@jungjaehoon/mama-os 0.29.1 → 0.30.0

package/dist/operator/conductor-inbox.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Durable conductor inbox.
+ *
+ * Written BEFORE the delta cursor commits (the trigger loop today commits the
+ * cursor and then invokes its callback, so a callback failure loses the batch
+ * forever - operator-trigger-loop.ts, "feed AFTER commit"). With this table
+ * the order inverts: enqueue -> commit. A crash between the two redelivers on
+ * the next drain, and per-event dedupe turns redelivery into a no-op.
+ *
+ * Claims are leases, not transfers: an acked row is done; an unacked claim
+ * older than the lease returns to pending via replayStale().
+ *
+ * `eventIds` and `lines` are INDEPENDENT fields, never zipped positionally:
+ * eventIds is the identity/cause set (the whole batch), lines is the bounded
+ * display excerpt - the same split the reconcile callback documents. Review
+ * caught the original positional pairing scrambling content for any batch
+ * larger than the display cap.
+ */
+import type { SQLiteDatabase } from '../sqlite.js';
+export interface InboxBatch {
+    channelKey: string;
+    /** Identity + cause: EVERY event in the batch. */
+    eventIds: string[];
+    /** Bounded human-readable excerpt - display only, not paired with eventIds. */
+    lines: string[];
+}
+export interface InboxRow extends InboxBatch {
+    id: number;
+    status: 'pending' | 'claimed' | 'acked' | 'dead';
+    attempts: number;
+}
+export declare class ConductorInbox {
+    private readonly db;
+    private readonly stmtInsertEvent;
+    private readonly stmtInsertBatch;
+    private readonly stmtClaimSelect;
+    private readonly stmtClaimUpdate;
+    private readonly stmtAck;
+    private readonly stmtRetry;
+    private readonly stmtRetryStatus;
+    private readonly stmtPruneAcked;
+    private readonly stmtPrunePending;
+    private readonly stmtPruneEvents;
+    private readonly stmtReplay;
+    private readonly stmtDepth;
+    constructor(db: SQLiteDatabase);
+    private now;
+    /**
+     * Dedupe is PER EVENT, not per batch shape. A batch-boundary key fails on
+     * partial redelivery: [e1] enqueues, the cursor commit fails elsewhere, the
+     * next drain delivers [e1,e2] under a different boundary - and e1 runs
+     * twice. Seen event ids live in their own table; a batch with no unseen
+     * events is dropped, a batch with any unseen event is stored whole (its
+     * display lines may briefly re-show an already-seen event; identity never
+     * lies).
+     */
+    enqueue(batch: InboxBatch): number | null;
+    claimNext(): InboxRow | null;
+    ack(id: number): void;
+    /**
+     * Return a claim to pending, or park it dead after MAX_ATTEMPTS. Returns
+     * the resulting status so the caller can be LOUD about a dead batch - a
+     * permanent loss must never be silent.
+     */
+    retry(id: number, error: string): 'pending' | 'dead' | 'noop';
+    replayStale(olderThanMs: number, now?: number): number;
+    depth(): {
+        pending: number;
+        claimed: number;
+        dead: number;
+    };
+}
+//# sourceMappingURL=conductor-inbox.d.ts.map

package/dist/operator/conductor-inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor-inbox.d.ts","sourceRoot":"","sources":["../../src/operator/conductor-inbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAsBnD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,cAAc;IAcb,OAAO,CAAC,QAAQ,CAAC,EAAE;IAb/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAEE,EAAE,EAAE,cAAc;IA4E/C,OAAO,CAAC,GAAG;IAIX;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IA+BzC,SAAS,IAAI,QAAQ,GAAG,IAAI;IA2B5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM;IAS7D,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM;IAW1D,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAS5D"}

