@dsh-enhanced/assistant-delivery 0.1.62 → 0.1.63

package/lib/store.js

@@ -2649,6 +2649,94 @@ export class DeliveryStore {
     `).all(afterSequence, limit);
         return rows.map(inboxFromRow);
     }
+    /** Scan durable, unacknowledged dispatched turns without replaying their Agent work. */
+    listInterruptedInboxNotices(input = {}) {
+        this.assertOpen();
+        const afterSequence = input.afterSequence ?? 0;
+        if (!Number.isSafeInteger(afterSequence) || afterSequence < 0) {
+            throw new DeliveryStoreError('conflict', 'invalid interrupted Inbox cursor');
+        }
+        const limit = boundedMaintenanceLimit(input.limit, 100, 'interrupted Inbox');
+        const rows = this.database.prepare(`${inboxSelect}
+      WHERE inbox_messages.status = 'dead_letter'
+        AND inbox_messages.failure_code = 'dispatch-ambiguous'
+        AND json_extract(inbox_messages.envelope_json, '$.kind') = 'text'
+        AND inbox_messages.channel != 'web'
+        AND inbox_messages.binding_id IS NOT NULL
+        AND EXISTS (
+          SELECT 1 FROM delivery_foreground_executions AS execution
+          WHERE execution.inbox_id = inbox_messages.id
+        )
+        AND admission_sequence > ?
+        AND NOT EXISTS (
+          SELECT 1 FROM dead_letter_resolutions AS resolution
+          WHERE resolution.kind = 'inbox' AND resolution.message_id = inbox_messages.id
+            AND resolution.attempt_count = inbox_messages.attempt_count
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM outbox_messages AS reply
+          WHERE reply.idempotency_key IN (
+            'inbound:' || inbox_messages.id || ':reply',
+            'inbound:' || inbox_messages.event_id || ':reply',
+            'inbound:' || inbox_messages.id || ':interrupted'
+          )
+        )
+      ORDER BY admission_sequence LIMIT ?
+    `).all(afterSequence, limit);
+        return rows.map(inboxFromRow);
+    }
+    /** The final notice decision and Outbox insert share one SQLite writer fence. */
+    enqueueInterruptedInboxNotice(input) {
+        this.assertOpen();
+        return this.transaction(() => {
+            if (!this.interruptedInboxNoticeCurrent(input)) {
+                throw new DeliveryStoreError('version-conflict', 'interrupted Inbox notice lost its exact owner or reply fence');
+            }
+            return this.enqueueIntent(input.intent, false);
+        });
+    }
+    /** Recheck a queued interruption notice immediately before an adapter send. */
+    canSendInterruptedInboxNotice(record) {
+        this.assertOpen();
+        const key = record.intent.idempotencyKey;
+        if (!key.startsWith('inbound:') || !key.endsWith(':interrupted'))
+            return false;
+        const inboxId = key.slice('inbound:'.length, -':interrupted'.length);
+        const binding = this.getBinding(record.intent.bindingId);
+        return binding !== undefined
+            && this.getOutboxByIdempotencyKey(key)?.id === record.id
+            && this.interruptedInboxNoticeCurrent({ inboxId, binding, intent: record.intent });
+    }
+    interruptedInboxNoticeCurrent(input) {
+        const inbox = this.getInbox(input.inboxId);
+        const binding = inbox?.bindingId === undefined ? undefined : this.getBinding(inbox.bindingId);
+        const owner = binding === undefined ? undefined : this.getBindingPrincipal(binding.id);
+        const execution = this.database.prepare(`
+        SELECT principal_record_id, principal_version, binding_id, binding_version,
+          binding_generation, workspace, preset
+        FROM delivery_foreground_executions WHERE inbox_id = ?
