@elvisw/dsh-magic-context 0.0.0-stage → 0.14.0

package/lib/core/policy.js

@@ -0,0 +1,111 @@
+export const DEFAULT_POLICY = {
+    executeThreshold: 65,
+    forceThreshold: 85,
+    assumedContextWindow: 256_000,
+    ttlMs: 5 * 60_000,
+    protectedToolResults: 8,
+    historianProtectedNodes: 8,
+    historianMinNodes: 3,
+    historianTimeoutMs: 120_000,
+    historianMaxTokens: 8192,
+    historianMaxTokensCeiling: 32_768,
+    historianAssumedWindow: 128_000,
+    historianMinBudgetTokens: 5_000,
+    baselineTokens: 2000,
+    memoryBudgetTokens: 8000,
+    memoryLimit: 40,
+    forceWaitReadyMs: 0,
+};
+/**
+ * The request's total input tokens as the provider counts them against the
+ * window: the DSH TokenUsage splits input into uncached input plus cache
+ * read/write, so pressure must sum all three (MC's OpenCode usage figure is
+ * already the total; this is the same quantity reassembled).
+ */
+export function totalInputTokens(usage) {
+    return (usage.inputTokens ?? 0) + (usage.cacheReadTokens ?? 0) + (usage.cacheWriteTokens ?? 0);
+}
+/** Usage percent against the model's context window, or undefined when unknown. */
+export function pressurePercent(latest, contextWindow) {
+    if (latest === undefined || contextWindow === undefined || contextWindow <= 0)
+        return undefined;
+    const total = totalInputTokens(latest);
+    if (total <= 0)
+        return 0;
+    return (total / contextWindow) * 100;
+}
+/**
+ * The denominator for pressure math: the window the routed model disclosed, or
+ * {@link PressurePolicy.assumedContextWindow} when it disclosed none (also for
+ * a placeholder 0 or a non-finite reading).
+ *
+ * Every pressure reader resolves through here, so one number governs the pass
+ * decision, its journal row and `/ctx-status`. Callers that need the fact
+ * itself — the DSH route window as disclosed — still read `contextWindow`.
+ */
+export function pressureWindowTokens(contextWindow, policy) {
+    return contextWindow !== undefined && Number.isFinite(contextWindow) && contextWindow > 0
+        ? contextWindow
+        : policy.assumedContextWindow;
+}
+/**
+ * One pass decision. Mirrors MC's scheduler: execute at the threshold, or
+ * when the idle clock (last served response, not last prepared request)
+ * passes the cache TTL; otherwise defer.
+ *
+ * Iron rule: the adapter must never leave the main wire unpairable. A
+ * stranded `tool_result` 400s every strict-provider request, so any live
+ * wire defect forces the execute band before pressure is even considered.
+ */
+export function decidePass(args) {
+    if ((args.wireDefects ?? 0) > 0)
+        return { kind: 'execute', reason: 'wire-repair' };
+    if (args.latest === undefined)
+        return { kind: 'defer', reason: 'no-usage' };
+    if (args.pressure === undefined)
+        return { kind: 'defer', reason: 'no-window' };
+    if (args.pressure >= args.policy.executeThreshold)
+        return { kind: 'execute', reason: 'execute-threshold' };
+    if (args.now - args.latest.recordedAt > args.policy.ttlMs) {
+        return { kind: 'execute', reason: 'cache-ttl-expired' };
+    }
+    return { kind: 'defer', reason: 'below-threshold' };
+}
+/**
+ * Parse MC's drop-range grammar: "3-5,8,12-15" → unique tag numbers.
+ *
+ * Ascending by default (the `ctx_reduce` contract: batch order is irrelevant).
+ * `ctx_expand` passes `preserveOrder` because its payload is joined in request
+ * order (contract D4/Q3), so "9,2" must stay 9 before 2.
