@cotal-ai/runtime 0.47.1 → 0.48.0

package/dist/mesh-handler.d.ts

@@ -3,6 +3,14 @@ import type { NatsConnection } from "@nats-io/transport-node";
 import type { JetStreamClient, JetStreamManager } from "@nats-io/jetstream";
 import { type KV } from "@nats-io/kv";
 import { type AskRequest, type AgentHandleValue, type ChannelHandleValue, type ConclaveRequest, type WaitRequest, type CheckpointRaw, type CheckpointRequest, type EffectContext, type JournalEntry, type MonitorRequest, type NotifyRequest, type SleepRequest, type SpawnRequest, type TurnRequest, type TurnResultValue } from "@cotal-ai/lang";
+import type { RunPauseHost } from "./run-pause-host.js";
+import type { RunWaitHost } from "./run-wait-host.js";
+import type { RunScopeAuthority } from "./run-scope-authority.js";
+export interface RunMeshServices {
+    readonly pauses: RunPauseHost;
+    readonly waits: RunWaitHost;
+    readonly authority: RunScopeAuthority;
+}
 /** Who this handler acts as, and where. All of it is the DRIVER's identity, not the program's. */
 export interface MeshHandlerBinding {
     readonly space: string;
@@ -85,7 +93,8 @@ export declare class MeshHandler {
     private readonly binding;
     private readonly watcher;
     private readonly clock;
-    constructor(nc: NatsConnection, kv: KV, js: JetStreamClient, jsm: JetStreamManager, binding: MeshHandlerBinding, watcher: SettleWatcher, clock?: () => number);
+    private readonly services?;
+    constructor(nc: NatsConnection, kv: KV, js: JetStreamClient, jsm: JetStreamManager, binding: MeshHandlerBinding, watcher: SettleWatcher, clock?: () => number, services?: RunMeshServices | undefined);
     /**
      * The resolved manager service, memoized as a PROMISE so concurrent branches share one describe
      * round-trip — and dropped on failure, so a resolve that lost to a manager restart is retried by
@@ -152,6 +161,7 @@ export declare class MeshHandler {
      * its identity, its worktree and its turn history across the edit. Called by the driver on the
      * migrated run before the program runs; a map with no entry for a persona changes nothing.
      */
+    restoreMigratedSeats(entries: readonly JournalEntry[]): Promise<void>;
     adoptMigratedSeats(seats: ReadonlyMap<string, readonly JournalEntry[]>): void;
     /**
      * Rebuild the in-memory run memos an adopted run needs to keep performing `turn`: the roster
@@ -632,19 +642,7 @@ export declare class MeshHandler {
     /** Take this deadline's fire for as long as somebody is waiting on it. */
     private pumpFires;
 }
-/** The durable that holds one wait's position on a channel. Derived from the step's own request id,
- *  which is why a resumed run finds the consumer its earlier attempt created rather than starting
- *  again from "now" — and why nothing about the wait has to be remembered across a crash. */
-export declare function waitConsumerName(requestId: string): string;
-/**
- * The one definition of a wait's consumer, shared by the handler and by anything that has to
- * recreate it — so the name a resume looks for and the name a wait creates cannot drift apart.
- *
- * `deliver_policy: "new"` applies only to the FIRST create: an existing durable keeps its own
- * position, which is exactly what a resume needs, and events from before the program asked are not
- * this wait's to see.