+    `).get(input.inboxId);
+        return inbox?.status === 'dead_letter' && inbox.failureCode === 'dispatch-ambiguous'
+            && inbox.envelope.kind === 'text' && inbox.channel !== 'web'
+            && binding?.status === 'active' && binding.id === input.binding.id
+            && binding.version === input.binding.version && binding.generation === input.binding.generation
+            && binding.sessionId === input.binding.sessionId
+            && this.getActiveBinding(inbox.envelope.conversation)?.id === binding.id
+            && owner?.status === 'active' && owner.role === 'owner'
+            && execution?.principal_record_id === owner.id && execution.principal_version === owner.version
+            && execution.binding_id === binding.id && execution.binding_version === binding.version
+            && execution.binding_generation === binding.generation
+            && execution.workspace === binding.workspace && execution.preset === binding.agentPreset
+            && principalHash(inbox.envelope.principal) === principalHash(binding.principal)
+            && conversationHash(inbox.envelope.conversation) === conversationHash(binding.conversation)
+            && input.intent.bindingId === binding.id
+            && input.intent.replyToEventId === inbox.eventId
+            && input.intent.idempotencyKey === `inbound:${inbox.id}:interrupted`
+            && this.getDeadLetterResolution({ kind: 'inbox', id: inbox.id,
+                attemptCount: inbox.attemptCount }) === undefined
+            && this.getOutboxByIdempotencyKey(`inbound:${inbox.id}:reply`) === undefined
+            && this.getOutboxByIdempotencyKey(`inbound:${inbox.eventId}:reply`) === undefined;
+    }
     listInbox(input = {}) {
         this.assertOpen();
         const limit = Math.max(1, Math.min(100, input.limit ?? 20));
@@ -2804,6 +2892,40 @@ export class DeliveryStore {
         }
         return this.getInbox(inboxId);
     }
+    /** A durable control message wins even while its async binding transition is waiting. */
+    hasRestartCancellationAfter(inboxId, binding) {
+        this.assertOpen();
+        const rows = this.database.prepare(`SELECT message.envelope_json FROM inbox_messages AS message
+      JOIN delivery_inbox_admissions AS admission ON admission.inbox_id = message.id
+      WHERE admission.admission_sequence > (SELECT admission_sequence FROM delivery_inbox_admissions WHERE inbox_id = ?)
+        AND message.status != 'dead_letter'
+        AND json_extract(message.envelope_json, '$.kind') = 'command'
+        AND json_extract(message.envelope_json, '$.conversation') = json(?)
+        AND json_extract(message.envelope_json, '$.principal') = json(?)`)
+            .all(inboxId, conversationJson(binding.conversation), principalJson(binding.principal));
+        return rows.some(row => isExactDeliveryCommand(parseDeliveryCommand(JSON.parse(row.envelope_json)), 'stop', 'new', 'clear'));
+    }
+    /** The fence and Inbox claims share this database's write transaction. */
+    setRestartFence(requestId, sourceInvocationId) {
+        this.assertOpen();
+        this.transaction(() => {
+            const current = this.getRestartFence();
+            if (current !== undefined && (current.requestId !== requestId || current.sourceInvocationId !== sourceInvocationId)) {
+                throw new DeliveryStoreError('conflict', 'another restart owns the delivery drain fence');
+            }
+            this.database.prepare('INSERT OR IGNORE INTO delivery_restart_fence VALUES (1, ?, ?)').run(requestId, sourceInvocationId);
+        });
+    }
+    getRestartFence() {
+        this.assertOpen();
+        const row = this.database.prepare('SELECT request_id, source_invocation_id FROM delivery_restart_fence WHERE singleton = 1')
+            .get();
+        return row === undefined ? undefined : { requestId: row.request_id, sourceInvocationId: row.source_invocation_id };
+    }
+    clearRestartFence(requestId) {
+        this.assertOpen();
+        this.database.prepare('DELETE FROM delivery_restart_fence WHERE singleton = 1 AND request_id = ?').run(requestId);
+    }
     claimInbox(input) {
         this.assertOpen();
         const ownerId = validateBindingText(input.ownerId, 'ownerId', 256);
@@ -2819,6 +2941,8 @@ export class DeliveryStore {
         const now = this.now();
         const claims = [];
         this.transaction(() => {
+            if (this.getRestartFence() !== undefined)
+                return;
             this.database.prepare(`
         UPDATE inbox_messages SET status = 'dead_letter', failure_code = 'attempts-exhausted',
           next_attempt_at = NULL, updated_at = ?
