@mono-agent/agent-app 0.11.2 → 0.11.4

package/dist/doctor.js

@@ -6,6 +6,7 @@ import { isIP } from "node:net";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { getBuiltinModels as getPiBuiltinModels, getBuiltinProviders as getPiBuiltinProviders, } from "@earendil-works/pi-ai/providers/all";
+import { validateCronExpression } from "@mono-agent/cron-adapter";
 import { listRecordedRuns } from "@mono-agent/observability";
 import { serializeTraceSpans } from "@mono-agent/observability/otel";
 import { classifyContinuationMcpServerTransport, isStdioMcpServerSpec, loadToolPolicyFromJsonFile, } from "@mono-agent/agent-harness";
@@ -19,8 +20,13 @@ import { collectChannelConfigViews } from "./channel-config-view.js";
 import { resolveChannelDrivers } from "./channels.js";
 import { findUnknownAppConfigWarnings } from "./config-reference.js";
 import { loadContinuationSettings } from "./continuation-config.js";
-import { CONTINUATION_RECORD_STORE_SCHEMA_VERSION, CONTINUATION_STORE_SCHEMA_VERSION, } from "./continuation-store.js";
-import { CONTINUATION_STATES } from "./continuations.js";
+import { applyOriginContextGroupCommit } from "./continuation-origin-store.js";
+import { readBoundedOwnerOnlyFile } from "./continuation-store-fs.js";
+import { loadLegacyStore, mergeMigrationRecords } from "./continuation-store-records.js";
+import { CONTINUATION_RECORD_STORE_SCHEMA_VERSION, } from "./continuation-store.js";
+import { applyRetention, isDurableGeneration, isOriginContextGroupCommit, isRecord, isRecordTransaction, isStoreFile, normalizeLegacyContinuationRecords, requiredDate, resolveRetention, } from "./continuation-store-policy.js";
+import { MAX_LEGACY_STORE_BYTES, MAX_MANIFEST_BYTES, MAX_RECORD_BYTES, MAX_TRANSACTION_BYTES, } from "./continuation-store-types.js";
+import { CONTINUATION_STATES, continuationDigest } from "./continuations.js";
 import { formatInteractionBridgeUrl, loadInteractionSettings } from "./interaction-bridge.js";
 import { FIRST_RUN_MEMORY_INITIALIZING_MARKER } from "./first-run-managed-memory.js";
 import { DEFAULT_MEMORY_EMBEDDING_ENDPOINTS, probeMemoryEmbeddingSelection, } from "./memory-embedding-service.js";
@@ -29,7 +35,9 @@ import { piAuthRecoveryCommand } from "./provider-setup.js";
 import { inspectPiAuthStore } from "./pi-auth-store-inspection.js";
 import { checkManagedProjectSkills, managedProjectSkillsExist } from "./project-skills.js";
 import { configuredRuntimeFallbackModels, configuredRuntimeModels } from "./runtime-routes.js";
+import { runtimeProvenanceDetail } from "./runtime-provenance.js";
 import { loadSupermemoryPlugin } from "./supermemory-plugin.js";
+import { DEFAULT_LAUNCHD_LOG_POLICY, inspectLaunchdLogs, LAUNCHD_LOG_MAINTENANCE_INTERVAL_SECONDS, launchdLogPathsForConfig, } from "./launchd-logs.js";
 const execFile = promisify(execFileCallback);
 const CONTINUATION_V2_ROLLBACK_GUARD = "UPGRADED-TO-RECORDS-V3";
 const CONTINUATION_V2_ROLLBACK_GUARD_CONTENT = "This state directory uses continuation records v3. Older runtimes must not open records-v2.\n";
@@ -54,6 +62,7 @@ export async function validateMonoAgentFolder(options) {
         }
         sections.push({ id: "core", label: "Core config", status: "error", details: [error.message] });
     }
+    sections.push(await runtimeProvenanceSection());
     if (coreConfig !== undefined) {