+ */
+export function parseTagRanges(input, options) {
+    const tags = [];
+    const seen = new Set();
+    const add = (tag) => {
+        if (seen.has(tag))
+            return;
+        seen.add(tag);
+        tags.push(tag);
+    };
+    for (const part of input.split(',')) {
+        const token = part.trim();
+        if (token.length === 0)
+            continue;
+        const range = token.match(/^(\d+)-(\d+)$/);
+        if (range !== null) {
+            const start = Number(range[1]);
+            const end = Number(range[2]);
+            if (!Number.isInteger(start) || !Number.isInteger(end) || start < 1 || end < start || end - start > 10_000)
+                continue;
+            for (let tag = start; tag <= end; tag++)
+                add(tag);
+            continue;
+        }
+        if (/^\d+$/.test(token)) {
+            const tag = Number(token);
+            if (tag >= 1)
+                add(tag);
+        }
+    }
+    return options?.preserveOrder === true ? tags : tags.sort((a, b) => a - b);
+}

package/lib/core/profile-confirmation.js

@@ -0,0 +1,55 @@
+import { buildConfirmationQuestion, classifyProfileShape } from "./directive-detect.js";
+/**
+ * Decide what happens to one candidate.
+ *
+ * Descriptive -> the caller may promote it through the normal path.
+ * Directive   -> queued, and the caller must NOT promote it.
+ *
+ * Enqueueing is idempotent per pending candidate, so a retried historian pass
+ * cannot produce a second question for the same observation.
+ */
+export function gateProfileCandidate(store, input, now) {
+    const verdict = classifyProfileShape(input.content);
+    if (verdict.shape !== 'directive')
+        return { shape: 'descriptive', verdict };
+    const confirmation = store.enqueueProfileConfirmation({
+        contractCandidateId: input.contractCandidateId,
+        question: buildConfirmationQuestion(input.content, verdict),
+        content: input.content,
+    }, now);
+    return { shape: 'directive', verdict, confirmation };
+}
+export function listPendingConfirmations(store) {
+    return store.listProfileConfirmations('pending');
+}
+/**
+ * Answer a pending question. Returns the decided row, or `undefined` when the
+ * id is unknown or was already decided — deciding twice must not resurrect a
+ * candidate the human already rejected.
+ */
+export function decideConfirmation(store, id, decision, now) {
+    const pending = store.listProfileConfirmations('pending').find(row => row.id === id);
+    if (pending === undefined)
+        return undefined;
+    store.decideProfileConfirmation(id, decision, now);
+    return { ...pending, state: decision, decidedAt: now };
+}
+/**
+ * The one-line summary a session notice carries. Deliberately includes the
+ * command surface, because a question with no way to answer it is just noise.
+ */
+export function formatConfirmationNotice(rows) {
+    if (rows.length === 0)
+        return undefined;
+    const head = rows.length === 1
+        ? '有 1 条画像候选需要你确认（它会在所有会话生效）'
+        : `有 ${rows.length} 条画像候选需要你确认（它们会在所有会话生效）`;
+    const lines = [head];
+    for (const row of rows.slice(0, 3)) {
+        lines.push(`  #${String(row.id)} ${row.content.replace(/\s+/g, ' ').trim().slice(0, 72)}`);
+    }
+    if (rows.length > 3)
+        lines.push(`  …还有 ${String(rows.length - 3)} 条`);
+    lines.push('  用 /ctx-profile list 查看全文，confirm <id> 确认，reject <id> 丢弃。');
+    return lines.join('\n');
+}

package/lib/core/profile-review.js

@@ -0,0 +1,375 @@
+/**
+ * WP7 — the `user` domain's REVIEW pass.
+ *
+ * Candidates (WP5) become profile rows (`user_memories`) that render into m[0]
+ * (WP8). Magic Context does this in a daily `review-user-memories` task that
+ * needs a session-scoped dreamer; DSH has no such thing, so the pass rides the
+ * existing maintenance tick and is throttled by a stored timestamp instead.
+ *
+ * Four rules carry the design, each of them a divergence or a defect fix:
+ *
+ *  1. **The candidate TTL does NOT live inside the review.** Upstream runs its
+ *     30-day decay inside the review task, so switching the review off — or
+ *     having no LLM route at all — means candidates are never cleaned and the
+ *     pool grows without bound. Here expiry runs first, unconditionally, before
+ *     any of the reasons that can skip the review.
+ *  2. **Failure is closed, and it is closed on the WHOLE verdict.** A truncated
+ *     or unparsable answer promotes nothing and consumes nothing: the candidates
+ *     stay for the next tick, which is always cheaper than acting on half a
+ *     judgement.