@@ -4397,93 +4521,98 @@ export class DeliveryStore {
         const claims = [];
         const validatedOwnerRouteIds = [];
         this.transaction(() => {
-            this.database.prepare(`
-        UPDATE outbox_messages SET status = 'dead', failure_code = 'attempts-exhausted',
-          next_attempt_at = NULL, updated_at = ?
-        WHERE rowid IN (
-          SELECT candidate.rowid FROM outbox_messages AS candidate
-          WHERE candidate.status = 'retry_wait' AND candidate.next_attempt_at <= ?
-            AND (
-              SELECT COUNT(*) FROM outbox_attempts AS history
-              WHERE history.outbox_id = candidate.id AND history.operation = 'send'
-            ) >= ?
-          ORDER BY candidate.rowid LIMIT ?
-        )
-      `).run(now, now, input.maxAttempts, maintenanceLimit);
-            this.database.prepare(`
-        UPDATE outbox_messages SET status = 'dead', failure_code = 'reconcile-attempts-exhausted',
-          next_attempt_at = NULL, updated_at = ?
-        WHERE rowid IN (
-          SELECT candidate.rowid FROM outbox_messages AS candidate
-          WHERE candidate.status = 'unknown_after_send'
-            AND NOT EXISTS (
-              SELECT 1 FROM dead_letter_resolutions AS resolution
-              WHERE resolution.kind = 'outbox' AND resolution.message_id = candidate.id
-                AND resolution.attempt_count = candidate.attempt_count AND resolution.resolution = 'cancel'
-            )
-            AND (
-              SELECT COUNT(*) FROM outbox_attempts AS history
-              WHERE history.outbox_id = candidate.id AND history.operation = 'reconcile'
-            ) >= ?
-          ORDER BY candidate.rowid LIMIT ?
-        )
-      `).run(now, input.maxAttempts, maintenanceLimit);
-            const ownerRouteRows = this.database.prepare(`
-        SELECT id FROM outbox_messages
-        WHERE status IN ('pending', 'retry_wait') AND claimed_by IS NULL
-          AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-          AND json_type(intent_json, '$.metadata."dsh.route.authority"') IS NOT NULL
-        ORDER BY rowid LIMIT ?
-      `).all(now, maintenanceLimit);
-            const ownerRouteGuard = input.ownerRouteGuard ?? { ownerRoutes: [], authorize: () => false };
-            for (const row of ownerRouteRows) {
-                const record = this.getOutbox(row.id);
-                if (record === undefined)
-                    continue;
-                const inspected = this.inspectOwnerRouteDispatch(record, ownerRouteGuard);
-                if (inspected.kind === 'deferred') {
-                    this.deferOwnerRouteBeforeClaim(record, inspected.failureCode, now, now + Math.max(1, Math.min(input.leaseMs, 30_000)));
-                    continue;
-                }
-                if (inspected.kind !== 'authorized') {
-                    const failureCode = inspected.kind === 'denied'
-                        ? inspected.failureCode
-                        : 'owner-route-receipt-invalid';
-                    this.deadLetterOwnerRouteBeforeClaim(record, ownerId, failureCode, now);
-                    continue;
-                }
-                if (!this.ownerRouteIsProvablyUnsent(record)) {
-                    this.deadLetterOwnerRouteBeforeClaim(record, ownerId, 'owner-route-send-proof-missing', now);
-                    continue;
-                }
-                if (!this.rebindOwnerRouteBeforeClaim(record, inspected)) {
-                    this.deadLetterOwnerRouteBeforeClaim(record, ownerId, 'owner-route-rebind-conflict', now);
-                    continue;
+            const restartFenceActive = this.getRestartFence() !== undefined;
+            // Drain without changing queued retries or unresolved sends. Only a
+            // plain maintenance acknowledgement may start during this fence.