- */
-export declare function waitConsumerConfig(space: string, requestId: string, channel: string): Record<string, unknown>;
+export { waitConsumerName, waitConsumerConfig } from "@cotal-ai/core";
 /**
  * Read a spawn's `permits` as the budgets this host can enforce: `turns`, a positive integer of
  * turns the run may dispatch to the agent, and `wallClock`, a duration from the spawn after which
@@ -736,5 +734,4 @@ export declare class EpfSettleWatcher implements SettleWatcher {
     constructor(jsm: JetStreamManager, space: string, pollMs?: number);
     awaitSettle(ref: CheckpointRef): Promise<CheckpointSettleFact>;
 }
-export {};
 //# sourceMappingURL=mesh-handler.d.ts.map

package/dist/mesh-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-handler.d.ts","sourceRoot":"","sources":["../src/mesh-handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EAyCL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAGzB,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EASL,KAAK,UAAU,EACf,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAExB,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;gBAApD,KAAK,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,GAAG,SAAS;CAS1E;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED;;;;GAIG;AAEH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBANL,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,MAAM,MAAyB;IAGzD;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAuC;IAC7D,OAAO,CAAC,OAAO;IASf,+FAA+F;IAC/F,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,eAAe;IAQvB,iGAAiG;YACnF,YAAY;IAI1B;;;uEAGmE;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAE7D;;;gGAG4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4I;IACnK,oHAAoH;IACpH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C;;;mGAG+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuE;IAEpG;+FAC2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D;8EAC0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IAErE;;uFAEmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAE/D,GAAG,IAAI,MAAM;IAIb;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUlE;;;;;;OAMG;IACH,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,GAAG,IAAI;IAK7E;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IA4CpB;;;;;;;;;;;;OAYG;YACW,aAAa;IAqC3B,2FAA2F;IAC3F,OAAO,CAAC,cAAc;IAMtB;uGACmG;IACnG,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqChE;;;;;;;;;;;;;;;;;;;OAmBG;YACW,eAAe;IAmB7B;;;;;;;;;;;;;;OAcG;YACW,cAAc;IA0C5B;;;;;;;;OAQG;YACW,iBAAiB;IAQ/B;;;;;;;;OAQG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IA+CpF;;;;;;;;;;;;;;OAcG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuHzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,QAAQ;IA4CtB;;;;;;;;;;;;;;;;;;OAkBG;YACW,WAAW;IAmDzB;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBnE;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoH7E;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAUvB;;sGAEkG;YACpF,YAAY;IAU1B;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAmJ1E;;;;mFAI+E;IAC/E;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAQR,WAAW;IA2DzB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAmEhE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;IACH,OAAO,CAAC,WAAW;YAOL,QAAQ;IAetB;;;;;;;;;;;;OAYG;YACW,eAAe;IA4B7B;;;;;;;OAOG;YACW,WAAW;IAiCzB;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAczF;;;;;;;;;;OAUG;IACG,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7E;;;sEAGkE;YACpD,YAAY;IA6B1B;;;;sFAIkF;YACpE,mBAAmB;IAoCjC;;;mGAG+F;YACjF,eAAe;IAmB7B;;;8DAG0D;YAC5C,YAAY;IAY1B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,GAAG;IAqDjB;uGACmG;YACrF,IAAI;IAUlB;;;;;;;;;;;;;;OAcG;YACW,QAAQ;IA0BtB;;;;oGAIgG;YAClF,OAAO;IAQrB;;4EAEwE;YAC1D,WAAW;IA8BzB,kFAAkF;YACpE,SAAS;IAUvB;;;;;;;OAOG;YACW,MAAM;IA2BpB;;8FAE0F;IAC1F,OAAO,CAAC,eAAe;IAiBvB,0EAA0E;YAC5D,SAAS;CAQxB;AAED;;6FAE6F;AAC7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO7G;AAWD;;;;;GAKG;AACH,4EAA4E;AAC5E,KAAK,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAqB3E;AAkED;;4FAE4F;AAC5F,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpE;AAqND;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,EAC5D,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC,EAChF,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAYjF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,SAAe;IAGlC,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC;CASrE"}
+{"version":3,"file":"mesh-handler.d.ts","sourceRoot":"","sources":["../src/mesh-handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EA4CL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAGzB,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EASL,KAAK,UAAU,EACf,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;CACvC;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;gBAApD,KAAK,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,GAAG,SAAS;CAS1E;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED;;;;GAIG;AAEH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAPT,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,MAAM,MAAyB,EACtC,QAAQ,CAAC,EAAE,eAAe,YAAA;IAG7C;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAuC;IAC7D,OAAO,CAAC,OAAO;IASf,+FAA+F;IAC/F,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,eAAe;IAQvB,iGAAiG;YACnF,YAAY;IAI1B;;;uEAGmE;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAE7D;;;gGAG4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