@fml-inc/fml 0.8.6 → 0.8.7-rc.1

package/dist/{chunk-5TOOBX7I.js → chunk-4YLSKFDU.js}

@@ -1,5 +1,8 @@
 import {
-  FML_HOOK_INBOX_DIR
+  FML_HOOK_INBOX_DIR,
+  FML_OBSERVER_LOCK_FILE,
+  FML_OBSERVER_PORT,
+  FML_OBSERVER_STATE_FILE
 } from "./chunk-B3H2YWPJ.js";
 
 // ../../packages/panopticon/src/observer/auth.ts
@@ -2922,6 +2925,7 @@ function openObserverDatabase(databaseFile, options = {}) {
 // ../../packages/panopticon/src/observer/protocol.ts
 var OBSERVER_PROTOCOL_VERSION = 1;
 var OBSERVER_SERVICE_NAME = "fml-observer";
+var OBSERVER_IDENTITY_HEADER = "x-fml-observer";
 function isObserverHealth(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const record = value;
@@ -2959,7 +2963,12 @@ function isAllowedObserverHost(host) {
 }
 function writeJson(res, status, body) {
   const payload = JSON.stringify(body);
-  res.writeHead(status, { "Content-Type": "application/json" });
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    // Identify every reply, including rejections, so a hook never mistakes
+    // another localhost service on a recorded port for the observer.
+    [OBSERVER_IDENTITY_HEADER]: OBSERVER_SERVICE_NAME
+  });
   res.end(payload);
 }
 function readHookRequestBody(req) {
@@ -3296,10 +3305,941 @@ function createObserverHttpServer(opts) {
   });
 }
 
-// src/hooks/inbox.ts
+// src/observer/state.ts
 import { randomUUID as randomUUID2 } from "crypto";
+import { execFileSync } from "child_process";
 import fs3 from "fs";
 import path4 from "path";
+var OBSERVER_STATE_SCHEMA_VERSION = 1;
+var OBSERVER_HEARTBEAT_STALE_MS = 2 * 60 * 1e3;
+var OBSERVER_RECLAIM_GUARD_STALE_MS = 3e4;
+var OBSERVER_RECLAIM_GUARD_UNVERIFIED_TTL_MS = 5 * 6e4;
+var MAX_RECLAIM_GUARD_RECOVERIES = 2;
+var MAX_RECLAIM_GUARD_RACE_RETRIES = 16;
+var MAX_INITIAL_STATE_PUBLICATION_RETRIES = 2;
+var EXCLUSIVE_LINK_UNSUPPORTED_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ENOSYS",
+  "ENOTSUP",
+  "EOPNOTSUPP",
+  "EPERM",
+  "EXDEV"
+]);
+var TRANSIENT_OBSERVER_FILE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "EACCES",
+  "EAGAIN",
+  "EBUSY",
+  "EPERM"
+]);
+var reclaimProcessNonce = randomUUID2();
+var activeReclaimGuardIds = /* @__PURE__ */ new Set();
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isObserverPhase(value) {
+  return value === "starting" || value === "syncing" || value === "idle" || value === "waiting_for_auth" || value === "backing_off" || value === "stopping";
+}
+function optionalNumber(record, key) {
+  const value = record[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function optionalString2(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : void 0;
+}
+function parseObserverState(value) {
+  if (!isRecord2(value)) return null;
+  if (value.schemaVersion !== OBSERVER_STATE_SCHEMA_VERSION || value.service !== OBSERVER_SERVICE_NAME || typeof value.pid !== "number" || !Number.isInteger(value.pid) || value.pid <= 0 || typeof value.port !== "number" || !Number.isInteger(value.port) || value.port <= 0 || value.port > 65535 || typeof value.instanceId !== "string" || value.instanceId.length === 0 || typeof value.startedAtMs !== "number" || typeof value.heartbeatAtMs !== "number" || !isObserverPhase(value.phase)) {
+    return null;
+  }
+  return {
+    schemaVersion: OBSERVER_STATE_SCHEMA_VERSION,
+    service: OBSERVER_SERVICE_NAME,
+    pid: value.pid,
+    port: value.port,
+    instanceId: value.instanceId,
+    startedAtMs: value.startedAtMs,
+    heartbeatAtMs: value.heartbeatAtMs,
+    phase: value.phase,
+    processIdentity: optionalString2(value, "processIdentity"),
+    environment: optionalString2(value, "environment"),
+    lastAttemptAtMs: optionalNumber(value, "lastAttemptAtMs"),
+    lastSuccessAtMs: optionalNumber(value, "lastSuccessAtMs"),
+    nextAttemptAtMs: optionalNumber(value, "nextAttemptAtMs"),
+    lastOutcome: optionalString2(value, "lastOutcome"),
+    lastError: optionalString2(value, "lastError")
+  };
+}
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function readObserverState(stateFile = FML_OBSERVER_STATE_FILE) {
+  try {
+    return parseObserverState(
+      JSON.parse(fs3.readFileSync(stateFile, "utf8"))
+    );
+  } catch {
+    return null;
+  }
+}
+function readObserverStateStatus(opts = {}) {
+  const stateFile = opts.stateFile ?? FML_OBSERVER_STATE_FILE;
+  const exists = fs3.existsSync(stateFile);
+  const state = readObserverState(stateFile);
+  if (!state) {
+    return { exists, valid: false, running: false, responsive: false, state };
+  }
+  const running = (opts.pidAlive ?? isPidAlive)(state.pid);
+  return {
+    exists,
+    valid: true,
+    running,
+    responsive: running && (opts.nowMs ?? Date.now()) - state.heartbeatAtMs <= OBSERVER_HEARTBEAT_STALE_MS,
+    state
+  };
+}
+function createInitialObserverState(opts = {}) {
+  const nowMs = opts.nowMs ?? Date.now();
+  return {
+    schemaVersion: OBSERVER_STATE_SCHEMA_VERSION,
+    service: OBSERVER_SERVICE_NAME,
+    pid: process.pid,
+    port: opts.port ?? FML_OBSERVER_PORT,
+    instanceId: randomUUID2(),
+    startedAtMs: nowMs,
+    heartbeatAtMs: nowMs,
+    phase: "starting",
+    processIdentity: getCurrentProcessIdentity() ?? void 0
+  };
+}
+function serializeState(state) {
+  return `${JSON.stringify(state, null, 2)}
+`;
+}
+var ObserverStateMutationBusyError = class extends Error {
+  constructor() {
+    super("observer lease mutation is already in progress");
+    this.name = "ObserverStateMutationBusyError";
+  }
+};
+function parseObserverLeaseOwner(value) {
+  try {
+    const parsed = JSON.parse(value);
+    return typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && typeof parsed.instanceId === "string" && parsed.instanceId.length > 0 ? { pid: parsed.pid, instanceId: parsed.instanceId } : null;
+  } catch {
+    return null;
+  }
+}
+function readObserverLeaseOwner(lockFile = FML_OBSERVER_LOCK_FILE) {
+  try {
+    return parseObserverLeaseOwner(fs3.readFileSync(lockFile, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function inspectObserverFile(file) {
+  try {
+    return {
+      raw: fs3.readFileSync(file, "utf8"),
+      exists: true,
+      busy: false
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { raw: null, exists: false, busy: false };
+    }
+    if (isTransientObserverFileError(error)) {
+      return { raw: null, exists: true, busy: true };
+    }
+    throw error;
+  }
+}
+function inspectObserverLease(opts = {}) {
+  const stateResult = inspectObserverFile(
+    opts.stateFile ?? FML_OBSERVER_STATE_FILE
+  );
+  const lockResult = inspectObserverFile(
+    opts.lockFile ?? FML_OBSERVER_LOCK_FILE
+  );
+  let state = null;
+  if (stateResult.raw !== null) {
+    try {
+      state = parseObserverState(JSON.parse(stateResult.raw));
+    } catch {
+      state = null;
+    }
+  }
+  return {
+    state,
+    owner: lockResult.raw === null ? null : parseObserverLeaseOwner(lockResult.raw),
+    stateExists: stateResult.exists,
+    lockExists: lockResult.exists,
+    stateBusy: stateResult.busy,
+    lockBusy: lockResult.busy,
+    busy: stateResult.busy || lockResult.busy
+  };
+}
+function observerLeaseIsOwned(instanceId, lockFile = FML_OBSERVER_LOCK_FILE) {
+  return readObserverLeaseOwner(lockFile)?.instanceId === instanceId;
+}
+function getProcessIdentity(pid) {
+  try {
+    if (process.platform === "linux") {
+      const stat = fs3.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const fieldsAfterCommand = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const startTimeTicks = fieldsAfterCommand[19];
+      return startTimeTicks ? `linux:${startTimeTicks}` : null;
+    }
+    if (process.platform === "darwin") {
+      const startedAt = execFileSync(
+        "ps",
+        ["-p", String(pid), "-o", "lstart="],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 1e3
+        }
+      ).trim();
+      return startedAt ? `darwin:${startedAt}` : null;
+    }
+    if (process.platform === "win32") {
+      const startedAt = execFileSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().Ticks`
+        ],
+        {
+          encoding: "utf8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 1e3
+        }
+      ).trim();
+      return startedAt ? `win32:${startedAt}` : null;
+    }
+  } catch {
+  }
+  return null;
+}
+var currentProcessIdentityCache;
+function getCurrentProcessIdentity() {
+  if (currentProcessIdentityCache === void 0) {
+    currentProcessIdentityCache = getProcessIdentity(process.pid);
+  }
+  return currentProcessIdentityCache;
+}