package/dist/operator/conductor-inbox.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConductorInbox = void 0;
+const MAX_ATTEMPTS = 5;
+const ACKED_RETENTION_MS = 7 * 86_400_000;
+/**
+ * Pending rows older than this park as dead: in shadow mode nothing acks, and
+ * an unbounded pending queue detonates as months of stale chat replayed at 8
+ * runs per 30s tick the day the owner flips the flag (review F4). 7 days of
+ * shadow data is the observation window; older batches are stale, not lost -
+ * dead rows stay visible in depth().
+ */
+const PENDING_RETENTION_MS = 7 * 86_400_000;
+/**
+ * Dedupe horizon. Event ids must outlive their batch rows or a redelivery
+ * after batch pruning re-processes old events - but they cannot live forever
+ * either (one TEXT-PK row per event ever drained; review measured 30k+ rows
+ * in a single connector incident). 30 days is far wider than any redelivery
+ * gap the delta cursor can produce.
+ */
+const EVENT_RETENTION_MS = 30 * 86_400_000;
+const SEEN_CHUNK = 500; // stay under SQLITE_MAX_VARIABLE_NUMBER
+class ConductorInbox {
+    db;
+    stmtInsertEvent;
+    stmtInsertBatch;
+    stmtClaimSelect;
+    stmtClaimUpdate;
+    stmtAck;
+    stmtRetry;
+    stmtRetryStatus;
+    stmtPruneAcked;
+    stmtPrunePending;
+    stmtPruneEvents;
+    stmtReplay;
+    stmtDepth;
+    constructor(db) {
+        this.db = db;
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS conductor_inbox (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        channel_key TEXT NOT NULL,
+        event_ids_json TEXT NOT NULL,
+        lines_json TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'pending'
+          CHECK (status IN ('pending','claimed','acked','dead')),
+        attempts INTEGER NOT NULL DEFAULT 0,
+        last_error TEXT,
+        created_at INTEGER NOT NULL,
+        claimed_at INTEGER,
+        acked_at INTEGER
+      );
+      CREATE INDEX IF NOT EXISTS idx_conductor_inbox_status
+        ON conductor_inbox(status, id);
+      CREATE TABLE IF NOT EXISTS conductor_inbox_events (
+        event_id TEXT PRIMARY KEY,
+        seen_at INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX IF NOT EXISTS idx_conductor_inbox_events_seen
+        ON conductor_inbox_events(seen_at);
+    `);
+        // Prepared once: enqueue runs per channel per drain tick and re-preparing
+        // statements per call was measurable on backfill drains.
+        this.stmtInsertEvent = this.db.prepare(`INSERT OR IGNORE INTO conductor_inbox_events (event_id, seen_at) VALUES (?, ?)`);
+        this.stmtInsertBatch = this.db.prepare(`INSERT INTO conductor_inbox (channel_key, event_ids_json, lines_json, created_at)
+       VALUES (?, ?, ?, ?)`);
+        this.stmtClaimSelect = this.db.prepare(`SELECT id, channel_key, event_ids_json, lines_json, attempts
+         FROM conductor_inbox WHERE status = 'pending' ORDER BY id ASC LIMIT 1`);
+        this.stmtClaimUpdate = this.db.prepare(`UPDATE conductor_inbox SET status = 'claimed', claimed_at = ?
+        WHERE id = ? AND status = 'pending'`);
+        this.stmtAck = this.db.prepare(`UPDATE conductor_inbox SET status = 'acked', acked_at = ? WHERE id = ?`);
+        this.stmtRetry = this.db.prepare(`UPDATE conductor_inbox
+          SET status = CASE WHEN attempts + 1 >= ${MAX_ATTEMPTS} THEN 'dead' ELSE 'pending' END,
+              attempts = attempts + 1, last_error = ?, claimed_at = NULL
+        WHERE id = ? AND status = 'claimed'`);
+        this.stmtRetryStatus = this.db.prepare(`SELECT status FROM conductor_inbox WHERE id = ?`);
+        this.stmtPruneAcked = this.db.prepare(`DELETE FROM conductor_inbox WHERE status = 'acked' AND acked_at <= ?`);
+        this.stmtPrunePending = this.db.prepare(`UPDATE conductor_inbox
+          SET status = 'dead', last_error = 'stale_pending_expired'
+        WHERE status = 'pending' AND created_at <= ?`);
+        this.stmtPruneEvents = this.db.prepare(`DELETE FROM conductor_inbox_events WHERE seen_at <= ?`);
+        // Same poison cap as retry(): a claim that expires its lease repeatedly
+        // (hung run, daemon death mid-flight) must park as dead too, not re-pend
+        // forever at the head of the queue (review F8).
+        this.stmtReplay = this.db.prepare(`UPDATE conductor_inbox
+          SET status = CASE WHEN attempts + 1 >= ${MAX_ATTEMPTS} THEN 'dead' ELSE 'pending' END,
+              attempts = attempts + 1, claimed_at = NULL
+        WHERE status = 'claimed' AND COALESCE(claimed_at, 0) <= ?`);
+        // Grouped on the (status, id) index; never scans the acked bulk.
+        this.stmtDepth = this.db.prepare(`SELECT status, COUNT(*) AS n FROM conductor_inbox
+        WHERE status IN ('pending','claimed','dead') GROUP BY status`);
+    }
+    now() {
+        return Date.now();
+    }
+    /**
+     * Dedupe is PER EVENT, not per batch shape. A batch-boundary key fails on
+     * partial redelivery: [e1] enqueues, the cursor commit fails elsewhere, the
+     * next drain delivers [e1,e2] under a different boundary - and e1 runs
+     * twice. Seen event ids live in their own table; a batch with no unseen
+     * events is dropped, a batch with any unseen event is stored whole (its
+     * display lines may briefly re-show an already-seen event; identity never
+     * lies).
+     */
+    enqueue(batch) {
+        const seenIds = new Set();
+        for (let i = 0; i < batch.eventIds.length; i += SEEN_CHUNK) {
+            const chunk = batch.eventIds.slice(i, i + SEEN_CHUNK);
+            const rows = this.db
+                .prepare(`SELECT event_id FROM conductor_inbox_events WHERE event_id IN (${chunk
+                .map(() => '?')
+                .join(',')})`)
+                .all(...chunk);
+            for (const row of rows)
+                seenIds.add(row.event_id);
+        }
+        const fresh = batch.eventIds.filter((id) => !seenIds.has(id));
+        if (fresh.length === 0) {
+            return null; // fully redelivered - already durable
+        }
+        const run = this.db.transaction(() => {
+            const now = this.now();
+            for (const id of fresh)
+                this.stmtInsertEvent.run(id, now);
+            return this.stmtInsertBatch.run(batch.channelKey, JSON.stringify(fresh), JSON.stringify(batch.lines), now);
+        });
+        return Number(run().lastInsertRowid);
+    }
+    claimNext() {
+        const row = this.stmtClaimSelect.get();
+        if (!row) {
+            return null;
+        }
+        const claimed = this.stmtClaimUpdate.run(this.now(), row.id);
+        if (claimed.changes !== 1) {
+            return null; // lost a race; caller just tries again next tick
+        }
+        return {
+            id: row.id,
+            channelKey: row.channel_key,
+            eventIds: JSON.parse(row.event_ids_json),
+            lines: JSON.parse(row.lines_json),
+            status: 'claimed',
+            attempts: row.attempts,
+        };
+    }
+    ack(id) {
+        this.stmtAck.run(this.now(), id);
+    }
+    /**
+     * Return a claim to pending, or park it dead after MAX_ATTEMPTS. Returns
+     * the resulting status so the caller can be LOUD about a dead batch - a
+     * permanent loss must never be silent.
+     */
+    retry(id, error) {
+        const result = this.stmtRetry.run(error.slice(0, 500), id);
+        if (result.changes !== 1) {
+            return 'noop'; // replayStale already flipped it
+        }
+        const row = this.stmtRetryStatus.get(id);
+        return row?.status === 'dead' ? 'dead' : 'pending';
+    }
+    replayStale(olderThanMs, now = this.now()) {
+        // Housekeeping rides along: acked rows age out, stale pending rows park
+        // as dead (visible, bounded), and the dedupe table keeps a wide but
+        // finite horizon - no table here grows without bound.
+        this.stmtPruneAcked.run(now - ACKED_RETENTION_MS);
+        this.stmtPrunePending.run(now - PENDING_RETENTION_MS);
+        this.stmtPruneEvents.run(now - EVENT_RETENTION_MS);
+        const result = this.stmtReplay.run(now - olderThanMs);
+        return result.changes;
+    }
+    depth() {
+        const rows = this.stmtDepth.all();
+        const byStatus = new Map(rows.map((row) => [row.status, row.n]));
+        return {
+            pending: byStatus.get('pending') ?? 0,
+            claimed: byStatus.get('claimed') ?? 0,
+            dead: byStatus.get('dead') ?? 0,
+        };
+    }
+}
+exports.ConductorInbox = ConductorInbox;
+//# sourceMappingURL=conductor-inbox.js.map