4I;IACnK,oHAAoH;IACpH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C;;;mGAG+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuE;IAEpG;+FAC2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D;8EAC0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IAErE;;uFAEmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAE/D,GAAG,IAAI,MAAM;IAIb;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWlE;;;;;;OAMG;IACG,oBAAoB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3E,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,GAAG,IAAI;IAK7E;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IA4CpB;;;;;;;;;;;;OAYG;YACW,aAAa;IAqC3B,2FAA2F;IAC3F,OAAO,CAAC,cAAc;IAMtB;uGACmG;IACnG,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0ChE;;;;;;;;;;;;;;;;;;;OAmBG;YACW,eAAe;IAmB7B;;;;;;;;;;;;;;OAcG;YACW,cAAc;IA0C5B;;;;;;;;OAQG;YACW,iBAAiB;IAS/B;;;;;;;;OAQG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IA+CpF;;;;;;;;;;;;;;OAcG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA4IzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,QAAQ;IA4CtB;;;;;;;;;;;;;;;;;;OAkBG;YACW,WAAW;IAmDzB;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBnE;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoH7E;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAUvB;;sGAEkG;YACpF,YAAY;IAU1B;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAmJ1E;;;;mFAI+E;IAC/E;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAQR,WAAW;IA2DzB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAmEhE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;IACH,OAAO,CAAC,WAAW;YAOL,QAAQ;IAetB;;;;;;;;;;;;OAYG;YACW,eAAe;IA4B7B;;;;;;;OAOG;YACW,WAAW;IAiCzB;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAezF;;;;;;;;;;OAUG;IACG,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7E;;;sEAGkE;YACpD,YAAY;IA6B1B;;;;sFAIkF;YACpE,mBAAmB;IAoCjC;;;mGAG+F;YACjF,eAAe;IAmB7B;;;8DAG0D;YAC5C,YAAY;IAY1B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,GAAG;IAsDjB;uGACmG;YACrF,IAAI;IAWlB;;;;;;;;;;;;;;OAcG;YACW,QAAQ;IA2BtB;;;;oGAIgG;YAClF,OAAO;IAcrB;;4EAEwE;YAC1D,WAAW;IA+BzB,kFAAkF;YACpE,SAAS;IAevB;;;;;;;OAOG;YACW,MAAM;IA2BpB;;8FAE0F;IAC1F,OAAO,CAAC,eAAe;IAiBvB,0EAA0E;YAC5D,SAAS;CAQxB;AAED,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAWtE;;;;;GAKG;AACH,4EAA4E;AAC5E,KAAK,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAqB3E;AAkED;;4FAE4F;AAC5F,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpE;AAyOD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,EAC5D,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC,EAChF,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAYjF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,SAAe;IAGlC,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC;CASrE"}

package/dist/mesh-handler.js

@@ -17,8 +17,9 @@
  * again.
  */
 import { createHash } from "node:crypto";
-import { mintCheckpoint, heartbeatCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointAnswer, readCheckpointStatus, readCheckpointSpec, reconcileCheckpointSchedule, handleCheckpointFire, eptStreamName, eptSubject, chatStream, chatSubject, isConcreteChannel, assertSafePattern, assertValidChannel, presenceBucket, liveKvEntries, IncompleteKvScan, openMembersRegistry, openChannelRegistry, writeChannelConfig, readMember, commitMember, tombstoneMember, StaleMembershipWrite, runNoticeId, writeRunNotice, actionContext, invokeCommand, readGoalResult, readGoalStatus, resolveService, listRunNotices, markRunNoticeConsumed, listRunNoticesForRun, readRunRecord, writeRunStatus, EpEnvelopeError, } from "@cotal-ai/core";
+import { mintCheckpoint, heartbeatCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointAnswer, readCheckpointStatus, readCheckpointSpec, reconcileCheckpointSchedule, handleCheckpointFire, eptStreamName, eptSubject, chatStream, waitConsumerName, waitConsumerConfig, isConcreteChannel, assertSafePattern, assertValidChannel, presenceBucket, principalKey, liveKvEntries, IncompleteKvScan, openMembersRegistry, openChannelRegistry, writeChannelConfig, readMember, commitMember, tombstoneMember, StaleMembershipWrite, runNoticeId, writeRunNotice, actionContext, invokeCommand, readGoalResult, readGoalStatus, resolveService, listRunNotices, listRunMigrations, markRunNoticeConsumed, listRunNoticesForRun, readRunRecord, writeRunStatus, EpEnvelopeError, } from "@cotal-ai/core";
 import { renderRunContext } from "./run-context.js";
+import { migrationSeats } from "./migrate.js";
 import { Kvm } from "@nats-io/kv";
 import { parseDuration, Cancelled, EffectError, Journal, EffectRefused, askSchemaShape, conformsToAskSchema, journalEntryKeyString, stepKeyString, } from "@cotal-ai/lang";
 /**
@@ -56,7 +57,8 @@ export class MeshHandler {
     binding;
     watcher;
     clock;
-    constructor(nc, kv, js, jsm, binding, watcher, clock = () => Date.now()) {
+    services;
+    constructor(nc, kv, js, jsm, binding, watcher, clock = () => Date.now(), services) {
         this.nc = nc;
         this.kv = kv;
         this.js = js;
@@ -64,6 +66,7 @@ export class MeshHandler {
         this.binding = binding;
         this.watcher = watcher;
         this.clock = clock;
+        this.services = services;
     }
     /**
      * The resolved manager service, memoized as a PROMISE so concurrent branches share one describe
@@ -163,8 +166,10 @@ export class MeshHandler {
      * cannot advance it.