+ *  3. **Consumption is a UNION, never just what the model listed.** A candidate
+ *     is consumed when the model names it, when its content is what got
+ *     promoted, or when the model rejects it — and a candidate whose content is
+ *     already promoted is consumed even though the promotion itself is skipped
+ *     as a duplicate. A model that forgets `consume_candidate_ids` therefore
+ *     cannot make the same candidate be re-judged forever.
+ *  4. **Candidates are consumed only for promotions that actually landed.**
+ *     Deleting the inputs of a failed INSERT would lose the observation with
+ *     nothing to show for it.
+ *  5. **A decided pass is never silent.** A skip that means "nothing to do
+ *     yet" (no-candidates / too-few / too-few-sessions) journals one info row
+ *     AND stamps the daily throttle, so the pass leaves exactly one
+ *     profile-review row per interval: a quiet journal can never again be read
+ *     as "the lane is dead", and a persistent skip cannot spam every tick.
+ *     Failed attempts (llm-off / llm-failed / invalid-output) stamp nothing,
+ *     so they stay retried on the next tick.
+ */
+import { LlmDeadlineError, withDeadline } from "./llm-deadline.js";
+import { errText } from "./types.js";
+/** Candidates needed before a review is worth an LLM call. */
+export const PROFILE_REVIEW_THRESHOLD = 3;
+/**
+ * Distinct SESSIONS the supporting candidates must come from before a profile
+ * row may be promoted (2026-10-16 user decision; execution plan §8 C-0).
+ *
+ * The profile is injected into EVERY session, so the failure mode is one
+ * talkative session turning its own quirk into a standing rule for all of them.
+ * Upstream MC guards this with cross-session recurrence; the `org` domain has
+ * the symmetric gate (`distinct_identities >= 2`), while this pass only counted
+ * the pool size — three near-identical observations from ONE session could
+ * promote. Counting distinct sessions closes that hole symmetrically.
+ */
+export const PROFILE_REVIEW_MIN_SESSIONS = 2;
+/** At most one review per day (MC's cadence, without MC's scheduler). */
+export const PROFILE_REVIEW_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/** MC's candidate TTL, enforced by expiry regardless of the switch. */
+export const PROFILE_CANDIDATE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** Candidates read per review — bounded so one tick cannot become a batch job. */
+export const PROFILE_REVIEW_BATCH = 40;
+/** Output cap for the verdict. */
+export const PROFILE_REVIEW_MAX_TOKENS = 4_096;
+/**
+ * Wall-clock budget for the review's single round trip, for the same reason the
+ * verify lane has one: the review rides the maintenance tick, and the ticker's
+ * interval is installed only after a tick resolves — a stream that never settles
+ * would therefore stop the whole maintenance lane for the life of the process.
+ */
+export const PROFILE_REVIEW_TIMEOUT_MS = 120_000;
+/** A promoted profile row is a standing rule; longer than this is not one. */
+export const PROFILE_MAX_CONTENT_CHARS = 800;
+/**
+ * Adapter-meta key holding when a review pass last reached a DECIDED state —
+ * a run, or a nothing-to-do skip (rule 5 above). The throttled timestamp
+ * lives here rather than in the contract: it is our scheduling state, not
+ * Magic Context's data, and writing it must not touch the shared store.
+ */
+export const PROFILE_REVIEW_META_KEY = 'profile_last_review_at';
+export const PROFILE_REVIEW_INSTRUCTION = [
+    'You maintain a USER PROFILE: statements about the user that stay true across projects.',
+    'You are given candidate observations collected from past sessions. Decide which belong in the profile.',
+    '',
+    'Return ONLY one JSON object, no prose, no code fences:',
+    '{',
+    '  "promote": [{ "content": "...", "consume_candidate_ids": [1, 2] }],',
+    '  "reject": [3]',
+    '}',
+    '',
+    'Rules:',
+    '- "promote" holds ONE entry per distinct standing fact. Merge near-duplicates into a single entry and put',
+    '  EVERY candidate id that fed it into "consume_candidate_ids".',
+    '- Treat the user as the subject. Project-specific facts (paths, module names, one-off incidents) do NOT',
+    '  belong here: reject them.',
+    '- Promoted content must be a standalone statement that reads correctly with no other context.',
+    '- "reject" lists candidate ids that will never be promoted.',
+    '- Every candidate id you were given must appear either in some "consume_candidate_ids" or in "reject".',
+    '- If nothing qualifies, return {"promote":[],"reject":[]}. Never invent candidates.',
+].join('\n');
+/** Case/whitespace-insensitive form used for duplicate detection. */
+export function normalizeProfileContent(content) {
+    return content.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/**
+ * Parse the review answer, fail-closed.