         const staticTriggerCredentialRefs = await collectStaticTriggerCredentialRefs(drivers, options);
         const jsonResult = await readMonoAgentConfigJson(options.configPath);
@@ -84,6 +93,7 @@ export async function validateMonoAgentFolder(options) {
     }
     sections.push(await exporterSection(options, liveness));
     sections.push(await runsSection(options, coreConfig));
+    sections.push(await launchdLogsSection(options.configPath));
     for (const driver of drivers) {
         sections.push(await channelSection(driver, options));
     }
@@ -102,6 +112,62 @@ export async function validateMonoAgentFolder(options) {
         ok: sections.every((section) => section.status !== "error"),
     };
 }
+/** Read-only launchd log inventory used by both `validate` and its `doctor` alias. */
+export async function launchdLogsSection(configPath) {
+    let inspection;
+    try {
+        const paths = await launchdLogPathsForConfig(configPath);
+        inspection = await inspectLaunchdLogs(paths);
+    }
+    catch {
+        return {
+            id: "launchd-logs",
+            label: "Launchd logs",
+            status: "waiting",
+            details: ["[WARN] Managed launchd log metadata could not be inspected safely."],
+        };
+    }
+    return launchdLogsSectionFromInspection(inspection);
+}
+/** Pure renderer kept separate so exact byte accounting is deterministic in tests. */
+export function launchdLogsSectionFromInspection(inspection) {
+    const policy = DEFAULT_LAUNCHD_LOG_POLICY;
+    const details = [
+        `Policy: ${policy.maxBytes} bytes per file, ${policy.rotationCount} retained generations, checked every ${LAUNCHD_LOG_MAINTENANCE_INTERVAL_SECONDS} seconds.`,
+        streamSizeDetail("stdout", inspection.stdout),
+        streamSizeDetail("stderr", inspection.stderr),
+        ...inspection.issues.map((issue) => `[WARN] ${issue}.`),
+        ...oversizedLogDetails("stdout", inspection.stdout, policy.maxBytes),
+        ...oversizedLogDetails("stderr", inspection.stderr, policy.maxBytes),
+    ];
+    if (!inspection.present && inspection.issues.length === 0) {
+        return {
+            id: "launchd-logs",
+            label: "Launchd logs",
+            status: "disabled",
+            details: [...details, "No managed launchd log files exist yet."],
+        };
+    }
+    return {
+        id: "launchd-logs",
+        label: "Launchd logs",
+        status: inspection.canMaintain && !inspection.needsMaintenance ? "ok" : "waiting",
+        details,
+    };
+}
+function streamSizeDetail(label, stream) {
+    if (!stream.byteAccountingComplete) {
+        return `${label}: byte inventory unavailable because one or more paths could not be inspected safely.`;
+    }
+    return `${label}: active=${stream.activeBytes} bytes, retained=${stream.retainedBytes} bytes, total=${stream.totalBytes} bytes.`;
+}
+function oversizedLogDetails(label, stream, maxBytes) {
+    if (!stream.byteAccountingComplete)
+        return [];
+    return stream.files.flatMap((file) => file.bytes <= maxBytes
+        ? []
+        : [`[WARN] ${label}${file.generation === 0 ? "" : `.${file.generation}`} is ${file.bytes} bytes; maintenance limit is ${maxBytes} bytes.`]);
+}
 /** Enabled, statically configured webhook/cron entries that can actually execute. */