package/dist/operator/conductor-inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor-inbox.js","sourceRoot":"","sources":["../../src/operator/conductor-inbox.ts"],"names":[],"mappings":";;;AAoBA,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,kBAAkB,GAAG,CAAC,GAAG,UAAU,CAAC;AAC1C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,UAAU,CAAC;AAC5C;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,UAAU,CAAC;AAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,wCAAwC;AAgBhE,MAAa,cAAc;IAcI;IAbZ,eAAe,CAAC;IAChB,eAAe,CAAC;IAChB,eAAe,CAAC;IAChB,eAAe,CAAC;IAChB,OAAO,CAAC;IACR,SAAS,CAAC;IACV,eAAe,CAAC;IAChB,cAAc,CAAC;IACf,gBAAgB,CAAC;IACjB,eAAe,CAAC;IAChB,UAAU,CAAC;IACX,SAAS,CAAC;IAE3B,YAA6B,EAAkB;QAAlB,OAAE,GAAF,EAAE,CAAgB;QAC7C,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;KAsBZ,CAAC,CAAC;QACH,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC;2BACqB,CACtB,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC;+EACyE,CAC1E,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACpC;4CACsC,CACvC,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B;mDAC6C,YAAY;;4CAEnB,CACvC,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAC1F,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACnC,sEAAsE,CACvE,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACrC;;qDAE+C,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC;QAChG,wEAAwE;QACxE,yEAAyE;QACzE,gDAAgD;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC/B;mDAC6C,YAAY;;kEAEG,CAC7D,CAAC;QACF,iEAAiE;QACjE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B;qEAC+D,CAChE,CAAC;IACJ,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAiB;QACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;iBACjB,OAAO,CACN,kEAAkE,KAAK;iBACpE,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;iBACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAChB;iBACA,GAAG,CAAC,GAAG,KAAK,CAAgC,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,CAAC,sCAAsC;QACrD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,EAAE,IAAI,KAAK;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAC7B,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAC3B,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAED,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAQvB,CAAC;QACd,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAChE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAa;YACpD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa;YAC7C,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,EAAU,EAAE,KAAa;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,CAAC,iCAAiC;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAmC,CAAC;QAC3E,OAAO,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,WAAW,CAAC,WAAmB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC/C,wEAAwE;QACxE,oEAAoE;QACpE,sDAAsD;QACtD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;QAClD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAA0C,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YACrC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;CACF;AAvMD,wCAuMC"}

