaintyRefusal, parsePositiveIntegerFlag, removeIdentityPin, verifyIdentityPin, writeIdentityPin, } from "@cotal-ai/workspace";
+/** The `--max-sessions` value a live `cotal supervise` argv is actually serving.
+ *
+ *  The manager reads that flag only at start. A refresh that records a different number while this
+ *  process stays up is a durable lie: MeshEntry claims a ceiling the live plane is not enforcing.
+ *  Absent from argv means the plane default of 64, not a recorded decision. */
+export function maxSessionsFromSuperviseArgv(command) {
+    const tokens = command.trim().split(/\s+/);
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        let raw;
+        if (token === "--max-sessions")
+            raw = tokens[i + 1];
+        else if (token.startsWith("--max-sessions="))
+            raw = token.slice("--max-sessions=".length);
+        if (raw === undefined)
+            continue;
+        try {
+            return parsePositiveIntegerFlag("--max-sessions", raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/** True only when the live supervisor argv is proven to already be serving `requested`.
+ *  An unreadable command line cannot prove that, so it is a refusal — persist would guess. */
+export function liveManagerWouldApplyMaxSessions(command, requested) {
+    if (command === undefined)
+        return false;
+    return maxSessionsFromSuperviseArgv(command) === requested;
+}
 /** The space whose manager this folder's commands mean. Every helper below defaults to it, and the
  *  ones a caller reaches with an explicit `--space` take it as their last argument: the records are
  *  per-space now, so a helper that assumed the folder's space would answer about a sibling tenant's
@@ -96,11 +128,6 @@ export function managerHasDeliveryMarker(space = folderSpace()) {
     const livePid = Number(readFileSync(pidPath, "utf8").trim());
     return Number.isFinite(markerPid) && Number.isFinite(livePid) && markerPid === livePid;
 }
-/** Start the control-plane manager detached (pid in `.cotal/manager.<spaceKey>.pid`, output to
- *  `.cotal/manager.<spaceKey>.log`), stopped by `cotal down`. Re-execs this same CLI's `supervise` — the
- *  composed `cotal` binary registers it; `process.execArgv` carries the tsx loader in dev and is
- *  empty in prod. `supervise`'s auto runtime resolves to pty when detached, which answers the
- *  control plane (`cotal_spawn`/`despawn`/`purge`/`persona`) with no tmux/cmux needed. */
 export function startManagerDetached(o = {}) {
     const space = o.space ?? folderSpace();
     // Clear a provably dead PRE-UPGRADE record before claiming the canonical slot, so an upgraded root
@@ -108,6 +135,10 @@ export function startManagerDetached(o = {}) {
     // on a live or unattributable one rather than orphaning the daemon behind it.
     reclaimDeadPreUpgradeRecord(MANAGER_PIDFILE, ctx(space));
     reclaimDeadPreUpgradeRecord(MANAGER_DELIVERY_AWARE_MARKER, ctx(space));
+    // BEFORE THE LOG IS OPENED. `selfArgv` refuses when this process was not started from the `cotal`
+    // entry (#1629), and a refusal must leave the root exactly as it found it: computing the argv after
+    // `openSync` would create a manager log and leak its descriptor on every refused start.
+    const [node, ...self] = selfArgv();
     const logPath = managerLogPath(space);
     // 0600: the manager prints its console URL here, and that URL carries the console token — a
     // standing credential for every agent's terminal on this mesh, at rest for the life of the file.
@@ -122,7 +153,6 @@ export function startManagerDetached(o = {}) {
         chmodSync(logPath, 0o600);
     }
     catch { /* mode is defence in depth, not the boundary */ }
-    const [node, ...self] = selfArgv();
     const args = [
         ...self,
         "supervise",
@@ -142,6 +172,7 @@ export function startManagerDetached(o = {}) {
         ...(o.resumeCommitToken ? ["--resume-commit-token", o.resumeCommitToken] : []),
         // P2 item 6: the broker ws listener port (loopback) for the console session client's wsUrl.
         ...(o.wsPort !== undefined ? ["--ws-port", String(o.wsPort)] : []),
+        ...(o.maxSessions !== undefined ? ["--max-sessions", String(o.maxSessions)] : []),
     ];
     // This is an INTERNAL child re-exec: the `up`/`spawn` that reached here already ran the first-run
     // connector seed, so the manager skips it on boot (a direct `cotal supervise` still seeds).