+function parseObserverReclaimGuardOwner(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || typeof parsed.instanceId !== "string" || parsed.instanceId.length === 0 || typeof parsed.guardId !== "string" || parsed.guardId.length === 0 || typeof parsed.createdAtMs !== "number" || parsed.processIdentity !== void 0 && typeof parsed.processIdentity !== "string" || parsed.processNonce !== void 0 && typeof parsed.processNonce !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isTransientObserverFileError(error) {
+  const code = error?.code;
+  return code !== void 0 && TRANSIENT_OBSERVER_FILE_ERROR_CODES.has(code);
+}
+function readObserverMutationFile(file) {
+  try {
+    return fs3.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    if (isTransientObserverFileError(error)) {
+      throw new ObserverStateMutationBusyError();
+    }
+    throw error;
+  }
+}
+function readObserverStateForMutation(stateFile) {
+  const raw = readObserverMutationFile(stateFile);
+  if (raw === null) return null;
+  try {
+    return parseObserverState(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+function assertObserverStateMutationOwnership(instanceId, stateFile, lockFile, errorMessage) {
+  const leaseOwner = readObserverMutationFile(lockFile);
+  if (leaseOwner === null || parseObserverLeaseOwner(leaseOwner)?.instanceId !== instanceId) {
+    throw new Error(errorMessage);
+  }
+  if (readObserverStateForMutation(stateFile)?.instanceId !== instanceId) {
+    throw new Error(errorMessage);
+  }
+}
+function isRetryableReclaimGuardRace(error) {
+  return error.code === "ENOENT" || isTransientObserverFileError(error);
+}
+function removeReclaimTombstone(tombstone) {
+  try {
+    fs3.rmSync(tombstone, { force: true });
+  } catch (error) {
+    if (!isRetryableReclaimGuardRace(error)) throw error;
+  }
+}
+function restoreDisplacedReclaimGuard(tombstone, reclaimFile, fallbackRaw) {
+  let canonicalReserved = false;
+  let tombstoneRestored = false;
+  let fallbackPublished = false;
+  try {
+    fs3.linkSync(tombstone, reclaimFile);
+    canonicalReserved = true;
+    tombstoneRestored = true;
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      canonicalReserved = true;
+    } else if (!isRetryableReclaimGuardRace(error)) {
+      throw error;
+    }
+  }
+  if (!canonicalReserved) {
+    try {
+      fs3.copyFileSync(tombstone, reclaimFile, fs3.constants.COPYFILE_EXCL);
+      canonicalReserved = true;
+      tombstoneRestored = true;
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        canonicalReserved = true;
+      } else if (!isRetryableReclaimGuardRace(error)) {
+        throw error;
+      }
+    }
+  }
+  if (!canonicalReserved) {
+    let fd;
+    try {
+      fd = fs3.openSync(reclaimFile, "wx", 384);
+      canonicalReserved = true;
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        canonicalReserved = true;
+      } else if (isTransientObserverFileError(error)) {
+        return false;
+      } else {
+        throw error;
+      }
+      fd = -1;
+    }
+    if (fd >= 0) {
+      let publicationError;
+      try {
+        fs3.writeFileSync(fd, fallbackRaw ?? "");
+      } catch (error) {
+        publicationError = error;
+      }
+      try {
+        fs3.closeSync(fd);
+      } catch (error) {
+        if (publicationError === void 0 || !isTransientObserverFileError(error)) {
+          publicationError = error;
+        }
+      }
+      if (publicationError !== void 0 && !isTransientObserverFileError(publicationError)) {
+        throw publicationError;
+      }
+      fallbackPublished = publicationError === void 0 && fallbackRaw !== void 0;
+    }
+  }
+  if (canonicalReserved && (fallbackPublished || tombstoneRestored)) {
+    removeReclaimTombstone(tombstone);
+  }
+  return canonicalReserved;
+}
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function removeCreatedFileByIdentity(file, created) {
+  let observed;
+  try {
+    observed = fs3.statSync(file);
+  } catch (error) {
+    if (!isRetryableReclaimGuardRace(error)) throw error;
+    return error.code === "ENOENT";
+  }
+  if (!sameFileIdentity(observed, created)) return true;
+  const tombstone = `${file}.failed-${process.pid}-${randomUUID2()}`;
+  try {
+    fs3.renameSync(file, tombstone);
+  } catch (error) {
+    if (!isRetryableReclaimGuardRace(error)) throw error;
+    return error.code === "ENOENT";
+  }
+  let displaced;
+  try {
+    displaced = fs3.statSync(tombstone);
+  } catch (error) {
+    if (!isRetryableReclaimGuardRace(error)) throw error;
+    return restoreDisplacedReclaimGuard(tombstone, file);
+  }
+  let displacedRaw;
+  try {
+    displacedRaw = fs3.readFileSync(tombstone, "utf8");
+  } catch (error) {
+    if (!isRetryableReclaimGuardRace(error)) throw error;
+  }
+  if (sameFileIdentity(displaced, created)) {
+    removeReclaimTombstone(tombstone);
+    return true;
+  }
+  return restoreDisplacedReclaimGuard(tombstone, file, displacedRaw);
+}
+function rewriteExclusiveFileBody(fd, contents) {
+  const body = Buffer.from(contents, "utf8");
+  fs3.ftruncateSync(fd, 0);
+  let offset = 0;
+  while (offset < body.length) {
+    const written = fs3.writeSync(
+      fd,
+      body,
+      offset,
+      body.length - offset,
+      offset
+    );
+    if (written === 0) {
+      throw Object.assign(
+        new Error("observer guard rewrite made no progress"),
+        {
+          code: "EBUSY"
+        }
+      );
+    }
+    offset += written;
+  }
+}
+function publishExclusiveLease(lockFile, serializedOwner) {
+  const stagingFile = `${lockFile}.${process.pid}.${randomUUID2()}.tmp`;
+  let fd = null;
+  let staged = null;
+  let publicationError;
+  try {
+    fd = fs3.openSync(stagingFile, "wx", 384);
+    fs3.writeFileSync(fd, serializedOwner);
+    fs3.fsyncSync(fd);
+    staged = fs3.fstatSync(fd);
+    const stagedFd = fd;
+    fd = null;
+    fs3.closeSync(stagedFd);
+    try {
+      fs3.linkSync(stagingFile, lockFile);
+    } catch (error) {
+      if (error.code === "EEXIST") return null;
+      let linkedDespiteError = false;
+      try {
+        const published2 = fs3.statSync(lockFile);
+        linkedDespiteError = sameFileIdentity(published2, staged) && fs3.readFileSync(lockFile, "utf8") === serializedOwner;
+      } catch {
+      }
+      if (!linkedDespiteError) {
+        const code = error.code;
+        if (code !== void 0 && EXCLUSIVE_LINK_UNSUPPORTED_ERROR_CODES.has(code)) {
+          throw new Error(
+            `The filesystem containing ${lockFile} does not support atomic FML observer leases; choose an FML state or observer directory on a filesystem with hard-link support`,
+            { cause: error }
+          );
+        }
+        throw error;
+      }
+    }
+    const published = fs3.statSync(lockFile);
+    if (fs3.readFileSync(lockFile, "utf8") !== serializedOwner) {
+      try {
+        removeCreatedFileByIdentity(lockFile, published);
+      } catch {
+      }
+      throw new Error(`FML observer lease publication was incomplete`);
+    }
+    return published;
+  } catch (error) {
+    publicationError = error;
+    throw error;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs3.closeSync(fd);
+      } catch (closeError) {
+        if (publicationError === void 0) throw closeError;
+      }
+    }
+    try {
+      fs3.rmSync(stagingFile, { force: true });
+    } catch {
+    }
+  }
+}
+function ownsReclaimGuard(reclaimFile, guardId) {
+  try {
+    return parseObserverReclaimGuardOwner(fs3.readFileSync(reclaimFile, "utf8"))?.guardId === guardId;
+  } catch {
+    return false;
+  }
+}
+function ownsReclaimGuardForMutation(reclaimFile, guardId) {
+  const raw = readObserverMutationFile(reclaimFile);
+  return raw !== null && parseObserverReclaimGuardOwner(raw)?.guardId === guardId;
+}
+function writeLeaseAndState(state, stateFile, lockFile, reclaimFile, reclaimGuardId) {
+  const serializedOwner = `${JSON.stringify({
+    pid: state.pid,
+    instanceId: state.instanceId
+  })}
+`;
+  const created = publishExclusiveLease(lockFile, serializedOwner);
+  if (!created) return false;
+  if (!ownsReclaimGuard(reclaimFile, reclaimGuardId) || !observerLeaseIsOwned(state.instanceId, lockFile)) {
+    removeCreatedFileByIdentity(lockFile, created);
+    return false;
+  }
+  try {
+    writeObserverState(state, stateFile);
+  } catch (error) {
+    try {
+      removeCreatedFileByIdentity(lockFile, created);
+    } catch {
+    }
+    throw error;
+  }
+  const coherent = ownsReclaimGuard(reclaimFile, reclaimGuardId) && observerLeaseIsOwned(state.instanceId, lockFile) && readObserverState(stateFile)?.instanceId === state.instanceId;
+  if (!coherent) {
+    try {
+      removeCreatedFileByIdentity(lockFile, created);
+    } catch {
+    }
+  }
+  return coherent;
+}