package/dist/operator/conductor-session.d.ts

@@ -0,0 +1,55 @@
+export declare const CONDUCTOR_SOURCE = "conductor";
+export declare const CONDUCTOR_CHANNEL_ID = "conductor";
+export declare const CONDUCTOR_SESSION_KEY = "conductor:main";
+/** Pool identity: agent-loop derives it from (source, channelId). */
+export declare const CONDUCTOR_POOL_KEY: string;
+export interface ConductorSessionPolicy {
+    maxAgeMs: number;
+    maxTurns: number;
+    maxTokens: number;
+    /**
+     * Treat the session as expired after this much idle time. Must stay BELOW
+     * the pool's own sessionTimeoutMs (30min default): the pool silently drops
+     * idle entries, and a pool-expired session would otherwise get a warm turn
+     * with no re-ground (review F11). Recycling first keeps the invariant.
+     */
+    idleExpiryMs: number;
+}
+interface PoolLike {
+    getTokenUsage(key: string): number;
+}
+export declare class ConductorSession {
+    private readonly pool;
+    private readonly now;
+    private readonly policy;
+    private bornAt;
+    private turns;
+    private lastRunAt;
+    private suspicion;
+    private regroundDue;
+    constructor(pool: PoolLike, policy?: Partial<ConductorSessionPolicy>, now?: () => number);
+    noteTurn(): void;
+    /**
+     * Force a recycle on the next tick. No production detector calls this yet -
+     * wiring one (denied-tool patterns, instruction-shaped batch lines) is named
+     * S2 work. The recycle path itself is pinned by tests so the hook is live
+     * the day a detector exists.
+     */
+    flagSuspicion(reason: string): void;
+    shouldRecycle(): string | null;
+    recycle(reason: string): {
+        needsReground: true;
+        reason: string;
+    };
+    /** Read-only: does the next run owe the board a re-ground? */
+    needsReground(): boolean;
+    /**
+     * Called ONLY after a successful re-grounded run. A failed run must not
+     * consume the re-ground - the retry still owes the board its context
+     * (review: consume-before-run dropped the re-ground on the floor when the
+     * first run of a fresh session threw).
+     */
+    markRegrounded(): void;
+}
+export {};
+//# sourceMappingURL=conductor-session.d.ts.map

package/dist/operator/conductor-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor-session.d.ts","sourceRoot":"","sources":["../../src/operator/conductor-session.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAMhD,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,QAA0D,CAAC;AAE1F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAYD,UAAU,QAAQ;IAChB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACpC;AAED,qBAAa,gBAAgB;IASzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAQ;gBAGR,IAAI,EAAE,QAAQ,EAC/B,MAAM,GAAE,OAAO,CAAC,sBAAsB,CAAM,EAC3B,GAAG,GAAE,MAAM,MAAyB;IAOvD,QAAQ,IAAI,IAAI;IAKhB;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAInC,aAAa,IAAI,MAAM,GAAG,IAAI;IAmB9B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,aAAa,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAShE,8DAA8D;IAC9D,aAAa,IAAI,OAAO;IAIxB;;;;;OAKG;IACH,cAAc,IAAI,IAAI;CAGvB"}