+ *
+ * The three failure modes the plan names — truncated JSON, no output, invalid
+ * JSON — all return `undefined`, and the caller then promotes and consumes
+ * nothing. Entries missing usable content are dropped individually (they cannot
+ * be promoted either way); a malformed `promote`/`reject` CONTAINER fails the
+ * whole verdict, because a partially-read verdict is a partially-applied
+ * judgement.
+ */
+export function parseProfileReviewOutput(text) {
+    const open = text.indexOf('{');
+    const close = text.lastIndexOf('}');
+    if (open === -1 || close <= open)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(text.slice(open, close + 1));
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const record = parsed;
+    const rawPromote = record.promote;
+    const rawReject = record.reject;
+    if (rawPromote !== undefined && !Array.isArray(rawPromote))
+        return undefined;
+    if (rawReject !== undefined && !Array.isArray(rawReject))
+        return undefined;
+    const promote = [];
+    for (const entry of (rawPromote ?? [])) {
+        if (entry === null || typeof entry !== 'object')
+            continue;
+        const row = entry;
+        const content = typeof row.content === 'string' ? row.content.trim() : '';
+        if (content === '')
+            continue;
+        const ids = Array.isArray(row.consume_candidate_ids)
+            ? row.consume_candidate_ids.filter((id) => Number.isInteger(id))
+            : [];
+        promote.push({
+            content: content.length > PROFILE_MAX_CONTENT_CHARS ? content.slice(0, PROFILE_MAX_CONTENT_CHARS) : content,
+            consumeCandidateIds: ids,
+        });
+    }
+    const reject = Array.isArray(rawReject)
+        ? rawReject.filter((id) => Number.isInteger(id))
+        : [];
+    return { promote, reject };
+}
+/**
+ * Turn a verdict into writes and deletions. Pure, so the union rule is testable
+ * without a database or a model. See the rule list at the top of the file.
+ */
+export function planProfileReview(input) {
+    const sent = new Map(input.candidates.map(row => [row.id, row]));
+    const byContent = new Map();
+    for (const row of input.candidates) {
+        const key = normalizeProfileContent(row.content);
+        byContent.set(key, [...(byContent.get(key) ?? []), row.id]);
+    }
+    const already = new Set(input.existing.map(normalizeProfileContent));
+    const consumed = new Set();
+    const promotions = [];
+    for (const entry of input.verdict.promote) {
+        const key = normalizeProfileContent(entry.content);
+        // Named ids and content matches are BOTH consumed, and both are collected
+        // even when the promotion itself is skipped as a duplicate: a candidate
+        // already represented in the profile must not be re-judged forever.
+        const own = [...new Set([
+                ...entry.consumeCandidateIds.filter(id => sent.has(id)),
+                ...(byContent.get(key) ?? []),
+            ])].sort((left, right) => left - right);
+        for (const id of own)
+            consumed.add(id);
+        if (key === '' || already.has(key))
+            continue;
+        already.add(key);
+        promotions.push({ content: entry.content, consume: own });
+    }
+    for (const id of input.verdict.reject) {
+        if (sent.has(id))
+            consumed.add(id);
+    }
+    return { promotions, consumed: [...consumed].sort((left, right) => left - right) };
+}
+/** One LLM call, collected by block index — the same shape the tick uses. */
+async function collectText(llm, route, sessionId, prompt, budgetMs = PROFILE_REVIEW_TIMEOUT_MS) {
+    try {
+        return await withDeadline(async (signal) => {
+            const byIndex = new Map();
+            let usage;
+            const chunks = llm.stream({
+                provider: route.provider,
+                model: route.model,
+                messages: [{ role: 'user', content: [{ type: 'text', text: prompt }] }],
+                maxTokens: PROFILE_REVIEW_MAX_TOKENS,
+                sessionId,
+                purpose: 'compaction',
+                signal,
+            });
+            for await (const raw of chunks) {
+                const chunk = raw;