+            if (!restartFenceActive) {
+                this.database.prepare(`
+          UPDATE outbox_messages SET status = 'dead', failure_code = 'attempts-exhausted',
+            next_attempt_at = NULL, updated_at = ?
+          WHERE rowid IN (
+            SELECT candidate.rowid FROM outbox_messages AS candidate
+            WHERE candidate.status = 'retry_wait' AND candidate.next_attempt_at <= ?
+              AND (
+                SELECT COUNT(*) FROM outbox_attempts AS history
+                WHERE history.outbox_id = candidate.id AND history.operation = 'send'
+              ) >= ?
+            ORDER BY candidate.rowid LIMIT ?
+          )
+        `).run(now, now, input.maxAttempts, maintenanceLimit);
+                this.database.prepare(`
+          UPDATE outbox_messages SET status = 'dead', failure_code = 'reconcile-attempts-exhausted',
+            next_attempt_at = NULL, updated_at = ?
+          WHERE rowid IN (
+            SELECT candidate.rowid FROM outbox_messages AS candidate
+            WHERE candidate.status = 'unknown_after_send'
+              AND NOT EXISTS (
+                SELECT 1 FROM dead_letter_resolutions AS resolution
+                WHERE resolution.kind = 'outbox' AND resolution.message_id = candidate.id
+                  AND resolution.attempt_count = candidate.attempt_count AND resolution.resolution = 'cancel'
+              )
+              AND (
+                SELECT COUNT(*) FROM outbox_attempts AS history
+                WHERE history.outbox_id = candidate.id AND history.operation = 'reconcile'
+              ) >= ?
+            ORDER BY candidate.rowid LIMIT ?
+          )
+        `).run(now, input.maxAttempts, maintenanceLimit);
+                const ownerRouteRows = this.database.prepare(`
+          SELECT id FROM outbox_messages
+          WHERE status IN ('pending', 'retry_wait') AND claimed_by IS NULL
+            AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+            AND json_type(intent_json, '$.metadata."dsh.route.authority"') IS NOT NULL
+          ORDER BY rowid LIMIT ?
+        `).all(now, maintenanceLimit);
+                const ownerRouteGuard = input.ownerRouteGuard ?? { ownerRoutes: [], authorize: () => false };
+                for (const row of ownerRouteRows) {
+                    const record = this.getOutbox(row.id);
+                    if (record === undefined)
+                        continue;
+                    const inspected = this.inspectOwnerRouteDispatch(record, ownerRouteGuard);
+                    if (inspected.kind === 'deferred') {
+                        this.deferOwnerRouteBeforeClaim(record, inspected.failureCode, now, now + Math.max(1, Math.min(input.leaseMs, 30_000)));
+                        continue;
+                    }
+                    if (inspected.kind !== 'authorized') {
+                        const failureCode = inspected.kind === 'denied'
+                            ? inspected.failureCode
+                            : 'owner-route-receipt-invalid';
+                        this.deadLetterOwnerRouteBeforeClaim(record, ownerId, failureCode, now);
+                        continue;
+                    }
+                    if (!this.ownerRouteIsProvablyUnsent(record)) {
+                        this.deadLetterOwnerRouteBeforeClaim(record, ownerId, 'owner-route-send-proof-missing', now);
+                        continue;
+                    }
+                    if (!this.rebindOwnerRouteBeforeClaim(record, inspected)) {
+                        this.deadLetterOwnerRouteBeforeClaim(record, ownerId, 'owner-route-rebind-conflict', now);
+                        continue;
+                    }
+                    validatedOwnerRouteIds.push(record.id);
                 }
-                validatedOwnerRouteIds.push(record.id);
+                this.database.prepare(`
+          UPDATE outbox_messages SET status = 'dead', failure_code = CASE
+              WHEN status = 'unknown_after_send' THEN 'binding-revoked-unknown'
+              ELSE 'binding-revoked'
+            END,
+            next_attempt_at = NULL, updated_at = ?