 function staticTriggerConfigEntries(driverId, loaded) {
     if (!isUnknownRecord(loaded))
@@ -392,6 +458,14 @@ function applyToolChannelCrossChecks(sections, allowedTools, disallowedTools) {
     }
     sections[toolsIndex] = { ...current, status, details: [...current.details, ...extraDetails] };
 }
+async function runtimeProvenanceSection() {
+    return {
+        id: "runtime-provenance",
+        label: "Runtime provenance",
+        status: "ok",
+        details: [await runtimeProvenanceDetail()],
+    };
+}
 function runtimeSection(config) {
     const details = [];
     let status = "ok";
@@ -1045,13 +1119,25 @@ async function contextSection(config, cwd) {
     return { id: "context", label: "Context & skills", status, details };
 }
 const DEFAULT_CONSOLIDATION_CRON = "0 */2 * * *";
+function memoryConsolidationCronIssue(expression) {
+    const result = validateCronExpression(expression, { timezone: "UTC" });
+    if (result.ok) {
+        return undefined;
+    }
+    if (result.code === "required") {
+        return "memory.consolidation.cron is required when consolidation is enabled.";
+    }
+    if (result.code === "field_count") {
+        return `memory.consolidation.cron must use exactly five fields; received ${result.fieldCount}.`;
+    }
+    return `memory.consolidation.cron is invalid: ${result.reason}`;
+}
 async function memorySection(config, cwd, env, liveness, allowFilesystemWrites, preferAppPluginInstall) {
     if (config.memory === undefined) {
         return { id: "memory", label: "Memory", status: "disabled", details: ["No memory configured."] };
     }
-    // External backend (e.g. supermemory): mode/embeddings/llm are bujo-only and ignored, so report the
-    // backend's own shape. We do not ping the instance here (config-shape check); the playbook covers
-    // starting the server.
+    // External backend (e.g. supermemory): mode/embeddings/llm are bujo-only and
+    // ignored, so validate the plugin-owned shape before any soft liveness probe.
     if ((config.memory.backend ?? "bujo") === "supermemory") {
         const sm = config.memory.supermemory;
         if (sm === undefined) {
@@ -1088,19 +1174,26 @@ async function memorySection(config, cwd, env, liveness, allowFilesystemWrites,
                 details: [`[ERROR] ${error instanceof Error ? error.message : String(error)}`],
             };
         }
-        return {
-            id: "memory",
-            label: "Memory",
-            status: "ok",
-            details: [
-                `Backend: supermemory, writeMode: ${config.memory.writeMode}.`,
-                `Endpoint: ${sm.baseUrl} (container "${resolveSupermemoryContainer(config)}").`,
-                sm.apiKey === undefined
-                    ? "Auth: no API key configured (keyless — works only if the instance allows it)."
-                    : "Auth: API key configured.",
-                "Start the Supermemory instance (e.g. `supermemory-server`) before sending turns; ingestion is async.",
-            ],
-        };
+        const details = [
+            `Backend: supermemory, writeMode: ${config.memory.writeMode}.`,
+            `Endpoint: ${sm.baseUrl} (container "${resolveSupermemoryContainer(config)}").`,
+            sm.apiKey === undefined
+                ? "Auth: no API key configured (keyless — works only if the instance allows it)."