+function leaseCanBeReclaimed(opts) {
+  const owner = parseObserverLeaseOwner(opts.rawOwner);
+  if (!owner) {
+    if (opts.liveOwnerPolicy === "process_identity") {
+      return false;
+    }
+    return opts.nowMs - opts.lockMtimeMs >= OBSERVER_RECLAIM_GUARD_STALE_MS;
+  }
+  if (!opts.pidAlive(owner.pid)) return true;
+  const ownerState = readObserverState(opts.stateFile);
+  if (opts.liveOwnerPolicy === "process_identity") {
+    if (ownerState?.pid !== owner.pid || ownerState.instanceId !== owner.instanceId) {
+      return false;
+    }
+    if (ownerState.processIdentity === void 0) {
+      return false;
+    }
+    const currentIdentity = opts.processIdentity(owner.pid);
+    return currentIdentity !== null && currentIdentity !== ownerState.processIdentity;
+  }
+  if (ownerState?.pid === owner.pid && ownerState.instanceId === owner.instanceId) {
+    return opts.nowMs - ownerState.heartbeatAtMs > OBSERVER_HEARTBEAT_STALE_MS;
+  }
+  return opts.nowMs - opts.lockMtimeMs > OBSERVER_HEARTBEAT_STALE_MS;
+}
+function acquireReclaimGuard(owner, reclaimFile, nowMs, opts = {}) {
+  const guardId = randomUUID2();
+  const processIdentity = opts.processIdentity ?? ((pid) => pid === process.pid ? getCurrentProcessIdentity() : getProcessIdentity(pid));
+  let recoveryAttempts = 0;
+  let raceRetries = 0;
+  while (recoveryAttempts < MAX_RECLAIM_GUARD_RECOVERIES && raceRetries <= MAX_RECLAIM_GUARD_RACE_RETRIES) {
+    try {
+      const fd = fs3.openSync(reclaimFile, "wx", 384);
+      let created = null;
+      const serializedGuard = `${JSON.stringify({
+        pid: process.pid,
+        instanceId: owner.instanceId,
+        guardId,
+        createdAtMs: nowMs,
+        processIdentity: processIdentity(process.pid) ?? void 0,
+        processNonce: reclaimProcessNonce
+      })}
+`;
+      let publicationError;
+      let publicationFailed = false;
+      let cleanupBlocked = false;
+      try {
+        created = fs3.fstatSync(fd);
+        fs3.writeFileSync(fd, serializedGuard);
+      } catch (error) {
+        if (isTransientObserverFileError(error)) {
+          try {
+            rewriteExclusiveFileBody(fd, serializedGuard);
+          } catch (retryError) {
+            publicationFailed = true;
+            publicationError = retryError;
+          }
+        } else {
+          publicationFailed = true;
+          publicationError = error;
+        }
+        if (publicationFailed && created) {
+          try {
+            cleanupBlocked = !removeCreatedFileByIdentity(reclaimFile, created);
+          } catch (cleanupError) {
+            publicationError = cleanupError;
+          }
+        }
+      }
+      let displacedAfterPublication = false;
+      if (!publicationFailed) {
+        try {
+          displacedAfterPublication = parseObserverReclaimGuardOwner(fs3.readFileSync(reclaimFile, "utf8"))?.guardId !== guardId;
+        } catch (error) {
+          if (error.code === "ENOENT") {
+            displacedAfterPublication = true;
+          } else {
+            publicationFailed = true;
+            publicationError = error;
+            if (isTransientObserverFileError(error) && created) {
+              try {
+                cleanupBlocked = !removeCreatedFileByIdentity(
+                  reclaimFile,
+                  created
+                );
+              } catch (cleanupError) {
+                publicationError = cleanupError;
+              }
+            }
+          }
+        }
+      }
+      try {
+        fs3.closeSync(fd);
+      } catch (error) {
+        if (!publicationFailed) publicationError = error;
+        publicationFailed = true;
+      }
+      if (publicationFailed) {
+        if (cleanupBlocked) return null;
+        if (isTransientObserverFileError(publicationError)) {
+          if (ownsReclaimGuard(reclaimFile, guardId)) {
+            activeReclaimGuardIds.add(guardId);
+            return guardId;
+          }
+          raceRetries += 1;
+          continue;
+        }
+        throw publicationError;
+      }
+      if (displacedAfterPublication) return null;
+      activeReclaimGuardIds.add(guardId);
+      return guardId;
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        if (isTransientObserverFileError(error)) return null;
+        throw error;
+      }
+      let observedRaw;
+      let observed;
+      try {
+        observedRaw = fs3.readFileSync(reclaimFile, "utf8");
+        observed = fs3.statSync(reclaimFile);
+      } catch (readError) {
+        if (readError.code === "ENOENT") {
+          raceRetries += 1;
+          continue;
+        }
+        if (isTransientObserverFileError(readError)) return null;
+        throw readError;
+      }
+      const observedOwner = parseObserverReclaimGuardOwner(observedRaw);
+      if (observedOwner) {
+        const alive = (opts.pidAlive ?? isPidAlive)(observedOwner.pid);
+        const abandonedByThisProcess = observedOwner.processNonce === reclaimProcessNonce && !activeReclaimGuardIds.has(observedOwner.guardId);
+        if (alive && !abandonedByThisProcess) {
+          const currentIdentity = observedOwner.processIdentity === void 0 ? null : processIdentity(observedOwner.pid);
+          if (currentIdentity !== null && currentIdentity === observedOwner.processIdentity) {
+            return null;
+          }
+          if (currentIdentity === null && nowMs - observedOwner.createdAtMs < OBSERVER_RECLAIM_GUARD_UNVERIFIED_TTL_MS) {
+            return null;
+          }
+        }
+      } else if (nowMs - observed.mtimeMs < OBSERVER_RECLAIM_GUARD_STALE_MS) {
+        return null;
+      }
+      const tombstone = `${reclaimFile}.stale-${process.pid}-${randomUUID2()}`;
+      try {
+        fs3.renameSync(reclaimFile, tombstone);
+      } catch (renameError) {
+        if (renameError.code === "ENOENT") {
+          raceRetries += 1;
+          continue;
+        }
+        if (isTransientObserverFileError(renameError)) return null;
+        throw renameError;
+      }
+      recoveryAttempts += 1;
+      let displacedRaw;
+      try {
+        displacedRaw = fs3.readFileSync(tombstone, "utf8");
+      } catch (error2) {
+        if (!isRetryableReclaimGuardRace(error2)) throw error2;
+        restoreDisplacedReclaimGuard(tombstone, reclaimFile, observedRaw);
+        return null;
+      }
+      let displaced;
+      try {
+        displaced = fs3.statSync(tombstone);
+      } catch (error2) {
+        if (!isRetryableReclaimGuardRace(error2)) throw error2;
+        restoreDisplacedReclaimGuard(tombstone, reclaimFile, displacedRaw);
+        return null;
+      }
+      if (displacedRaw !== observedRaw || displaced.dev !== observed.dev || displaced.ino !== observed.ino || displaced.mtimeMs !== observed.mtimeMs || !observedOwner && nowMs - displaced.mtimeMs < OBSERVER_RECLAIM_GUARD_STALE_MS) {
+        restoreDisplacedReclaimGuard(tombstone, reclaimFile, displacedRaw);
+        return null;
+      }
+      removeReclaimTombstone(tombstone);
+    }
+  }
+  return null;
+}
+function releaseReclaimGuard(reclaimFile, guardId) {
+  try {
+    let observedRaw;
+    let observed;
+    try {
+      observedRaw = fs3.readFileSync(reclaimFile, "utf8");
+      observed = fs3.statSync(reclaimFile);
+    } catch (error) {
+      if (error.code === "ENOENT" || isTransientObserverFileError(error)) {
+        return;
+      }
+      throw error;
+    }
+    if (parseObserverReclaimGuardOwner(observedRaw)?.guardId !== guardId) {
+      return;
+    }
+    const tombstone = `${reclaimFile}.release-${process.pid}-${randomUUID2()}`;
+    fs3.renameSync(reclaimFile, tombstone);
+    let displacedRaw;
+    try {
+      displacedRaw = fs3.readFileSync(tombstone, "utf8");
+    } catch (error) {
+      if (!isRetryableReclaimGuardRace(error)) throw error;
+      restoreDisplacedReclaimGuard(tombstone, reclaimFile, observedRaw);
+      return;
+    }
+    let displaced;
+    try {
+      displaced = fs3.statSync(tombstone);
+    } catch (error) {
+      if (!isRetryableReclaimGuardRace(error)) throw error;
+      restoreDisplacedReclaimGuard(tombstone, reclaimFile, displacedRaw);
+      return;
+    }
+    if (displacedRaw !== observedRaw || displaced.dev !== observed.dev || displaced.ino !== observed.ino || displaced.mtimeMs !== observed.mtimeMs) {
+      restoreDisplacedReclaimGuard(tombstone, reclaimFile, displacedRaw);
+      return;
+    }
+    removeReclaimTombstone(tombstone);
+  } catch (error) {
+    if (error.code !== "ENOENT" && !isTransientObserverFileError(error)) {
+      throw error;
+    }
+  } finally {
+    activeReclaimGuardIds.delete(guardId);
+  }
+}
+function claimObserverState(state, opts = {}) {