package/dist/operator/conductor-session.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConductorSession = exports.CONDUCTOR_POOL_KEY = exports.CONDUCTOR_SESSION_KEY = exports.CONDUCTOR_CHANNEL_ID = exports.CONDUCTOR_SOURCE = void 0;
+/**
+ * Session lifecycle for the stateful conductor.
+ *
+ * Injected text persists in a long-lived buffer - that is the pivot's one new
+ * risk, and this class is the antidote: sessions are disposable on age, turn,
+ * token, idle, or suspicion budgets, and every fresh session (boot included)
+ * owes the board one re-ground before its first judgment. State survives
+ * because it lives in cards; the buffer never has to.
+ *
+ * Recycle does NOT touch the pool directly: agent-loop's `freshSession: true`
+ * is the one sanctioned reset path (it resets the pool entry AND marks the
+ * run new in the same place - review F5: `pool.resetSession()` alone swaps a
+ * UUID while the fallback branch overwrites `resumeSession` with the pool's
+ * own `isNew`, so the old buffer survives). The conductor passes
+ * `freshSession: true` whenever `needsReground()` is true.
+ */
+const session_pool_js_1 = require("../agent/session-pool.js");
+exports.CONDUCTOR_SOURCE = 'conductor';
+exports.CONDUCTOR_CHANNEL_ID = 'conductor';
+// THREE keys, one identity. The LANE comes from the session key's FIRST
+// `:` segment (agent-loop.ts resolveGlobalLaneForSession) - NOT from
+// options.source. 'operator:conductor' would resolve to the GLOBAL operator
+// lane where Stage-2 workers serialize (review F1), so the key must lead
+// with a segment absent from SOURCE_GLOBAL_LANES.
+exports.CONDUCTOR_SESSION_KEY = 'conductor:main'; // lane: session:conductor:main
+/** Pool identity: agent-loop derives it from (source, channelId). */
+exports.CONDUCTOR_POOL_KEY = (0, session_pool_js_1.buildChannelKey)(exports.CONDUCTOR_SOURCE, exports.CONDUCTOR_CHANNEL_ID);
+const DEFAULTS = {
+    maxAgeMs: 6 * 60 * 60 * 1000,
+    maxTurns: 400,
+    // Below the pool's own 160k context threshold (session-pool.ts
+    // CONTEXT_THRESHOLD_TOKENS) so the conductor always recycles BEFORE the
+    // pool silently swaps the session out from under it.
+    maxTokens: 150_000,
+    idleExpiryMs: 25 * 60 * 1000,
+};
+class ConductorSession {
+    pool;
+    now;
+    policy;
+    bornAt;
+    turns = 0;
+    lastRunAt;
+    suspicion = null;
+    regroundDue = true; // boot = fresh session = restart recovery
+    constructor(pool, policy = {}, now = () => Date.now()) {
+        this.pool = pool;
+        this.now = now;
+        this.policy = { ...DEFAULTS, ...policy };
+        this.bornAt = this.now();
+        this.lastRunAt = this.bornAt;
+    }
+    noteTurn() {
+        this.turns += 1;
+        this.lastRunAt = this.now();
+    }
+    /**
+     * Force a recycle on the next tick. No production detector calls this yet -
+     * wiring one (denied-tool patterns, instruction-shaped batch lines) is named
+     * S2 work. The recycle path itself is pinned by tests so the hook is live
+     * the day a detector exists.
+     */
+    flagSuspicion(reason) {
+        this.suspicion = reason;
+    }
+    shouldRecycle() {
+        if (this.suspicion) {
+            return `suspicion: ${this.suspicion}`;
+        }
+        if (this.now() - this.bornAt > this.policy.maxAgeMs) {
+            return 'max_age';
+        }
+        if (this.now() - this.lastRunAt > this.policy.idleExpiryMs) {
+            return 'idle_expiry';
+        }
+        if (this.turns >= this.policy.maxTurns) {
+            return 'max_turns';
+        }
+        if (this.pool.getTokenUsage(exports.CONDUCTOR_POOL_KEY) >= this.policy.maxTokens) {
+            return 'max_tokens';
+        }
+        return null;
+    }
+    recycle(reason) {
+        this.bornAt = this.now();
+        this.lastRunAt = this.bornAt;
+        this.turns = 0;
+        this.suspicion = null;
+        this.regroundDue = true;
+        return { needsReground: true, reason };
+    }
+    /** Read-only: does the next run owe the board a re-ground? */
+    needsReground() {
+        return this.regroundDue;
+    }
+    /**
+     * Called ONLY after a successful re-grounded run. A failed run must not
+     * consume the re-ground - the retry still owes the board its context
+     * (review: consume-before-run dropped the re-ground on the floor when the
+     * first run of a fresh session threw).
+     */
+    markRegrounded() {
+        this.regroundDue = false;
+    }
+}
+exports.ConductorSession = ConductorSession;
+//# sourceMappingURL=conductor-session.js.map