+                : "Auth: API key configured.",
+        ];
+        if (!liveness) {
+            details.push("Supermemory liveness probe skipped; ingestion is async.");
+            return { id: "memory", label: "Memory", status: "ok", details };
+        }
+        const probe = await probeSupermemoryEndpoint(sm.baseUrl);
+        if (!probe.reachable) {
+            details.push(`[WARN] Supermemory is not reachable at ${sm.baseUrl} (${probe.reason}). ` +
+                "Start Supermemory or fix memory.supermemory.baseUrl, then re-run `mono-agent validate`; " +
+                "capture and recall will degrade until it is reachable.");
+            return { id: "memory", label: "Memory", status: "waiting", details };
+        }
+        details.push(`Supermemory transport reachable at ${sm.baseUrl} (HTTP ${probe.status}); ingestion is async.`);
+        return { id: "memory", label: "Memory", status: "ok", details };
     }
     const details = [
         `Mode: ${config.memory.mode}, path: ${config.memory.path}, writeMode: ${config.memory.writeMode}.`,
@@ -1133,6 +1226,11 @@ async function memorySection(config, cwd, env, liveness, allowFilesystemWrites,
         else {
             details.push("Consolidation: disabled.");
         }
+        const cronIssue = memoryConsolidationCronIssue(consolidationCron);
+        if (cronIssue !== undefined) {
+            status = "error";
+            details.push(`[ERROR] ${cronIssue}`);
+        }
     }
     const managedIdentity = await managedMemoryIdentityStatus(config.memory);
     if (managedIdentity !== undefined) {
@@ -1294,11 +1392,39 @@ function isBuiltInMemoryNativeFailure(error) {
 async function liteRootWritableWarning(memoryPath, allowFilesystemWrites) {
     return await memoryRootWritableWarnings("lite", memoryPath, allowFilesystemWrites);
 }
-const BUJO_PROBE_TIMEOUT_MS = 3_000;
+const LIVENESS_PROBE_TIMEOUT_MS = 3_000;
+/**
+ * Read-only transport probe for a configured Supermemory service root. Neither
+ * the hosted nor self-hosted base URL has a documented health response, so any
+ * HTTP status proves reachability; only transport failure or timeout degrades
+ * validation. Manual redirects and omitted auth keep the probe on the exact
+ * configured endpoint without sending memory data or credentials.
+ */
+async function probeSupermemoryEndpoint(endpoint) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => { ctrl.abort(); }, LIVENESS_PROBE_TIMEOUT_MS);
+    try {
+        const response = await fetch(endpoint, {
+            method: "HEAD",
+            redirect: "manual",
+            signal: ctrl.signal,
+        });
+        return { reachable: true, status: response.status };
+    }
+    catch (error) {
+        return {
+            reachable: false,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** Probes Ollama /api/tags and returns a sorted list of model names, or throws. */
 async function fetchOllamaModels(endpoint) {
     const ctrl = new AbortController();
-    const timer = setTimeout(() => { ctrl.abort(); }, BUJO_PROBE_TIMEOUT_MS);
+    const timer = setTimeout(() => { ctrl.abort(); }, LIVENESS_PROBE_TIMEOUT_MS);
     try {
         const res = await fetch(`${endpoint}/api/tags`, { signal: ctrl.signal });
         if (!res.ok) {
@@ -1385,7 +1511,7 @@ async function localEmbeddingLivenessWarnings(embeddings, apiKey) {
             endpoint,
             model: embeddings.model,
             expectedDimension: embeddings.dim ?? 768,
-            timeoutMs: BUJO_PROBE_TIMEOUT_MS,
+            timeoutMs: LIVENESS_PROBE_TIMEOUT_MS,
             ...(apiKey === undefined ? {} : { apiKey }),
         });
         return [];
@@ -1681,7 +1807,7 @@ async function continuationSection(config, input) {
     details.push(routeNames.length === 0 ? "Named detached routes: none." : `Named detached routes: ${routeNames.join(", ")}.`);
     const detachedNames = Object.keys(settings.detachedServices);
     details.push(detachedNames.length === 0 ? "Detached services: none." : `Detached services: ${detachedNames.join(", ")}.`);
-    const state = await inspectContinuationState(settings.stateDir);
+    const state = await inspectContinuationState(settings.stateDir, settings.retention);
     details.push(...state.details);
     return {
         id: "continuations",
@@ -1690,8 +1816,9 @@ async function continuationSection(config, input) {