+  const stateFile = opts.stateFile ?? FML_OBSERVER_STATE_FILE;
+  const lockFile = opts.lockFile ?? FML_OBSERVER_LOCK_FILE;
+  fs3.mkdirSync(path4.dirname(lockFile), { recursive: true, mode: 448 });
+  const nowMs = opts.nowMs ?? Date.now();
+  const reclaimFile = `${lockFile}.reclaim`;
+  let initialPublicationRetries = 0;
+  while (!fs3.existsSync(lockFile)) {
+    const initialGuardId = acquireReclaimGuard(state, reclaimFile, nowMs, {
+      pidAlive: opts.pidAlive,
+      processIdentity: opts.processIdentity
+    });
+    if (!initialGuardId) return false;
+    let retryPublication = false;
+    try {
+      try {
+        if (writeLeaseAndState(
+          state,
+          stateFile,
+          lockFile,
+          reclaimFile,
+          initialGuardId
+        )) {
+          return true;
+        }
+      } catch (error) {
+        if (!isTransientObserverFileError(error) || initialPublicationRetries >= MAX_INITIAL_STATE_PUBLICATION_RETRIES) {
+          throw error;
+        }
+        initialPublicationRetries += 1;
+        retryPublication = true;
+      }
+    } finally {
+      releaseReclaimGuard(reclaimFile, initialGuardId);
+    }
+    if (!retryPublication) break;
+  }
+  let observedRaw;
+  let observedStat;
+  try {
+    observedRaw = fs3.readFileSync(lockFile, "utf8");
+    observedStat = fs3.statSync(lockFile);
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  const reclaimable = leaseCanBeReclaimed({
+    rawOwner: observedRaw,
+    lockMtimeMs: observedStat.mtimeMs,
+    stateFile,
+    nowMs,
+    pidAlive: opts.pidAlive ?? isPidAlive,
+    processIdentity: opts.processIdentity ?? getProcessIdentity,
+    liveOwnerPolicy: opts.liveOwnerPolicy ?? "heartbeat"
+  });
+  if (!reclaimable) return false;
+  const reclaimGuardId = acquireReclaimGuard(state, reclaimFile, nowMs, {
+    pidAlive: opts.pidAlive,
+    processIdentity: opts.processIdentity
+  });
+  if (!reclaimGuardId) return false;
+  try {
+    const currentRaw = fs3.readFileSync(lockFile, "utf8");
+    const currentStat = fs3.statSync(lockFile);
+    if (!ownsReclaimGuard(reclaimFile, reclaimGuardId) || currentRaw !== observedRaw || currentStat.dev !== observedStat.dev || currentStat.ino !== observedStat.ino || currentStat.mtimeMs !== observedStat.mtimeMs || !leaseCanBeReclaimed({
+      rawOwner: currentRaw,
+      lockMtimeMs: currentStat.mtimeMs,
+      stateFile,
+      nowMs,
+      pidAlive: opts.pidAlive ?? isPidAlive,
+      processIdentity: opts.processIdentity ?? getProcessIdentity,
+      liveOwnerPolicy: opts.liveOwnerPolicy ?? "heartbeat"
+    })) {
+      return false;
+    }
+    fs3.unlinkSync(lockFile);
+    return writeLeaseAndState(
+      state,
+      stateFile,
+      lockFile,
+      reclaimFile,
+      reclaimGuardId
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  } finally {
+    releaseReclaimGuard(reclaimFile, reclaimGuardId);
+  }
+}
+function writeObserverState(state, stateFile = FML_OBSERVER_STATE_FILE) {
+  fs3.mkdirSync(path4.dirname(stateFile), { recursive: true, mode: 448 });
+  const tempFile = `${stateFile}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    fs3.writeFileSync(tempFile, serializeState(state), { mode: 384 });
+    fs3.renameSync(tempFile, stateFile);
+  } catch (error) {
+    try {
+      fs3.rmSync(tempFile, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+  try {
+    fs3.chmodSync(stateFile, 384);
+  } catch {
+  }
+}
+function updateObserverState(state, update, stateFile = FML_OBSERVER_STATE_FILE, lockFile = FML_OBSERVER_LOCK_FILE) {
+  const reclaimFile = `${lockFile}.reclaim`;
+  const reclaimGuardId = acquireReclaimGuard(state, reclaimFile, Date.now());
+  if (!reclaimGuardId) {
+    assertObserverStateMutationOwnership(
+      state.instanceId,
+      stateFile,
+      lockFile,
+      "observer lease ownership was lost"
+    );
+    throw new ObserverStateMutationBusyError();
+  }
+  try {
+    assertObserverStateMutationOwnership(
+      state.instanceId,
+      stateFile,
+      lockFile,
+      "observer lease ownership was lost"
+    );
+    if (!ownsReclaimGuardForMutation(reclaimFile, reclaimGuardId)) {
+      throw new ObserverStateMutationBusyError();
+    }
+    const next = { ...state, ...update };
+    try {
+      writeObserverState(next, stateFile);
+    } catch (error) {
+      if (isTransientObserverFileError(error)) {
+        assertObserverStateMutationOwnership(
+          state.instanceId,
+          stateFile,
+          lockFile,
+          "observer lease ownership was lost during state update"
+        );
+        if (!ownsReclaimGuardForMutation(reclaimFile, reclaimGuardId)) {
+          throw new ObserverStateMutationBusyError();
+        }
+        throw new ObserverStateMutationBusyError();
+      }
+      throw error;
+    }
+    assertObserverStateMutationOwnership(
+      state.instanceId,
+      stateFile,
+      lockFile,
+      "observer lease ownership was lost during state update"
+    );
+    if (!ownsReclaimGuardForMutation(reclaimFile, reclaimGuardId)) {
+      throw new ObserverStateMutationBusyError();
+    }
+    return next;
+  } finally {
+    releaseReclaimGuard(reclaimFile, reclaimGuardId);
+  }
+}
+function removeObserverStateIfOwned(instanceId, opts = {}) {
+  const stateFile = opts.stateFile ?? FML_OBSERVER_STATE_FILE;
+  const lockFile = opts.lockFile ?? FML_OBSERVER_LOCK_FILE;
+  const reclaimFile = `${lockFile}.reclaim`;
+  const reclaimGuardId = acquireReclaimGuard(
+    { pid: process.pid, instanceId },
+    reclaimFile,
+    Date.now()
+  );
+  if (!reclaimGuardId) {
+    return;
+  }
+  try {
+    if (!ownsReclaimGuard(reclaimFile, reclaimGuardId) || !observerLeaseIsOwned(instanceId, lockFile) || readObserverState(stateFile)?.instanceId !== instanceId) {
+      return;
+    }
+    fs3.rmSync(stateFile, { force: true });
+    if (ownsReclaimGuard(reclaimFile, reclaimGuardId) && observerLeaseIsOwned(instanceId, lockFile)) {
+      fs3.rmSync(lockFile, { force: true });
+    }
+  } finally {
+    releaseReclaimGuard(reclaimFile, reclaimGuardId);
+  }
+}
+
+// src/hooks/inbox.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import fs4 from "fs";
+import path5 from "path";
 
 // src/hooks/inbox-config.ts
 var BYTE_SUFFIXES = {
@@ -3311,7 +4251,8 @@ var BYTE_SUFFIXES = {
 var MAX_BYTES_PATTERN = /^([1-9]\d*)(b|kib|mib|gib)?$/i;
 var POSITIVE_INTEGER_PATTERN = /^[1-9]\d*$/;
 var DEFAULT_HOOK_INBOX_MAX_BYTES = 512 * 1024 * 1024;
-var DEFAULT_HOOK_INBOX_MAX_ENTRIES = 1e4;
+var SMALLEST_REALISTIC_HOOK_EVENT_BYTES = 2 * 1024;
+var DEFAULT_HOOK_INBOX_MAX_ENTRIES = DEFAULT_HOOK_INBOX_MAX_BYTES / SMALLEST_REALISTIC_HOOK_EVENT_BYTES;
 function parseHookInboxMaxBytes(configured) {
   if (configured === void 0) return DEFAULT_HOOK_INBOX_MAX_BYTES;
   const value = configured.trim();
@@ -3347,9 +4288,12 @@ function parseHookInboxMaxEntries(configured) {
   }
   return entries;
 }
+function hookInboxEntriesForBytes(maxBytes) {
+  return Math.ceil(maxBytes / SMALLEST_REALISTIC_HOOK_EVENT_BYTES);
+}
 function hookInboxLimitsFromEnv(env = process.env) {
   const maxBytes = parseHookInboxMaxBytes(env.FML_HOOK_INBOX_MAX_BYTES);
-  const maxEntries = parseHookInboxMaxEntries(env.FML_HOOK_INBOX_MAX_ENTRIES);
+  const maxEntries = env.FML_HOOK_INBOX_MAX_ENTRIES === void 0 ? maxBytes === void 0 ? void 0 : hookInboxEntriesForBytes(maxBytes) : parseHookInboxMaxEntries(env.FML_HOOK_INBOX_MAX_ENTRIES);
   return {
     ...maxBytes === void 0 ? {} : { maxBytes },
     ...maxEntries === void 0 ? {} : { maxEntries }
@@ -3360,6 +4304,7 @@ function hookInboxLimitsFromEnv(env = process.env) {
 var HOOK_INBOX_SCHEMA_VERSION = 1;
 var MAX_HOOK_INBOX_ENTRY_BYTES = 16 * 1024 * 1024;
 var MAX_HOOK_INBOX_DRAIN_ENTRIES = 100;
+var DRAIN_YIELD_EVERY_ENTRIES = 25;
 var MAX_HOOK_INBOX_DRAIN_CURSORS = 8;
 var INBOX_ID_PATTERN = /^\d{1,16}-[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var INBOX_TEMP_PATTERN = /^\.(\d{1,16}-[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\.\d+\.[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.tmp$/i;
@@ -3397,7 +4342,7 @@ var HookInboxCapacityError = class extends Error {
     this.reason = reason;
   }
 };
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function validTimestamp(value) {
@@ -3408,7 +4353,7 @@ function validSyncId(value) {
 }
 function parseDestination(value) {
   if (value === void 0) return void 0;
-  if (!isRecord2(value)) return null;
+  if (!isRecord3(value)) return null;
   const { targetUrl, destinationIdentity } = value;