      */
     async adopted(entries) {
-        const folded = foldEntries(entries);
+        const folded = foldEntries(this.services ? await this.services.authority.journal() : entries);
         this.seedRunMemos(folded);
+        if (this.services)
+            return [...await this.services.pauses.rearm()];
         return await rearmOutstandingPauses({ kv: this.kv, js: this.js, jsm: this.jsm }, this.binding, folded);
     }
     /**
@@ -174,6 +179,18 @@ export class MeshHandler {
      * its identity, its worktree and its turn history across the edit. Called by the driver on the
      * migrated run before the program runs; a map with no entry for a persona changes nothing.
      */
+    async restoreMigratedSeats(entries) {
+        const source = this.services ? await this.services.authority.journal() : entries;
+        const kept = new Map();
+        for (const migration of await listRunMigrations(this.kv, this.binding.endpoint, this.binding.runId)) {
+            if (migration.applied === undefined)
+                continue;
+            for (const [persona, seats] of migrationSeats(source, migration.spec).adopt)
+                kept.set(persona, [...(kept.get(persona) ?? []), ...seats]);
+        }
+        if (kept.size > 0)
+            this.adoptMigratedSeats(kept);
+    }
     adoptMigratedSeats(seats) {
         for (const [persona, entries] of seats)
             this.adoptable.set(persona, [...(this.adoptable.get(persona) ?? []), ...entries]);
@@ -306,7 +323,8 @@ export class MeshHandler {
      * landed, and the flip to `issued: true` happens only after it returns.
      */
     async discharge(entries) {
-        for (const e of entries) {
+        const owed = this.services ? await this.services.authority.cleanupEntries() : entries;
+        for (const e of owed) {
             if (e.requestId === undefined)
                 continue;
             if (e.kind === "spawn") {
@@ -337,6 +355,10 @@ export class MeshHandler {
             await this.cancelTimer({ endpoint: this.binding.endpoint, token: current });
             if (e.kind === "wait") {
                 await this.cancelTimer({ endpoint: this.binding.endpoint, token: derivedToken(e.requestId, "wait-timeout") });
+                if (this.services) {
+                    await this.services.waits.close(e.requestId);
+                    continue;
+                }
                 try {
                     await this.jsm.consumers.delete(chatStream(this.binding.space), waitConsumerName(e.requestId));
                 }
@@ -456,6 +478,7 @@ export class MeshHandler {
         const plan = e.external;
         if (!isConclavePlan(plan))
             return;
+        assertConclaveOwnership(plan, e.requestId);
         await this.releaseConclave(plan);
         this.conclaves.delete(e.requestId);
     }
@@ -538,7 +561,7 @@ export class MeshHandler {
         // was accepted, so an answer found by token alone could be the loser's.