package/dist/operator/conductor-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor-session.js","sourceRoot":"","sources":["../../src/operator/conductor-session.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACH,8DAA2D;AAE9C,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,oBAAoB,GAAG,WAAW,CAAC;AAChD,wEAAwE;AACxE,qEAAqE;AACrE,4EAA4E;AAC5E,yEAAyE;AACzE,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,gBAAgB,CAAC,CAAC,+BAA+B;AACtF,qEAAqE;AACxD,QAAA,kBAAkB,GAAG,IAAA,iCAAe,EAAC,wBAAgB,EAAE,4BAAoB,CAAC,CAAC;AAe1F,MAAM,QAAQ,GAA2B;IACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC5B,QAAQ,EAAE,GAAG;IACb,+DAA+D;IAC/D,wEAAwE;IACxE,qDAAqD;IACrD,SAAS,EAAE,OAAO;IAClB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC7B,CAAC;AAMF,MAAa,gBAAgB;IASR;IAEA;IAVF,MAAM,CAAyB;IACxC,MAAM,CAAS;IACf,KAAK,GAAG,CAAC,CAAC;IACV,SAAS,CAAS;IAClB,SAAS,GAAkB,IAAI,CAAC;IAChC,WAAW,GAAG,IAAI,CAAC,CAAC,0CAA0C;IAEtE,YACmB,IAAc,EAC/B,SAA0C,EAAE,EAC3B,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAFpC,SAAI,GAAJ,IAAI,CAAU;QAEd,QAAG,GAAH,GAAG,CAAiC;QAErD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,MAAc;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,aAAa;QACX,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,0BAAkB,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACzE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,8DAA8D;IAC9D,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;CACF;AA3ED,4CA2EC"}

package/dist/operator/conductor.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The stateful conductor: consumes the durable inbox, judges each batch in
+ * ONE long-lived session, and delegates by COMMITTING work orders only - it
+ * never awaits a worker from its model turn.
+ *
+ * Lane: the session key 'conductor:main' leads with a segment absent from
+ * SOURCE_GLOBAL_LANES, so runs land on session:conductor:main - fully
+ * separate from the global operator lane where Stage-2 workers serialize
+ * (worker-run.ts documents the deadlock seal). The lane is derived from the
+ * session key's FIRST segment, not options.source (agent-loop.ts
+ * resolveGlobalLaneForSession) - tests pin this axis.
+ *
+ * Trust boundary: batch lines are connector-channel text - attacker-authored
+ * by definition, and this session's buffer is long-lived. Every batch enters
+ * the prompt through wrapUntrustedContent (the spec's standing "wrapping
+ * remains the first line"), under an owner-authored framing instruction.
+ */
+import type { ConductorInbox } from './conductor-inbox.js';
+import { type ConductorSession } from './conductor-session.js';
+import type { AgentContext } from '../agent/types.js';
+import type { Envelope } from '../envelope/types.js';
+interface RunnerLike {
+    run(prompt: string, options?: {
+        sessionKey?: string;
+        source?: string;
+        channelId?: string;
+        resumeSession?: boolean;
+        freshSession?: boolean;
+        agentContext?: AgentContext;
+        envelope?: Envelope;
+    }): Promise<{
+        response: string;
+    }>;
+}
+export declare class Conductor {
+    private readonly deps;
+    private readonly leaseMs;
+    private readonly maxBatchesPerTick;
+    constructor(deps: {
+        inbox: ConductorInbox;
+        session: ConductorSession;
+        runner: RunnerLike;
+        reground: () => string;
+        /**
+         * Per-run scoped authority, mirroring the report lane: without an
+         * agentContext the executor's permission checks take their documented
+         * "no context - allow all" branch, and without an envelope every
+         * model_tool call dies 'envelope_missing' while the run still resolves
+         * and acks (review F2). Both are REQUIRED wiring in start.ts; optional
+         * here only so unit tests can run the loop without the full boot.
+         */
+        agentContext?: AgentContext;
+        issueEnvelope?: () => Promise<Envelope | null>;
+        log?: (line: string) => void;
+        leaseMs?: number;
+        /** Burst backpressure budget: batches processed per tick before yielding. */
+        maxBatchesPerTick?: number;
+    });
+    tick(): Promise<'idle' | 'processed' | 'failed'>;
+    /**
+     * A growing inbox must be loud - silence is how backlogs hide. Runs on the
+     * failure path too: a batch stuck in retries (attempts 1-4) is exactly when
+     * the backlog grows unattended (review).
+     */
+    private logDepth;
+}
+export {};
+//# sourceMappingURL=conductor.d.ts.map