         details,
     };
 }
-async function inspectContinuationState(stateDir) {
+async function inspectContinuationState(stateDir, retention) {
     const details = [];
+    const retentionPolicy = resolveRetention(retention);
     let directory;
     try {
         directory = await lstat(stateDir);
@@ -1735,7 +1862,7 @@ async function inspectContinuationState(stateDir) {
             return { status: "error", details: [manifestSecurityError] };
         let manifest;
         try {
-            manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+            manifest = JSON.parse(await readBoundedOwnerOnlyFile(manifestPath, MAX_MANIFEST_BYTES, "Continuation v3 manifest"));
         }
         catch (error) {
             return { status: "error", details: [`Continuation store manifest contains invalid JSON: ${continuationReason(error)}`] };
@@ -1743,21 +1870,116 @@ async function inspectContinuationState(stateDir) {
         if (!isContinuationStoreManifest(manifest, CONTINUATION_RECORD_STORE_SCHEMA_VERSION, "per-record-v3")) {
             return { status: "error", details: ["Continuation store manifest has an unsupported or malformed schema."] };
         }
-        const recordsDirectoryError = await inspectContinuationRecordsDirectory(join(stateDir, "records-v3"));
+        const recordsDirectoryPath = join(stateDir, "records-v3");
+        const recordsDirectoryError = await inspectContinuationRecordsDirectory(recordsDirectoryPath);
         if (recordsDirectoryError !== undefined)
             return { status: "error", details: [recordsDirectoryError] };
-        const transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v3.json"));
+        let recordsDirectoryHasEntries;
+        try {
+            recordsDirectoryHasEntries = (await readdir(recordsDirectoryPath))
+                .some((entry) => !(entry.startsWith(".") && entry.endsWith(".tmp")));
+        }
+        catch (error) {
+            return {
+                status: "error",
+                details: [`Continuation record directory cannot be inspected: ${continuationReason(error)}`],
+            };
+        }
+        const transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v3.json"), CONTINUATION_RECORD_STORE_SCHEMA_VERSION);
         if (!transaction.valid)
             return { status: "error", details: [transaction.detail] };
-        const rollbackGuard = await inspectContinuationRollbackGuard(join(stateDir, "records-v2", CONTINUATION_V2_ROLLBACK_GUARD), true);
+        const legacyRecordsDirectoryPath = join(stateDir, "records-v2");
+        let legacyRecordsDirectoryExists = false;
+        try {
+            const legacyRecordsDirectoryInfo = await lstat(legacyRecordsDirectoryPath);
+            legacyRecordsDirectoryExists = true;
+            if (!legacyRecordsDirectoryInfo.isDirectory() || legacyRecordsDirectoryInfo.isSymbolicLink()) {
+                return { status: "error", details: ["Legacy continuation record directory must be a real directory."] };
+            }
+            const legacyRecordsDirectoryError = await inspectContinuationRecordsDirectory(legacyRecordsDirectoryPath, { allowV2RollbackGuard: true });
+            if (legacyRecordsDirectoryError !== undefined) {
+                return { status: "error", details: [legacyRecordsDirectoryError] };
+            }
+        }
+        catch (error) {
+            if (continuationFsCode(error) !== "ENOENT") {
+                return {
+                    status: "error",
+                    details: [`Legacy continuation record directory cannot be inspected: ${continuationReason(error)}`],
+                };
+            }
+        }
+        let legacyStateExists = legacyRecordsDirectoryExists;
+        const legacyV1Path = join(stateDir, "continuations-v1.json");
+        const legacyV1 = await inspectContinuationEvidenceFile(legacyV1Path, "v1 store");
+        if (!legacyV1.valid)
+            return { status: "error", details: [legacyV1.detail] };
+        legacyStateExists ||= legacyV1.exists;
+        const legacyV2Manifest = await inspectContinuationEvidenceFile(join(stateDir, "continuation-store-v2.json"), "v2 manifest");
+        if (!legacyV2Manifest.valid)
+            return { status: "error", details: [legacyV2Manifest.detail] };
+        legacyStateExists ||= legacyV2Manifest.exists;