+                if (chunk.type === 'text-delta' && typeof chunk.index === 'number' && typeof chunk.text === 'string') {
+                    byIndex.set(chunk.index, (byIndex.get(chunk.index) ?? '') + chunk.text);
+                }
+                else if (chunk.type === 'usage') {
+                    const reported = raw.usage;
+                    const numeric = {};
+                    for (const [key, value] of Object.entries(reported ?? {})) {
+                        if (typeof value === 'number')
+                            numeric[key] = value;
+                    }
+                    usage = numeric;
+                }
+                else if (chunk.type === 'finish') {
+                    const kind = chunk.reason?.kind;
+                    if (kind === 'error' || kind === 'aborted') {
+                        return { ok: false, why: `stream finished (${kind})${chunk.reason?.failure?.message === undefined ? '' : `: ${chunk.reason.failure.message}`}` };
+                    }
+                }
+            }
+            const text = [...byIndex.entries()].sort(([a], [b]) => a - b).map(([, value]) => value).join('');
+            if (text.trim().length === 0)
+                return { ok: false, why: 'stream produced no text deltas' };
+            return { ok: true, text, ...usage === undefined ? {} : { usage } };
+        }, budgetMs);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            why: error instanceof LlmDeadlineError ? `deadline ${error.message}` : errText(error),
+        };
+    }
+}
+function renderCandidate(row, nowMs) {
+    const ageDays = Math.max(0, Math.round((nowMs - row.createdAt) / 86_400_000));
+    const text = row.content.replace(/\s+/g, ' ');
+    return `- id ${String(row.id)} (age ${String(ageDays)}d): ${text}`;
+}
+/**
+ * Run one review. Never throws: every failure is journaled and the pool is left
+ * exactly as it was, so the next tick sees the same candidates.
+ */
+export async function runProfileReview(deps) {
+    const now = (deps.now ?? Date.now)();
+    const writer = deps.writer;
+    const empty = { expired: 0, ran: false, promoted: 0, consumed: 0 };
+    if (writer === undefined || writer.status.ok !== true) {
+        return { ...empty, reason: 'writer-unavailable' };
+    }
+    // (1) TTL FIRST, and unconditionally. Upstream's decay lives inside its review
+    // task, so turning the review off (or having no route) leaks candidates
+    // forever; here the pool is bounded no matter what happens below.
+    const expired = writer.expireCandidates(now - PROFILE_CANDIDATE_TTL_MS);
+    if (deps.llm === undefined || deps.route === undefined) {
+        deps.journal.info('maintenance', `profile review skipped (no llm route); expired ${String(expired)}`, {
+            expired,
+            reason: 'llm-off',
+        });
+        return { ...empty, expired, reason: 'llm-off' };
+    }
+    if (deps.lastReviewAt !== undefined && now - deps.lastReviewAt < PROFILE_REVIEW_INTERVAL_MS) {
+        return { ...empty, expired, reason: 'throttled' };
+    }
+    const threshold = Math.max(1, deps.threshold ?? PROFILE_REVIEW_THRESHOLD);
+    const batch = Math.max(threshold, deps.batch ?? PROFILE_REVIEW_BATCH);
+    const candidates = writer.listCandidates(batch);
+    if (candidates.length === 0) {
+        deps.journal.info('maintenance', `profile review skipped (no candidates); expired ${String(expired)}`, {
+            expired,
+            reason: 'no-candidates',
+        });
+        return { ...empty, expired, reason: 'no-candidates', attempted: true };
+    }
+    if (candidates.length < threshold) {
+        deps.journal.info('maintenance', `profile review skipped (${String(candidates.length)} candidate(s) below threshold ${String(threshold)}); expired ${String(expired)}`, { expired, candidates: candidates.length, threshold, reason: 'too-few' });
+        return { ...empty, expired, reason: 'too-few', attempted: true };
+    }
+    // Cross-session gate (see PROFILE_REVIEW_MIN_SESSIONS). Checked before the LLM
+    // call: a batch contributed by a single session cannot promote anything, so
+    // paying for a judgement on it would only burn tokens and produce a verdict
+    // that must be discarded.