   if (typeof targetUrl !== "string" || targetUrl.length === 0 || Buffer.byteLength(targetUrl, "utf8") > 4096 || typeof destinationIdentity !== "string" || destinationIdentity.length === 0 || Buffer.byteLength(destinationIdentity, "utf8") > 4096) {
     return null;
@@ -3416,7 +4361,7 @@ function parseDestination(value) {
   return { targetUrl, destinationIdentity };
 }
 function parseMetadata(value) {
-  if (!isRecord2(value)) return null;
+  if (!isRecord3(value)) return null;
   if (typeof value.id !== "string" || !INBOX_ID_PATTERN.test(value.id) || !validSyncId(value.syncId) || !validTimestamp(value.capturedAtMs)) {
     return null;
   }
@@ -3441,12 +4386,12 @@ function entryFileName(id) {
   return `${id}.json`;
 }
 function entryPath(inboxDir, id) {
-  return path4.join(inboxDir, entryFileName(id));
+  return path5.join(inboxDir, entryFileName(id));
 }
 function enforceOwnerOnlyDirectory(inboxDir) {
-  fs3.mkdirSync(inboxDir, { recursive: true, mode: 448 });
+  fs4.mkdirSync(inboxDir, { recursive: true, mode: 448 });
   try {
-    fs3.chmodSync(inboxDir, 448);
+    fs4.chmodSync(inboxDir, 448);
   } catch {
   }
 }
@@ -3454,22 +4399,22 @@ function fsyncDirectory(inboxDir) {
   if (process.platform === "win32") return;
   let descriptor;
   try {
-    descriptor = fs3.openSync(inboxDir, "r");
-    fs3.fsyncSync(descriptor);
+    descriptor = fs4.openSync(inboxDir, "r");
+    fs4.fsyncSync(descriptor);
   } catch (error) {
     const code = error.code;
     if (code === void 0 || !UNSUPPORTED_DIRECTORY_FSYNC_CODES.has(code)) {
       throw error;
     }
   } finally {
-    if (descriptor !== void 0) fs3.closeSync(descriptor);
+    if (descriptor !== void 0) fs4.closeSync(descriptor);
   }
 }
 async function fsyncDirectoryAsync(inboxDir) {
   if (process.platform === "win32") return;
   let descriptor;
   try {
-    descriptor = await fs3.promises.open(inboxDir, "r");
+    descriptor = await fs4.promises.open(inboxDir, "r");
     await descriptor.sync();
   } catch (error) {
     const code = error.code;
@@ -3502,7 +4447,7 @@ function parseNullablePositiveInteger(value) {
 }
 function parsePendingCapacityMutation(value) {
   if (value === void 0) return void 0;
-  if (!isRecord2(value)) return null;
+  if (!isRecord3(value)) return null;
   if (typeof value.fileName !== "string" || !value.fileName.endsWith(".json") || !INBOX_ID_PATTERN.test(value.fileName.slice(0, -5)) || !nonNegativeInteger(value.bytes) || !validTimestamp(value.startedAtMs)) {
     return null;
   }
@@ -3523,7 +4468,7 @@ function parsePendingCapacityMutation(value) {
   };
 }
 function parseCapacityState(value) {
-  if (!isRecord2(value) || value.schemaVersion !== CAPACITY_STATE_SCHEMA_VERSION || !nonNegativeInteger(value.pendingEntries) || !nonNegativeInteger(value.pendingBytes) || !nonNegativeInteger(value.rejectedEntries) || !nonNegativeInteger(value.rejectedBytes)) {
+  if (!isRecord3(value) || value.schemaVersion !== CAPACITY_STATE_SCHEMA_VERSION || !nonNegativeInteger(value.pendingEntries) || !nonNegativeInteger(value.pendingBytes) || !nonNegativeInteger(value.rejectedEntries) || !nonNegativeInteger(value.rejectedBytes)) {
     return null;
   }
   const maxEntries = parseNullablePositiveInteger(value.maxEntries);
@@ -3536,28 +4481,33 @@ function parseCapacityState(value) {
   const lastRejectionReason = parseCapacityRejectionReason(
     value.lastRejectionReason
   );
+  const lostEntries = nonNegativeInteger(value.lostEntries) ? value.lostEntries : 0;
+  const lostBytes = nonNegativeInteger(value.lostBytes) ? value.lostBytes : 0;
   return {
     schemaVersion: CAPACITY_STATE_SCHEMA_VERSION,
     pendingEntries: value.pendingEntries,
     pendingBytes: value.pendingBytes,
     rejectedEntries: value.rejectedEntries,
     rejectedBytes: value.rejectedBytes,
+    lostEntries,
+    lostBytes,
     maxEntries,
     maxBytes,
     ...validTimestamp(value.lastRejectedAtMs) ? { lastRejectedAtMs: value.lastRejectedAtMs } : {},
     ...lastRejectionReason === void 0 ? {} : { lastRejectionReason },
+    ...validTimestamp(value.lastLostAtMs) ? { lastLostAtMs: value.lastLostAtMs } : {},
     ...pendingPersist === void 0 ? {} : { pendingPersist },
     ...pendingRemoval === void 0 ? {} : { pendingRemoval }
   };
 }
 function capacityStatePath(inboxDir) {
-  return path4.join(inboxDir, CAPACITY_STATE_FILE);
+  return path5.join(inboxDir, CAPACITY_STATE_FILE);
 }
 function readCapacityStateFile(inboxDir) {
   try {
     return parseCapacityState(
       JSON.parse(
-        fs3.readFileSync(capacityStatePath(inboxDir), "utf8")
+        fs4.readFileSync(capacityStatePath(inboxDir), "utf8")
       )
     );
   } catch {
@@ -3571,6 +4521,8 @@ function defaultCapacityState(limits, pendingEntries, pendingBytes) {
     pendingBytes,
     rejectedEntries: 0,
     rejectedBytes: 0,
+    lostEntries: 0,
+    lostBytes: 0,
     maxEntries: limits.maxEntries ?? null,
     maxBytes: limits.maxBytes ?? null
   };
@@ -3579,26 +4531,26 @@ function writeCapacityState(inboxDir, state, capacityLock) {
   enforceOwnerOnlyDirectory(inboxDir);
   capacityLock.assertOwned();
   const destination = capacityStatePath(inboxDir);
-  const temporary = path4.join(
+  const temporary = path5.join(
     inboxDir,
-    `${CAPACITY_STATE_FILE}.${process.pid}.${randomUUID2()}.tmp`
+    `${CAPACITY_STATE_FILE}.${process.pid}.${randomUUID3()}.tmp`
   );
   let descriptor;
   try {
-    descriptor = fs3.openSync(temporary, "wx", 384);
-    fs3.writeFileSync(descriptor, `${JSON.stringify(state)}
+    descriptor = fs4.openSync(temporary, "wx", 384);
+    fs4.writeFileSync(descriptor, `${JSON.stringify(state)}
 `, "utf8");
-    fs3.fsyncSync(descriptor);
+    fs4.fsyncSync(descriptor);
     capacityLock.assertOwned();
-    fs3.closeSync(descriptor);
+    fs4.closeSync(descriptor);
     descriptor = void 0;
-    fs3.renameSync(temporary, destination);
+    fs4.renameSync(temporary, destination);
     fsyncDirectory(inboxDir);
     capacityLock.assertOwned();
   } catch (error) {
-    if (descriptor !== void 0) fs3.closeSync(descriptor);
+    if (descriptor !== void 0) fs4.closeSync(descriptor);
     try {
-      fs3.rmSync(temporary, { force: true });
+      fs4.rmSync(temporary, { force: true });
     } catch {
     }
     throw error;
@@ -3606,19 +4558,19 @@ function writeCapacityState(inboxDir, state, capacityLock) {
 }
 function capacityLockIsOwned(lockPath, descriptor, ownerToken) {
   try {
-    const openStat = fs3.fstatSync(descriptor);
-    const pathStat = fs3.statSync(lockPath);
+    const openStat = fs4.fstatSync(descriptor);
+    const pathStat = fs4.statSync(lockPath);
     if (openStat.dev !== pathStat.dev || openStat.ino !== pathStat.ino) {
       return false;
     }
-    const value = JSON.parse(fs3.readFileSync(lockPath, "utf8"));
-    return isRecord2(value) && value.ownerToken === ownerToken;
+    const value = JSON.parse(fs4.readFileSync(lockPath, "utf8"));
+    return isRecord3(value) && value.ownerToken === ownerToken;
   } catch {
     return false;
   }
 }
 function parseCapacityLockOwner(value) {
-  if (!isRecord2(value) || typeof value.ownerToken !== "string" || value.ownerToken.length === 0 || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0 || !validTimestamp(value.createdAtMs)) {
+  if (!isRecord3(value) || typeof value.ownerToken !== "string" || value.ownerToken.length === 0 || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0 || !validTimestamp(value.createdAtMs)) {
     return null;
   }
   return {
@@ -3630,7 +4582,7 @@ function parseCapacityLockOwner(value) {
 function readCapacityLockOwner(lockPath) {
   try {
     return parseCapacityLockOwner(
-      JSON.parse(fs3.readFileSync(lockPath, "utf8"))
+      JSON.parse(fs4.readFileSync(lockPath, "utf8"))
     );
   } catch {
     return null;
@@ -3648,7 +4600,7 @@ function capacityLockOwnerIsAlive(pid) {
 }
 function restoreMovedCapacityLock(abandonedPath, lockPath) {
   try {
-    fs3.renameSync(abandonedPath, lockPath);
+    fs4.renameSync(abandonedPath, lockPath);
   } catch (error) {
     if (!capacityLockRaceError(error)) throw error;
   }
@@ -3660,7 +4612,7 @@ function capacityLockRaceError(error) {
 function recoverStaleCapacityLock(lockPath, nowMs) {
   let observed;
   try {
-    observed = fs3.statSync(lockPath);
+    observed = fs4.statSync(lockPath);
   } catch (error) {
     if (capacityLockRaceError(error)) return;
     throw error;
@@ -3672,10 +4624,10 @@ function recoverStaleCapacityLock(lockPath, nowMs) {
   if (!beyondStaleHorizon && (!observedOwner || capacityLockOwnerIsAlive(observedOwner.pid))) {
     return;
   }
-  const abandoned = `${lockPath}.stale.${nowMs}.${randomUUID2()}`;
+  const abandoned = `${lockPath}.stale.${nowMs}.${randomUUID3()}`;
   try {
-    fs3.renameSync(lockPath, abandoned);