         const answer = settled.answerId === undefined
             ? undefined
-            : await readCheckpointAnswer(this.kv, this.binding.endpoint, ref.token, settled.answerId);
+            : this.services ? await this.services.pauses.readAnswer(ref.token) : await readCheckpointAnswer(this.kv, this.binding.endpoint, ref.token, settled.answerId);
         if (answer === undefined)
             throw new CheckpointAnswerMissing(ref.token, settled.answerId);
         return {
@@ -576,6 +599,19 @@ export class MeshHandler {
         if (!isConcreteChannel(ev.channel)) {
             throw new Error(`wait() cannot await a wildcard channel ("${ev.channel}"); an await names one channel`);
         }
+        const waitBinding = {
+            ...ctx.resume,
+            waitChannel: ev.channel,
+            waitTimers: [
+                ...(ev.event === "idle" || req.timeout !== undefined ? [ctx.requestId] : []),
+                ...(ev.event === "idle" && req.timeout !== undefined ? [derivedToken(ctx.requestId, "wait-timeout")] : []),
+            ],
+        };
+        if (this.services) {
+            if (ctx.resume?.waitChannel !== undefined && ctx.resume.waitChannel !== ev.channel)
+                throw new Error(`wait ${ctx.requestId} recorded a different channel`);
+            await ctx.bind(waitBinding);
+        }
         // A recorded seq is a previous attempt's MATCH, taken before the crash. Return that message
         // rather than looking again: the consumer has already acked it, so looking again would wait for
         // a second event the program never asked for.
@@ -586,7 +622,7 @@ export class MeshHandler {
             // same reason the live match path does: this is the ending, it just happened last time.
             await this.cancelTimer({ endpoint: this.binding.endpoint, token: ctx.requestId });
             await this.cancelTimer({ endpoint: this.binding.endpoint, token: derivedToken(ctx.requestId, "wait-timeout") });
-            return await this.messageAt(bound);
+            return await this.messageAt(bound, ctx.requestId);
         }
         const timeoutAt = req.timeout === undefined ? undefined : this.now() + parseDuration(req.timeout);
         const idleFor = ev.event === "idle" ? parseDuration(ev.duration) : undefined;
@@ -608,8 +644,11 @@ export class MeshHandler {
             await this.arm(outer, timeoutAt);
         const durable = waitConsumerName(ctx.requestId);
         const stream = chatStream(this.binding.space);
-        await this.jsm.consumers.add(stream, waitConsumerConfig(this.binding.space, ctx.requestId, ev.channel));
-        const consumer = await this.js.consumers.get(stream, durable);
+        if (this.services)
+            await this.services.waits.open(ctx.requestId, ev.channel);
+        else
+            await this.jsm.consumers.add(stream, waitConsumerConfig(this.binding.space, ctx.requestId, ev.channel));
+        const consumer = this.services ? undefined : await this.js.consumers.get(stream, durable);
         // Set on each of the three paths that END the wait, and read by the cleanup below. A THROW is
         // not one of them — see the note there.
         let over = false;
@@ -649,24 +688,30 @@ export class MeshHandler {
                     over = true;
                     return { channel: ev.channel, at: this.now() };
                 }
-                for await (const m of await consumer.fetch({ max_messages: 16, expires: WAIT_POLL_MS })) {
+                const batch = this.services
+                    ? (await this.services.waits.fetch(ctx.requestId)).map((message) => ({
+                        seq: message.sequence, data: message.data,
+                        ack: () => this.services.waits.ack(ctx.requestId, message.receipt),
+                    }))
+                    : await consumer.fetch({ max_messages: 16, expires: WAIT_POLL_MS });
+                for await (const m of batch) {
                     const msg = decodeMessage(m.data);
                     if (idleFor !== undefined) {
                         // ANY traffic resets an idle window, matched or not: "idle" is a fact about the
                         // channel, not about the messages this program finds interesting.
-                        m.ack();
+                        await m.ack();
                         await this.push(primary, this.now() + idleFor);
                         continue;
                     }
                     if (msg === undefined || !matchesEvent(msg, from, matcher)) {
-                        m.ack();
+                        await m.ack();
                         continue;
                     }
                     // BIND BEFORE ACK. The bind is durable; the ack is what makes the message unrecoverable.
                     // In this order a crash in between redelivers it, and a crash after it is answered from
                     // the recorded sequence — in the other order the match is simply lost.
-                    await ctx.bind({ chatSeq: m.seq });
-                    m.ack();
+                    await ctx.bind(this.services ? { ...waitBinding, chatSeq: m.seq } : { chatSeq: m.seq });
+                    await m.ack();
                     if (primary !== undefined)
                         await this.cancelTimer(primary);
                     if (outer !== undefined)
@@ -687,7 +732,9 @@ export class MeshHandler {
             // Keeping the consumer costs one durable on an abandoned run, which is what a host crash
             // already costs; reaping on inactivity instead could delete a live wait's position while its
             // host was down.