+          WHERE rowid IN (
+            SELECT candidate.rowid FROM outbox_messages AS candidate
+            WHERE candidate.status IN ('pending', 'retry_wait', 'unknown_after_send')
+              AND json_type(candidate.intent_json, '$.metadata."dsh.route.authority"') IS NULL
+              AND NOT EXISTS (
+                SELECT 1 FROM dead_letter_resolutions AS resolution
+                WHERE resolution.kind = 'outbox' AND resolution.message_id = candidate.id
+                  AND resolution.attempt_count = candidate.attempt_count AND resolution.resolution = 'cancel'
+              )
+              AND NOT EXISTS (
+                SELECT 1 FROM conversation_bindings AS binding
+                WHERE binding.id = candidate.binding_id AND binding.status = 'active'
+              )
+            ORDER BY candidate.rowid LIMIT ?
+          )
+        `).run(now, maintenanceLimit);
             }
-            this.database.prepare(`
-        UPDATE outbox_messages SET status = 'dead', failure_code = CASE
-            WHEN status = 'unknown_after_send' THEN 'binding-revoked-unknown'
-            ELSE 'binding-revoked'
-          END,
-          next_attempt_at = NULL, updated_at = ?
-        WHERE rowid IN (
-          SELECT candidate.rowid FROM outbox_messages AS candidate
-          WHERE candidate.status IN ('pending', 'retry_wait', 'unknown_after_send')
-            AND json_type(candidate.intent_json, '$.metadata."dsh.route.authority"') IS NULL
-            AND NOT EXISTS (
-              SELECT 1 FROM dead_letter_resolutions AS resolution
-              WHERE resolution.kind = 'outbox' AND resolution.message_id = candidate.id
-                AND resolution.attempt_count = candidate.attempt_count AND resolution.resolution = 'cancel'
-            )
-            AND NOT EXISTS (
-              SELECT 1 FROM conversation_bindings AS binding
-              WHERE binding.id = candidate.binding_id AND binding.status = 'active'
-            )
-          ORDER BY candidate.rowid LIMIT ?
-        )
-      `).run(now, maintenanceLimit);
             const ownerRouteClaimClause = validatedOwnerRouteIds.length === 0
                 ? `AND (
             json_type(candidate.intent_json, '$.metadata."dsh.route.authority"') IS NULL
@@ -4498,6 +4627,13 @@ export class DeliveryStore {
         SELECT candidate.id, candidate.status FROM outbox_messages AS candidate
         WHERE candidate.status IN ('pending', 'retry_wait', 'unknown_after_send')
           AND candidate.claimed_by IS NULL
+          ${restartFenceActive ? `AND candidate.status IN ('pending', 'retry_wait')
+          AND candidate.idempotency_key GLOB 'inbound:*:maintenance'
+          AND json_extract(candidate.intent_json, '$.format') = 'plain'
+          AND json_type(candidate.intent_json, '$.metadata') IS NULL
+          AND json_type(candidate.intent_json, '$.approval') IS NULL
+          AND json_type(candidate.intent_json, '$.modelPicker') IS NULL
+          AND json_type(candidate.intent_json, '$.permissionPicker') IS NULL` : ''}
           AND NOT EXISTS (
             SELECT 1 FROM dead_letter_resolutions AS resolution
             WHERE resolution.kind = 'outbox' AND resolution.message_id = candidate.id
@@ -4532,6 +4668,7 @@ export class DeliveryStore {
             WHERE earlier.lane_hash = candidate.lane_hash
               AND earlier.rowid < candidate.rowid
               AND earlier.status NOT IN ('accepted', 'delivered', 'read', 'dead')
+              ${restartFenceActive ? "AND earlier.idempotency_key GLOB 'inbound:*:maintenance'" : ''}
               AND NOT EXISTS (
                 SELECT 1 FROM dead_letter_resolutions AS resolution
                 WHERE resolution.kind = 'outbox' AND resolution.message_id = earlier.id