-    const moved = fs3.statSync(abandoned);
+    fs4.renameSync(lockPath, abandoned);
+    const moved = fs4.statSync(abandoned);
     if (moved.dev !== observed.dev || moved.ino !== observed.ino) {
       restoreMovedCapacityLock(abandoned, lockPath);
       return;
@@ -3687,8 +4639,8 @@ function recoverStaleCapacityLock(lockPath, nowMs) {
       restoreMovedCapacityLock(abandoned, lockPath);
       return;
     }
-    fs3.rmSync(abandoned, { force: true });
-    fsyncDirectory(path4.dirname(lockPath));
+    fs4.rmSync(abandoned, { force: true });
+    fsyncDirectory(path5.dirname(lockPath));
   } catch (error) {
     if (!capacityLockRaceError(error)) throw error;
   }
@@ -3699,21 +4651,21 @@ function sleepSync(milliseconds) {
 }
 function acquireCapacityLock(inboxDir, waitMs = CAPACITY_LOCK_WAIT_MS) {
   enforceOwnerOnlyDirectory(inboxDir);
-  const lockPath = path4.join(inboxDir, CAPACITY_LOCK_FILE);
+  const lockPath = path5.join(inboxDir, CAPACITY_LOCK_FILE);
   const deadlineMs = Date.now() + Math.max(0, waitMs);
   while (true) {
     let descriptor;
     let ownerToken;
     try {
-      descriptor = fs3.openSync(lockPath, "wx+", 384);
-      ownerToken = randomUUID2();
-      fs3.writeFileSync(
+      descriptor = fs4.openSync(lockPath, "wx+", 384);
+      ownerToken = randomUUID3();
+      fs4.writeFileSync(
         descriptor,
         `${JSON.stringify({ ownerToken, pid: process.pid, createdAtMs: Date.now() })}
 `,
         "utf8"
       );
-      fs3.fsyncSync(descriptor);
+      fs4.fsyncSync(descriptor);
       let released = false;
       const capacityLock = {
         assertOwned() {
@@ -3727,14 +4679,14 @@ function acquireCapacityLock(inboxDir, waitMs = CAPACITY_LOCK_WAIT_MS) {
           let releaseError;
           try {
             if (capacityLockIsOwned(lockPath, descriptor, ownerToken)) {
-              fs3.unlinkSync(lockPath);
+              fs4.unlinkSync(lockPath);
               fsyncDirectory(inboxDir);
             }
           } catch (error) {
             releaseError = error;
           }
           try {
-            fs3.closeSync(descriptor);
+            fs4.closeSync(descriptor);
           } catch (error) {
             releaseError ??= error;
           }
@@ -3747,12 +4699,12 @@ function acquireCapacityLock(inboxDir, waitMs = CAPACITY_LOCK_WAIT_MS) {
       if (descriptor !== void 0) {
         const removeOwnedLock = ownerToken !== void 0 && capacityLockIsOwned(lockPath, descriptor, ownerToken);
         try {
-          fs3.closeSync(descriptor);
+          fs4.closeSync(descriptor);
         } catch {
         }
         if (removeOwnedLock) {
           try {
-            fs3.rmSync(lockPath, { force: true });
+            fs4.rmSync(lockPath, { force: true });
             fsyncDirectory(inboxDir);
           } catch {
           }
@@ -3772,23 +4724,23 @@ function capacityMutationEvidence(inboxDir, pending, includeTemporary) {
   const prefix = `.${id}.`;
   const candidates = [];
   if (includeTemporary && pending.temporaryFileName) {
-    candidates.push(path4.join(inboxDir, pending.temporaryFileName));
+    candidates.push(path5.join(inboxDir, pending.temporaryFileName));
   } else if (includeTemporary) {
     try {
-      for (const name of fs3.readdirSync(inboxDir)) {
+      for (const name of fs4.readdirSync(inboxDir)) {
         if (name.startsWith(prefix) && name.endsWith(".tmp")) {
-          candidates.push(path4.join(inboxDir, name));
+          candidates.push(path5.join(inboxDir, name));
         }
       }
     } catch (error) {
       return error.code === "ENOENT" ? { kind: "missing" } : { kind: "unavailable" };
     }
   }
-  candidates.push(path4.join(inboxDir, fileName));
+  candidates.push(path5.join(inboxDir, fileName));
   let presentBytes;
   for (const candidate of candidates) {
     try {
-      const stat = fs3.lstatSync(candidate);
+      const stat = fs4.lstatSync(candidate);
       if (!stat.isFile() || presentBytes !== void 0) {
         return { kind: "unavailable" };
       }
@@ -3887,7 +4839,7 @@ function removeCapacityTrackedEntry(filePath, inboxDir, expectedBytes, missingIs
     );
     let bytes = expectedBytes;
     try {
-      const stat = fs3.lstatSync(filePath);
+      const stat = fs4.lstatSync(filePath);
       if (!stat.isFile()) return false;
       bytes = stat.size;
     } catch (error) {
@@ -3896,7 +4848,7 @@ function removeCapacityTrackedEntry(filePath, inboxDir, expectedBytes, missingIs
     }
     if (bytes === void 0) return false;
     const pendingRemoval = {
-      fileName: path4.basename(filePath),
+      fileName: path5.basename(filePath),
       bytes,
       startedAtMs: Date.now()
     };
@@ -3909,7 +4861,7 @@ function removeCapacityTrackedEntry(filePath, inboxDir, expectedBytes, missingIs
     writeCapacityState(inboxDir, state, capacityLock);
     capacityLock.assertOwned();
     try {
-      fs3.unlinkSync(filePath);
+      fs4.unlinkSync(filePath);
     } catch (error) {
       if (error.code !== "ENOENT") {
         try {
@@ -3944,12 +4896,12 @@ function parseRetirementReason(value) {
   return value === "malformed" || value === "terminal_rejected" ? value : void 0;
 }
 function parseRetirementState(value) {
-  if (!isRecord2(value) || value.schemaVersion !== RETIREMENT_STATE_SCHEMA_VERSION || !nonNegativeInteger(value.retiredEntries) || !nonNegativeInteger(value.retiredBytes)) {
+  if (!isRecord3(value) || value.schemaVersion !== RETIREMENT_STATE_SCHEMA_VERSION || !nonNegativeInteger(value.retiredEntries) || !nonNegativeInteger(value.retiredBytes)) {
     return null;
   }
   let pending;
   if (value.pending !== void 0) {
-    if (!isRecord2(value.pending)) return null;
+    if (!isRecord3(value.pending)) return null;
     const reason = parseRetirementReason(value.pending.reason);
     if (typeof value.pending.fileName !== "string" || !value.pending.fileName.endsWith(".json") || !INBOX_ID_PATTERN.test(value.pending.fileName.slice(0, -5)) || !nonNegativeInteger(value.pending.bytes) || !validTimestamp(value.pending.retiredAtMs) || reason === void 0) {
       return null;
@@ -3977,7 +4929,7 @@ function readRetirementState(inboxDir) {
   try {
     return parseRetirementState(
       JSON.parse(
-        fs3.readFileSync(path4.join(inboxDir, RETIREMENT_STATE_FILE), "utf8")
+        fs4.readFileSync(path5.join(inboxDir, RETIREMENT_STATE_FILE), "utf8")
       )
     ) ?? defaultRetirementState();
   } catch {
@@ -3986,25 +4938,25 @@ function readRetirementState(inboxDir) {
 }
 function writeRetirementState(inboxDir, state) {
   enforceOwnerOnlyDirectory(inboxDir);
-  const destination = path4.join(inboxDir, RETIREMENT_STATE_FILE);
-  const temporary = path4.join(
+  const destination = path5.join(inboxDir, RETIREMENT_STATE_FILE);
+  const temporary = path5.join(
     inboxDir,
-    `${RETIREMENT_STATE_FILE}.${process.pid}.${randomUUID2()}.tmp`
+    `${RETIREMENT_STATE_FILE}.${process.pid}.${randomUUID3()}.tmp`
   );
   let descriptor;
   try {
-    descriptor = fs3.openSync(temporary, "wx", 384);
-    fs3.writeFileSync(descriptor, `${JSON.stringify(state)}
+    descriptor = fs4.openSync(temporary, "wx", 384);
+    fs4.writeFileSync(descriptor, `${JSON.stringify(state)}
 `, "utf8");
-    fs3.fsyncSync(descriptor);
-    fs3.closeSync(descriptor);
+    fs4.fsyncSync(descriptor);
+    fs4.closeSync(descriptor);
     descriptor = void 0;
-    fs3.renameSync(temporary, destination);
+    fs4.renameSync(temporary, destination);
     fsyncDirectory(inboxDir);
   } catch (error) {
-    if (descriptor !== void 0) fs3.closeSync(descriptor);
+    if (descriptor !== void 0) fs4.closeSync(descriptor);
     try {
-      fs3.rmSync(temporary, { force: true });
+      fs4.rmSync(temporary, { force: true });
     } catch {
     }
     throw error;
@@ -4014,7 +4966,7 @@ function completePendingRetirement(inboxDir, state) {
   const pending = state.pending;
   if (!pending) return state;
   if (!removeCapacityTrackedEntry(
-    path4.join(inboxDir, pending.fileName),
+    path5.join(inboxDir, pending.fileName),
     inboxDir,
     pending.bytes,
     true
@@ -4043,14 +4995,14 @@ function retireEntry(filePath, reason, inboxDir) {
   if (!current) return false;
   let bytes;
   try {
-    bytes = fs3.lstatSync(filePath).size;
+    bytes = fs4.lstatSync(filePath).size;
   } catch {
     return false;
   }
   const pending = {
     ...current,
     pending: {
-      fileName: path4.basename(filePath),
+      fileName: path5.basename(filePath),
       bytes,
       reason,
       retiredAtMs: Date.now()
@@ -4069,7 +5021,7 @@ function createHookInboxEntry(request, event, destination, persistedAtMs = Date.