-            if (over) {
+            if (over && this.services)
+                await this.services.waits.close(ctx.requestId);
+            else if (over) {
                 try {
                     await this.jsm.consumers.delete(stream, durable);
                 }
@@ -1356,7 +1403,7 @@ export class MeshHandler {
             }
             const answer = settled.answerId === undefined
                 ? undefined
-                : await readCheckpointAnswer(this.kv, this.binding.endpoint, token, settled.answerId);
+                : this.services ? await this.services.pauses.readAnswer(token) : await readCheckpointAnswer(this.kv, this.binding.endpoint, token, settled.answerId);
             if (answer === undefined)
                 throw new CheckpointAnswerMissing(token, settled.answerId);
             if (conformsToAskSchema(answer.value, shape))
@@ -1552,6 +1599,7 @@ export class MeshHandler {
             plan = await this.planConclave(req, ctx);
             await ctx.bind({ ...plan });
         }
+        assertConclaveOwnership(plan, ctx.requestId, req);
         await this.executeConclavePlan(plan);
         this.conclaves.set(ctx.requestId, plan);
         return { channel: plan.channel };
@@ -1571,6 +1619,7 @@ export class MeshHandler {
         const plan = this.conclaves.get(ctx.requestId) ?? (isConclavePlan(ctx.resume) ? ctx.resume : undefined);
         if (plan === undefined)
             throw new Error(`conclave close for "${ctx.requestId}" has no recorded plan: the open that owes this close bound none`);
+        assertConclaveOwnership(plan, ctx.requestId);
         await this.releaseConclave(plan);
         this.conclaves.delete(ctx.requestId);
         return null;
@@ -1715,6 +1764,8 @@ export class MeshHandler {
      * raised rather than waited on.
      */
     async arm(ref, deadline) {
+        if (this.services)
+            return this.services.pauses.arm(ref.token, deadline);
         // Over already: an expiry or an answer landed while this host was away. Nothing to arm, and the
         // caller reads the fact next.
         if ((await readCheckpointSettle(this.jsm, this.binding.space, ref)) !== undefined)
@@ -1768,6 +1819,8 @@ export class MeshHandler {
     /** Push a live deadline out — the idle window restarting. The heartbeat CAS-advances the
      *  generation before replacing the timer, so a fire from the old one no-ops rather than racing. */
     async push(ref, deadline) {
+        if (this.services)
+            return this.services.pauses.heartbeat(ref.token, deadline);
         await heartbeatCheckpoint(this.kv, this.js, this.jsm, this.binding.space, {
             ref,
             instanceId: this.binding.instanceId,
@@ -1792,6 +1845,8 @@ export class MeshHandler {
      * owner-behind clock skew, and over-emission is idempotent at the timer writer.
      */
     async takeFire(ref) {
+        if (this.services)
+            return this.services.pauses.takeFire(ref.token);
         const subject = eptSubject(this.binding.space, ref.endpoint, this.binding.instanceId, this.binding.epoch, ref.token, "fire");
         const fired = await this.jsm.streams
             .getMessage(eptStreamName(this.binding.space), { last_by_subj: subject })
@@ -1823,6 +1878,14 @@ export class MeshHandler {
     async expired(ref) {
         if (ref === undefined)
             return undefined;
+        if (this.services) {
+            const settled = await this.services.pauses.readSettle(ref.token);
+            if (settled !== undefined)
+                return settled;
+            if (!(await this.services.pauses.takeFire(ref.token)))
+                return undefined;
+            return this.services.pauses.readSettle(ref.token);
+        }
         const settled = await readCheckpointSettle(this.jsm, this.binding.space, ref);
         if (settled !== undefined)
             return settled;
@@ -1834,6 +1897,8 @@ export class MeshHandler {
      *  A timer left armed would fire into a run that has moved on; claiming it is how the plane says
      *  "this pause is over" without a second mechanism for cancellation. */
     async cancelTimer(ref) {
+        if (this.services)
+            return this.services.pauses.claim(ref.token);
         const st = await readCheckpointStatus(this.kv, ref);
         if (st?.value.state !== "waiting")
             return;
@@ -1866,7 +1931,13 @@ export class MeshHandler {
         }
     }
     /** The message at a recorded stream sequence — the re-bind path after a crash. */
-    async messageAt(seq) {
+    async messageAt(seq, requestId) {
+        if (this.services) {
+            const message = decodeMessage(await this.services.waits.messageAt(requestId, seq));
+            if (message === undefined)
+                throw new Error(`wait ${requestId}'s recorded message does not decode`);
+            return message;
+        }
         const m = await this.jsm.streams.getMessage(chatStream(this.binding.space), { seq });
         if (m === null || m === undefined) {
             throw new Error(`the message this wait matched (sequence ${seq}) is no longer on the channel's stream; a recorded match cannot be re-read`);
@@ -1885,7 +1956,7 @@ export class MeshHandler {
      * already in the past.