package/dist/operator/conductor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor.d.ts","sourceRoot":"","sources":["../../src/operator/conductor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,UAAU,UAAU;IAClB,GAAG,CACD,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;KACrB,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC;AAED,qBAAa,SAAS;IAKlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGxB,IAAI,EAAE;QACrB,KAAK,EAAE,cAAc,CAAC;QACtB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,MAAM,MAAM,CAAC;QACvB;;;;;;;WAOG;QACH,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,6EAA6E;QAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAMG,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IAuEtD;;;;OAIG;IACH,OAAO,CAAC,QAAQ;CAQjB"}

package/dist/operator/conductor.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Conductor = void 0;
+const conductor_session_js_1 = require("./conductor-session.js");
+const untrusted_content_js_1 = require("../utils/untrusted-content.js");
+class Conductor {
+    deps;
+    leaseMs;
+    maxBatchesPerTick;
+    constructor(deps) {
+        this.deps = deps;
+        this.leaseMs = deps.leaseMs ?? 10 * 60_000;
+        this.maxBatchesPerTick = deps.maxBatchesPerTick ?? 8;
+    }
+    async tick() {
+        const replayed = this.deps.inbox.replayStale(this.leaseMs);
+        if (replayed > 0) {
+            this.deps.log?.(`[conductor] replayed ${replayed} stale claim(s)`);
+        }
+        const reason = this.deps.session.shouldRecycle();
+        if (reason) {
+            this.deps.session.recycle(reason);
+            this.deps.log?.(`[conductor] session recycled: ${reason}`);
+        }
+        let processed = 0;
+        for (; processed < this.maxBatchesPerTick;) {
+            const batch = this.deps.inbox.claimNext();
+            if (!batch) {
+                break;
+            }
+            const fresh = this.deps.session.needsReground();
+            const parts = [];
+            if (fresh) {
+                parts.push(this.deps.reground());
+            }
+            parts.push(untrusted_content_js_1.UNTRUSTED_EXTERNAL_EVIDENCE_INSTRUCTION, (0, untrusted_content_js_1.wrapUntrustedContent)(`channel:${batch.channelKey}`, batch.lines.join('\n')));
+            try {
+                // freshSession is the ONE sanctioned reset path: agent-loop resets the
+                // pool entry AND marks the run new together. resumeSession alone is
+                // overwritten by the pool's own isNew in the fallback branch, so it
+                // cannot express "start over" (review F5).
+                const envelope = (await this.deps.issueEnvelope?.()) ?? undefined;
+                await this.deps.runner.run(parts.join('\n'), {
+                    sessionKey: conductor_session_js_1.CONDUCTOR_SESSION_KEY, // lane (first segment picks it)
+                    source: conductor_session_js_1.CONDUCTOR_SOURCE, // pool key half 1
+                    channelId: conductor_session_js_1.CONDUCTOR_CHANNEL_ID, // pool key half 2
+                    ...(fresh ? { freshSession: true } : { resumeSession: true }),
+                    agentContext: this.deps.agentContext,
+                    envelope,
+                });
+                this.deps.inbox.ack(batch.id);
+                this.deps.session.noteTurn();
+                if (fresh) {
+                    this.deps.session.markRegrounded();
+                }
+                processed += 1;
+            }
+            catch (error) {
+                const outcome = this.deps.inbox.retry(batch.id, error instanceof Error ? error.message : String(error));
+                if (outcome === 'dead') {
+                    // A dead batch is a permanent loss - it must never die quietly.
+                    this.deps.log?.(`[conductor] batch ${batch.id} (${batch.channelKey}) parked DEAD after repeated failures: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                this.logDepth(processed);
+                return 'failed';
+            }
+        }
+        this.logDepth(processed);
+        return processed > 0 ? 'processed' : 'idle';
+    }
+    /**
+     * A growing inbox must be loud - silence is how backlogs hide. Runs on the
+     * failure path too: a batch stuck in retries (attempts 1-4) is exactly when
+     * the backlog grows unattended (review).
+     */
+    logDepth(processed) {
+        const depth = this.deps.inbox.depth();
+        if (depth.pending > 0 || depth.dead > 0) {
+            this.deps.log?.(`[conductor] tick budget spent: ${processed} processed, ${depth.pending} pending, ${depth.dead} dead`);
+        }
+    }
+}
+exports.Conductor = Conductor;
+//# sourceMappingURL=conductor.js.map