     schemaVersion: HOOK_INBOX_SCHEMA_VERSION,
     // File ordering follows the local durable write, not an agent-supplied
     // event timestamp that may be delayed or backdated behind a drain cursor.
-    id: `${persistedAtMs}-${randomUUID2()}`,
+    id: `${persistedAtMs}-${randomUUID3()}`,
     syncId: event.syncId,
     capturedAtMs,
     ...event.repository ? { repository: event.repository } : {},
@@ -4101,9 +5053,9 @@ function persistHookInboxEntry(entry, inboxDir = FML_HOOK_INBOX_DIR, limits = ho
     throw new Error("FML hook inbox admission is busy");
   }
   const destination = entryPath(inboxDir, entry.id);
-  const temporary = path4.join(
+  const temporary = path5.join(
     inboxDir,
-    `.${entry.id}.${process.pid}.${randomUUID2()}.tmp`
+    `.${entry.id}.${process.pid}.${randomUUID3()}.tmp`
   );
   let descriptor;
   let state;
@@ -4131,8 +5083,8 @@ function persistHookInboxEntry(entry, inboxDir = FML_HOOK_INBOX_DIR, limits = ho
   }
   try {
     const pendingPersist = {
-      fileName: path4.basename(destination),
-      temporaryFileName: path4.basename(temporary),
+      fileName: path5.basename(destination),
+      temporaryFileName: path5.basename(temporary),
       bytes: serializedBytes,
       startedAtMs: Date.now()
     };
@@ -4144,23 +5096,23 @@ function persistHookInboxEntry(entry, inboxDir = FML_HOOK_INBOX_DIR, limits = ho
     };
     writeCapacityState(inboxDir, state, capacityLock);
     capacityLock.assertOwned();
-    descriptor = fs3.openSync(temporary, "wx", 384);
-    fs3.writeFileSync(descriptor, serialized, "utf8");
-    fs3.fsyncSync(descriptor);
+    descriptor = fs4.openSync(temporary, "wx", 384);
+    fs4.writeFileSync(descriptor, serialized, "utf8");
+    fs4.fsyncSync(descriptor);
     capacityLock.assertOwned();
-    fs3.closeSync(descriptor);
+    fs4.closeSync(descriptor);
     descriptor = void 0;
-    fs3.renameSync(temporary, destination);
+    fs4.renameSync(temporary, destination);
     try {
-      fs3.chmodSync(destination, 384);
+      fs4.chmodSync(destination, 384);
     } catch {
     }
     fsyncDirectory(inboxDir);
     capacityLock.assertOwned();
   } catch (error) {
-    if (descriptor !== void 0) fs3.closeSync(descriptor);
+    if (descriptor !== void 0) fs4.closeSync(descriptor);
     try {
-      fs3.rmSync(temporary, { force: true });
+      fs4.rmSync(temporary, { force: true });
     } catch {
     }
     if (state.pendingPersist) {
@@ -4188,10 +5140,10 @@ function hookInboxDeliveryPayload(entry) {
   };
 }
 function parseHookInboxMetadata(value) {
-  return isRecord2(value) ? parseMetadata(value[INBOX_METADATA_KEY]) : null;
+  return isRecord3(value) ? parseMetadata(value[INBOX_METADATA_KEY]) : null;
 }
 function parseHookInboxEntry(value) {
-  if (!isRecord2(value) || value.schemaVersion !== HOOK_INBOX_SCHEMA_VERSION) {
+  if (!isRecord3(value) || value.schemaVersion !== HOOK_INBOX_SCHEMA_VERSION) {
     return null;
   }
   const metadata = parseMetadata(value);
@@ -4211,21 +5163,21 @@ function sourceDeclaresForwardSchema(source) {
 }
 function readEntryResult(filePath) {
   try {
-    const stat = fs3.lstatSync(filePath);
+    const stat = fs4.lstatSync(filePath);
     if (!stat.isFile()) {
       return { kind: "malformed" };
     }
     if (stat.size > MAX_HOOK_INBOX_ENTRY_BYTES) {
       return { kind: "unsupported_schema" };
     }
-    const source = fs3.readFileSync(filePath, "utf8");
+    const source = fs4.readFileSync(filePath, "utf8");
     let value;
     try {
       value = JSON.parse(source);
     } catch {
       return sourceDeclaresForwardSchema(source) ? { kind: "unsupported_schema" } : { kind: "malformed" };
     }
-    if (isRecord2(value) && typeof value.schemaVersion === "number" && Number.isSafeInteger(value.schemaVersion) && value.schemaVersion > HOOK_INBOX_SCHEMA_VERSION) {
+    if (isRecord3(value) && typeof value.schemaVersion === "number" && Number.isSafeInteger(value.schemaVersion) && value.schemaVersion > HOOK_INBOX_SCHEMA_VERSION) {
       return { kind: "unsupported_schema" };
     }
     const entry = parseHookInboxEntry(value);
@@ -4283,19 +5235,19 @@ async function scanDrainEntryNames(inboxDir, maximumEntries, skipThrough, exclud
   let blockCursorAdvance = false;
   let removedOrphan = false;
   const cutoffMs = nowMs - STALE_INBOX_TEMP_AGE_MS;
-  const directory = await fs3.promises.opendir(inboxDir);
+  const directory = await fs4.promises.opendir(inboxDir);
   try {
     for (let dirent = await directory.read(); dirent !== null; dirent = await directory.read()) {
       const name = dirent.name;
       const abandonedLockMatch = ABANDONED_CAPACITY_LOCK_PATTERN.exec(name);
       if (INBOX_STATE_TEMP_PATTERN.test(name) || abandonedLockMatch !== null) {
         try {
-          const orphanPath = path4.join(inboxDir, name);
-          const stat = await fs3.promises.lstat(orphanPath);
+          const orphanPath = path5.join(inboxDir, name);
+          const stat = await fs4.promises.lstat(orphanPath);
           const abandonedAtMs = abandonedLockMatch ? Number(abandonedLockMatch[1]) : void 0;
           const isStale = abandonedLockMatch ? validTimestamp(abandonedAtMs) && abandonedAtMs <= cutoffMs : stat.mtimeMs <= cutoffMs;
           if (stat.isFile() && isStale) {
-            await fs3.promises.unlink(orphanPath);
+            await fs4.promises.unlink(orphanPath);
             removedOrphan = true;
           }
         } catch (error) {
@@ -4313,27 +5265,27 @@ async function scanDrainEntryNames(inboxDir, maximumEntries, skipThrough, exclud
       const id = match?.[1];
       if (!id) continue;
       const destination = entryPath(inboxDir, id);
-      const destinationName = path4.basename(destination);
-      const temporary = path4.join(inboxDir, name);
+      const destinationName = path5.basename(destination);
+      const temporary = path5.join(inboxDir, name);
       try {
-        const stat = await fs3.promises.lstat(temporary);
+        const stat = await fs4.promises.lstat(temporary);
         if (!stat.isFile()) continue;
         blockCursorAdvance = true;
         if (skipThrough && destinationName <= skipThrough) resetCursor = true;
         if (stat.mtimeMs > cutoffMs) continue;
         let destinationExists = false;
         try {
-          await fs3.promises.lstat(destination);
+          await fs4.promises.lstat(destination);
           destinationExists = true;
         } catch (error) {
           if (error.code !== "ENOENT") throw error;
         }
         if (destinationExists) {
-          await fs3.promises.unlink(temporary);
+          await fs4.promises.unlink(temporary);
         } else {
-          await fs3.promises.rename(temporary, destination);
+          await fs4.promises.rename(temporary, destination);
           try {
-            await fs3.promises.chmod(destination, 384);
+            await fs4.promises.chmod(destination, 384);
           } catch {
           }
         }
@@ -4367,7 +5319,7 @@ async function scanDrainEntryNames(inboxDir, maximumEntries, skipThrough, exclud
   return { names, failed, resetCursor, blockCursorAdvance };
 }
 function drainCursor(inboxDir) {
-  const key = path4.resolve(inboxDir);
+  const key = path5.resolve(inboxDir);
   const existing = HOOK_INBOX_DRAIN_CURSORS.get(key);
   if (existing) {