      */
     async settle(ref, signal) {
-        const already = await readCheckpointSettle(this.jsm, this.binding.space, ref);
+        const already = this.services ? await this.services.pauses.readSettle(ref.token) : await readCheckpointSettle(this.jsm, this.binding.space, ref);
         if (already !== undefined)
             return already;
         // The watcher waits for the FACT. For a pause with an answer the fact arrives because somebody
@@ -1942,28 +2013,7 @@ export class MeshHandler {
         }
     }
 }
-/** The durable that holds one wait's position on a channel. Derived from the step's own request id,
- *  which is why a resumed run finds the consumer its earlier attempt created rather than starting
- *  again from "now" — and why nothing about the wait has to be remembered across a crash. */
-export function waitConsumerName(requestId) {
-    return `wfw_${requestId}`;
-}
-/**
- * The one definition of a wait's consumer, shared by the handler and by anything that has to
- * recreate it — so the name a resume looks for and the name a wait creates cannot drift apart.
- *
- * `deliver_policy: "new"` applies only to the FIRST create: an existing durable keeps its own
- * position, which is exactly what a resume needs, and events from before the program asked are not
- * this wait's to see.
- */
-export function waitConsumerConfig(space, requestId, channel) {
-    return {
-        durable_name: waitConsumerName(requestId),
-        filter_subject: chatSubject(space, "*", "*", channel),
-        ack_policy: "explicit",
-        deliver_policy: "new",
-    };
-}
+export { waitConsumerName, waitConsumerConfig } from "@cotal-ai/core";
 /** How long one poll of a wait's consumer blocks. The deadline itself is durable; this is only how
  *  late its observation can be, and a shorter poll buys latency at the cost of fetch traffic. */
 const WAIT_POLL_MS = 2_000;
@@ -2126,6 +2176,25 @@ function spawnHandleOf(req, ext, fact, endpoint) {
         ...(typeof d.role === "string" ? { role: d.role } : {}),
     };
 }
+/** A recorded flag cannot turn a borrowed channel into a channel this step owns. */
+function assertConclaveOwnership(plan, requestId, req) {
+    const derived = `conclave-${createHash("sha256").update(requestId).digest("hex").slice(0, 12)}`;
+    if (plan.registered && plan.channel !== derived)
+        throw new Error(`recorded conclave channel ${plan.channel} is not owned by step ${requestId}`);
+    if (req !== undefined) {
+        if (plan.channel !== (req.channel ?? derived) || plan.registered !== (req.channel === undefined))
+            throw new Error(`recorded conclave channel does not match the requested channel for ${requestId}`);
+        const members = new Set(req.members.map((member) => member.agent));
+        if (plan.members.length !== members.size || plan.members.some((member) => !members.delete(member.agent)))
+            throw new Error(`recorded conclave members do not match the request for ${requestId}`);
+    }
+    for (const member of plan.members) {
+        const [owner, actor, ...extra] = member.principal.split(".");
+        if (owner === undefined || actor === undefined || extra.length !== 0 || principalKey(owner, actor).key !== member.principal
+            || parseAgentHandle(member.agent).uid !== member.uid || !Number.isSafeInteger(member.generation) || member.generation < 1)
+            throw new Error(`recorded conclave member identity is malformed for ${requestId}`);
+    }
+}
 /** Whether a recorded external is a conclave plan. A journal is bytes from an earlier process, so
  *  the shape is checked rather than trusted — a malformed external reads as "nothing was bound". */
 function isConclavePlan(v) {