package/dist/operator/conductor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conductor.js","sourceRoot":"","sources":["../../src/operator/conductor.ts"],"names":[],"mappings":";;;AAkBA,iEAKgC;AAChC,wEAGuC;AAmBvC,MAAa,SAAS;IAKD;IAJF,OAAO,CAAS;IAChB,iBAAiB,CAAS;IAE3C,YACmB,IAmBhB;QAnBgB,SAAI,GAAJ,IAAI,CAmBpB;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG,MAAM,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,QAAQ,iBAAiB,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,SAAS,GAAG,IAAI,CAAC,iBAAiB,GAAI,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnC,CAAC;YACD,KAAK,CAAC,IAAI,CACR,8DAAuC,EACvC,IAAA,2CAAoB,EAAC,WAAW,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC5E,CAAC;YAEF,IAAI,CAAC;gBACH,uEAAuE;gBACvE,oEAAoE;gBACpE,oEAAoE;gBACpE,2CAA2C;gBAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;gBAClE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC3C,UAAU,EAAE,4CAAqB,EAAE,gCAAgC;oBACnE,MAAM,EAAE,uCAAgB,EAAE,kBAAkB;oBAC5C,SAAS,EAAE,2CAAoB,EAAE,kBAAkB;oBACnD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;oBAC7D,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;oBACpC,QAAQ;iBACT,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBACrC,CAAC;gBACD,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CACnC,KAAK,CAAC,EAAE,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;gBACF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,gEAAgE;oBAChE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,qBAAqB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,0CAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzB,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,SAAiB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,kCAAkC,SAAS,eAAe,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,IAAI,OAAO,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAlHD,8BAkHC"}

package/dist/operator/operator-trigger-loop.d.ts

@@ -91,6 +91,19 @@ export interface TriggerLoopDeps {
      * on this batch; carrying it is the difference between a fact and a claim.
      */
     onChannelDelta?: (channelKey: string, lines: string[], eventIds: string[]) => void;
+    /**
+     * S1: durable conductor feed. Each per-channel batch is enqueued BEFORE
+     * `delta.commit()` - a crash between the two redelivers the events and the
+     * inbox's per-event dedupe absorbs the duplicate. Structural type, no import
+     * cycle. Absent -> no conductor leg.
+     */
+    conductorInbox?: {
+        enqueue(batch: {
+            channelKey: string;
+            eventIds: string[];
+            lines: string[];
+        }): number | null;
+    };
     /** Kagemusha dual output: FULL report also publishes the operator board slots. */
     fullReportBoardLines?: string[];
     /** Context carry (plan v6 S1-T4): persist the delivered FULL report text. */

package/dist/operator/operator-trigger-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-trigger-loop.d.ts","sourceRoot":"","sources":["../../src/operator/operator-trigger-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACX,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,KAAK,EAIV,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AAGnC,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,sGAAsG;IACtG,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACrF,uFAAuF;IACvF,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,0FAA0F;IAC1F,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,MAAM,EAAE,CAAC,CAAC;IACzF;;;;;OAKG;IACH;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACnF,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,eAAe,CAAoC;IAC3D,OAAO,CAAC,cAAc,CAAmC;gBAE7C,IAAI,EAAE,eAAe;IA6CjC,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,aAAa;YAOP,oBAAoB;YA0BpB,uBAAuB;YA6BvB,qBAAqB;YA4BrB,wBAAwB;IAUhC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IA4LjC;;;;;;;;;;;OAWG;IACH;;;;;;;;;;OAUG;IACH,eAAe,IAAI;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAA;KAAE;IAqDzE,KAAK,IAAI,IAAI;IA6Bb;;;;OAIG;IACH,KAAK,IAAI,MAAM,IAAI;CA2CpB"}
+{"version":3,"file":"operator-trigger-loop.d.ts","sourceRoot":"","sources":["../../src/operator/operator-trigger-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACX,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,KAAK,EAIV,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AAGnC,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,sGAAsG;IACtG,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACrF,uFAAuF;IACvF,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,0FAA0F;IAC1F,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,MAAM,EAAE,CAAC,CAAC;IACzF;;;;;OAKG;IACH;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACnF;;;;;OAKG;IACH,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,KAAK,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,GAAG,MAAM,GAAG,IAAI,CAAC;KAC5F,CAAC;IACF,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,eAAe,CAAoC;IAC3D,OAAO,CAAC,cAAc,CAAmC;gBAE7C,IAAI,EAAE,eAAe;IA6CjC,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,aAAa;YAOP,oBAAoB;YA0BpB,uBAAuB;YA6BvB,qBAAqB;YA4BrB,wBAAwB;IAUhC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IAqOjC;;;;;;;;;;;OAWG;IACH;;;;;;;;;;OAUG;IACH,eAAe,IAAI;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAA;KAAE;IAqDzE,KAAK,IAAI,IAAI;IA6Bb;;;;OAIG;IACH,KAAK,IAAI,MAAM,IAAI;CA2CpB"}