     HOOK_INBOX_DRAIN_CURSORS.delete(key);
@@ -4399,12 +5351,12 @@ function safeDrainCursor(cursor, nowMs) {
 async function pendingInboxSizeAsync(inboxDir) {
   let pendingEntries = 0;
   let pendingBytes = 0;
-  const directory = await fs3.promises.opendir(inboxDir);
+  const directory = await fs4.promises.opendir(inboxDir);
   try {
     for (let dirent = await directory.read(); dirent !== null; dirent = await directory.read()) {
       if (!isPendingEntryName(dirent.name)) continue;
       try {
-        const stat = await fs3.promises.lstat(path4.join(inboxDir, dirent.name));
+        const stat = await fs4.promises.lstat(path5.join(inboxDir, dirent.name));
         if (stat.isFile()) {
           pendingEntries += 1;
           pendingBytes += stat.size;
@@ -4421,14 +5373,14 @@ async function pendingInboxSizeAsync(inboxDir) {
 function pendingInboxSize(inboxDir, includeTemporary = false) {
   let pendingEntries = 0;
   let pendingBytes = 0;
-  const directory = fs3.opendirSync(inboxDir);
+  const directory = fs4.opendirSync(inboxDir);
   try {
     for (let dirent = directory.readSync(); dirent !== null; dirent = directory.readSync()) {
       if (!isPendingEntryName(dirent.name) && !(includeTemporary && INBOX_TEMP_PATTERN.test(dirent.name))) {
         continue;
       }
       try {
-        const stat = fs3.lstatSync(path4.join(inboxDir, dirent.name));
+        const stat = fs4.lstatSync(path5.join(inboxDir, dirent.name));
         if (stat.isFile()) {
           pendingEntries += 1;
           pendingBytes += stat.size;
@@ -4463,6 +5415,8 @@ function emptyHookInboxStatus(limits, unreadable) {
     maxBytes: limits.maxBytes ?? null,
     capacityRejectedEntries: 0,
     capacityRejectedBytes: 0,
+    lostEntries: 0,
+    lostBytes: 0,
     retiredEntries: 0,
     retiredBytes: 0,
     unreadable
@@ -4488,6 +5442,9 @@ function readHookInboxStatus(inboxDir = FML_HOOK_INBOX_DIR) {
       capacityRejectedBytes: capacity.rejectedBytes,
       ...capacity.lastRejectedAtMs === void 0 ? {} : { lastCapacityRejectedAtMs: capacity.lastRejectedAtMs },
       ...capacity.lastRejectionReason === void 0 ? {} : { lastCapacityRejectionReason: capacity.lastRejectionReason },
+      lostEntries: capacity.lostEntries,
+      lostBytes: capacity.lostBytes,
+      ...capacity.lastLostAtMs === void 0 ? {} : { lastLostAtMs: capacity.lastLostAtMs },
       retiredEntries: retirement.retiredEntries,
       retiredBytes: retirement.retiredBytes,
       unreadable: false
@@ -4499,6 +5456,50 @@ function readHookInboxStatus(inboxDir = FML_HOOK_INBOX_DIR) {
     return emptyHookInboxStatus(limits, true);
   }
 }
+function readHookInboxCapacityCounters(inboxDir = FML_HOOK_INBOX_DIR) {
+  const capacity = readCapacityStateFile(inboxDir);
+  if (!capacity) return null;
+  return {
+    rejectedEntries: capacity.rejectedEntries,
+    rejectedBytes: capacity.rejectedBytes,
+    ...capacity.lastRejectedAtMs === void 0 ? {} : { lastRejectedAtMs: capacity.lastRejectedAtMs },
+    ...capacity.lastRejectionReason === void 0 ? {} : { lastRejectionReason: capacity.lastRejectionReason },
+    lostEntries: capacity.lostEntries,
+    lostBytes: capacity.lostBytes,
+    ...capacity.lastLostAtMs === void 0 ? {} : { lastLostAtMs: capacity.lastLostAtMs }
+  };
+}
+function recordHookInboxLoss(inboxDir = FML_HOOK_INBOX_DIR, bytes, capacityLockWaitMs = CAPACITY_LOCK_WAIT_MS) {
+  let capacityLock;
+  try {
+    enforceOwnerOnlyDirectory(inboxDir);
+    capacityLock = acquireCapacityLock(inboxDir, capacityLockWaitMs);
+  } catch {
+    return false;
+  }
+  if (!capacityLock) return false;
+  try {
+    const state = loadCapacityState(
+      inboxDir,
+      maintenanceCapacityLimits(inboxDir)
+    );
+    writeCapacityState(
+      inboxDir,
+      {
+        ...state,
+        lostEntries: saturatingAdd(state.lostEntries, 1),
+        lostBytes: saturatingAdd(state.lostBytes, Math.max(0, bytes)),
+        lastLostAtMs: Date.now()
+      },
+      capacityLock
+    );
+    return true;
+  } catch {
+    return false;
+  } finally {
+    capacityLock.release();
+  }
+}
 async function readHookInboxStatusAsync(inboxDir = FML_HOOK_INBOX_DIR) {
   let limits;
   try {
@@ -4519,6 +5520,9 @@ async function readHookInboxStatusAsync(inboxDir = FML_HOOK_INBOX_DIR) {
       capacityRejectedBytes: capacity.rejectedBytes,
       ...capacity.lastRejectedAtMs === void 0 ? {} : { lastCapacityRejectedAtMs: capacity.lastRejectedAtMs },
       ...capacity.lastRejectionReason === void 0 ? {} : { lastCapacityRejectionReason: capacity.lastRejectionReason },
+      lostEntries: capacity.lostEntries,
+      lostBytes: capacity.lostBytes,
+      ...capacity.lastLostAtMs === void 0 ? {} : { lastLostAtMs: capacity.lastLostAtMs },
       retiredEntries: retirement.retiredEntries,
       retiredBytes: retirement.retiredBytes,
       unreadable: false
@@ -4530,7 +5534,10 @@ async function readHookInboxStatusAsync(inboxDir = FML_HOOK_INBOX_DIR) {
     return emptyHookInboxStatus(limits, true);
   }
 }
-async function drainHookInbox(capture, inboxDir = FML_HOOK_INBOX_DIR) {
+var defaultYieldToEventLoop = () => new Promise((resolve) => setImmediate(resolve));
+async function drainHookInbox(capture, inboxDir = FML_HOOK_INBOX_DIR, options = {}) {
+  const maximumEntries = options.maximumEntries ?? MAX_HOOK_INBOX_DRAIN_ENTRIES;
+  const yieldToEventLoop = options.yieldToEventLoop ?? defaultYieldToEventLoop;
   const retirement = readRetirementState(inboxDir);
   const completedRetirement = completePendingRetirement(inboxDir, retirement);
   let failed = completedRetirement === null ? 1 : 0;
@@ -4548,7 +5555,7 @@ async function drainHookInbox(capture, inboxDir = FML_HOOK_INBOX_DIR) {
   try {
     const scan = await scanDrainEntryNames(
       inboxDir,
-      MAX_HOOK_INBOX_DRAIN_ENTRIES,
+      Math.max(1, Math.floor(maximumEntries)),
       skipThrough,
       pendingRetirementName
     );
@@ -4582,8 +5589,14 @@ async function drainHookInbox(capture, inboxDir = FML_HOOK_INBOX_DIR) {
     }
     safeThrough = name;
   };
+  let processedSinceYield = 0;
   for (const name of names) {
-    const filePath = path4.join(inboxDir, name);
+    if (processedSinceYield >= DRAIN_YIELD_EVERY_ENTRIES) {
+      processedSinceYield = 0;
+      await yieldToEventLoop();
+    }
+    processedSinceYield += 1;
+    const filePath = path5.join(inboxDir, name);
     const readResult = readEntryResult(filePath);
     if (readResult.kind === "missing") {
       markResolved(name, false);
@@ -4659,8 +5672,22 @@ export {
   openObserverDatabase,
   OBSERVER_PROTOCOL_VERSION,
   OBSERVER_SERVICE_NAME,
+  OBSERVER_IDENTITY_HEADER,
   isObserverHealth,
   createObserverHttpServer,
+  OBSERVER_HEARTBEAT_STALE_MS,
+  isPidAlive,
+  readObserverState,
+  readObserverStateStatus,
+  createInitialObserverState,
+  ObserverStateMutationBusyError,
+  inspectObserverLease,
+  observerLeaseIsOwned,
+  getProcessIdentity,
+  claimObserverState,
+  updateObserverState,
+  removeObserverStateIfOwned,
+  HookInboxCapacityError,
   createHookInboxEntry,
   persistHookInboxEntry,
   hookInboxDeliveryPayload,
@@ -4668,6 +5695,8 @@ export {
   acknowledgeHookInboxEntry,
   retireHookInboxEntry,
   readHookInboxStatus,
+  readHookInboxCapacityCounters,
+  recordHookInboxLoss,
   readHookInboxStatusAsync,
   drainHookInbox
 };