+    const minSessions = Math.max(1, deps.minSessions ?? PROFILE_REVIEW_MIN_SESSIONS);
+    const sessions = new Set(candidates.map(row => row.sessionId));
+    if (sessions.size < minSessions) {
+        deps.journal.info('maintenance', `profile review skipped (candidates span ${String(sessions.size)} session(s), need ${String(minSessions)}); expired ${String(expired)}`, { candidates: candidates.length, sessions: sessions.size, reason: 'too-few-sessions' });
+        return { ...empty, expired, reason: 'too-few-sessions', attempted: true };
+    }
+    const prompt = PROFILE_REVIEW_INSTRUCTION + '\n\nCandidate observations:\n'
+        + candidates.map(row => renderCandidate(row, now)).join('\n');
+    const call = await collectText(deps.llm, deps.route, deps.sessionId, prompt, deps.reviewTimeoutMs);
+    if (!call.ok) {
+        deps.journal.warn('maintenance', `profile review call failed (retried next tick): ${call.why}`, {
+            candidates: candidates.length,
+            why: call.why,
+            route: `${deps.route.provider}/${deps.route.model}`,
+        });
+        return { ...empty, expired, reason: 'llm-failed' };
+    }
+    // (2) Fail closed on the whole verdict: nothing promoted, nothing consumed.
+    const verdict = parseProfileReviewOutput(call.text);
+    if (verdict === undefined) {
+        deps.journal.warn('maintenance', 'profile review answer rejected (invalid JSON); candidates kept', {
+            candidates: candidates.length,
+            outputChars: call.text.length,
+            outputTail: call.text.slice(-400),
+        });
+        return { ...empty, expired, reason: 'invalid-output' };
+    }
+    const existing = writer.listActiveProfiles().map(row => row.content);
+    const plan = planProfileReview({ candidates, existing, verdict });
+    const provenance = JSON.stringify({
+        sessions: [...new Set(candidates.map(row => row.sessionId))],
+        candidateIds: candidates.map(row => row.id),
+    });
+    // Per-promotion cross-session gate: the batch check above only proves that TWO
+    // sessions contributed SOMETHING; a promotion must itself rest on more than one
+    // session's observations. One that does not is held back here — and its
+    // candidates are deliberately NOT consumed, so it can be judged again once
+    // another session corroborates it.
+    const byId = new Map(candidates.map(row => [row.id, row]));
+    const kept = [];
+    const heldBack = [];
+    for (const promotion of plan.promotions) {
+        const spanned = new Set(promotion.consume
+            .map(id => byId.get(id)?.sessionId)
+            .filter((sid) => sid !== undefined));
+        if (spanned.size < minSessions) {
+            heldBack.push(...promotion.consume);
+            continue;
+        }
+        kept.push(promotion);
+    }
+    if (heldBack.length > 0) {
+        deps.journal.info('maintenance', `profile review held back ${String(heldBack.length)} candidate(s): a promotion needs observations from ${String(minSessions)} session(s)`, { heldBack: [...new Set(heldBack)].sort((left, right) => left - right), reason: 'too-few-sessions' });
+    }
+    const promotedIds = [];
+    const landed = [];
+    for (const promotion of kept) {
+        const id = writer.promoteProfile({
+            content: promotion.content,
+            candidateIds: promotion.consume,
+            promotedAt: now,
+            provenance,
+        });
+        // (4) Only a promotion that LANDED may consume its inputs.
+        if (id !== undefined) {
+            promotedIds.push(id);
+            landed.push(...promotion.consume);
+        }
+    }
+    // Rejections are consumption by definition — the model said these never
+    // become profile rows — so they are dropped whether or not anything promoted.
+    const rejected = verdict.reject.filter(id => candidates.some(row => row.id === id));
+    const toDelete = [...new Set([...landed, ...rejected])];
+    const consumed = toDelete.length === 0 ? 0 : writer.deleteCandidates(toDelete);
+    const usage = call.usage !== undefined
+        ? { inputTokens: call.usage.inputTokens ?? 0, outputTokens: call.usage.outputTokens ?? 0 }
+        : undefined;
+    deps.journal.info('maintenance', `profile review: ${String(promotedIds.length)} promoted, ${String(consumed)} candidate(s) consumed`
+        + `${expired > 0 ? `, ${String(expired)} expired` : ''}`, {
+        ran: true,
+        expired,
+        candidates: candidates.length,
+        promoted: promotedIds.length,
+        promotedIds,
+        consumed,
+        rejected: rejected.length,
+        ...usage === undefined ? {} : { usage },
+    });
+    return { expired, ran: true, attempted: true, promoted: promotedIds.length, consumed };
+}