+        const legacyTransaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v2.json"), 2);
+        if (!legacyTransaction.valid)
+            return { status: "error", details: [legacyTransaction.detail] };
+        legacyStateExists ||= legacyTransaction.pending;
+        const manifestRollbackGuardRequired = manifest.rollbackGuardRequired ?? true;
+        const legacyMigrationPending = legacyStateExists && !manifestRollbackGuardRequired;
+        let recoverableRecords;
+        try {
+            recoverableRecords = await loadContinuationRecordsForRecoveryInspection(recordsDirectoryPath);
+            if (transaction.transaction !== undefined) {
+                applyContinuationTransactionForInspection(recoverableRecords, transaction.transaction);
+            }
+            normalizeLegacyContinuationRecords(recoverableRecords);
+            if (legacyMigrationPending) {
+                const legacy = legacyRecordsDirectoryExists
+                    ? await loadContinuationRecordsForRecoveryInspection(legacyRecordsDirectoryPath)
+                    : new Map();
+                if (legacyTransaction.transaction !== undefined) {
+                    applyContinuationTransactionForInspection(legacy, legacyTransaction.transaction);
+                }
+                if (legacyV1.exists) {
+                    mergeMigrationRecords(legacy, await loadLegacyStore(legacyV1Path), "recoverable v1 and v2");
+                }
+                mergeMigrationRecords(recoverableRecords, legacy, "recoverable v2 and v3");
+            }
+        }
+        catch (error) {
+            return {
+                status: "error",
+                details: [`Continuation recoverable records are malformed or conflicting: ${continuationReason(error)}`],
+            };
+        }
+        const originGroups = await inspectContinuationEvidenceDirectory(join(stateDir, "origin-context-groups-v1"), "origin-context activation directory", async () => recoverableRecords);
+        if (!originGroups.valid)
+            return { status: "error", details: [originGroups.detail] };
+        try {
+            applyRetention(recoverableRecords, retentionPolicy, new Date());
+        }
+        catch (error) {
+            return {
+                status: "error",
+                details: [`Continuation retention projection cannot be recovered safely: ${continuationReason(error)}`],
+            };
+        }
+        const rollbackGuardRequired = manifestRollbackGuardRequired
+            || recordsDirectoryHasEntries
+            || transaction.pending
+            || originGroups.hasEntries;
+        const rollbackGuard = await inspectContinuationRollbackGuard(join(legacyRecordsDirectoryPath, CONTINUATION_V2_ROLLBACK_GUARD), rollbackGuardRequired, legacyMigrationPending
+            ? "Legacy continuation state is awaiting v3 migration; the current runtime will fence it before v3 materialization."
+            : "The empty v3 store has no v2 rollback guard; the current runtime will install one before its first v3 record becomes durable.");
         if (!rollbackGuard.valid)
             return { status: "error", details: [rollbackGuard.detail] };
         const owner = await inspectContinuationOwnerDatabase(join(stateDir, "continuations-owner.sqlite"));
         if (!owner.valid)
             return { status: "error", details: [owner.detail] };
-        details.push(`Store v3: ${String(manifest.stats.records)} retained; ${String(manifest.stats.active)} active; ${String(manifest.stats.unresolvedDelivery)} delivery unknown; ${String(manifest.stats.deadLettered)} dead-lettered; ${String(manifest.stats.historyDegraded)} history-degraded deliveries; ${String(manifest.stats.terminalTombstones)} terminal tombstones; ${String(manifest.stats.capturedText)} captured answers.`, `Retention: at most ${String(manifest.stats.limits.terminalMaxRecords)} terminal tombstones and ${String(manifest.stats.limits.capturedTextMaxRecords)} captured answers.`, transaction.detail, rollbackGuard.detail, owner.detail);
+        details.push(`Store v3: ${String(manifest.stats.records)} retained; ${String(manifest.stats.active)} active; ${String(manifest.stats.unresolvedDelivery)} delivery unknown; ${String(manifest.stats.deadLettered)} dead-lettered; ${String(manifest.stats.historyDegraded)} history-degraded deliveries; ${String(manifest.stats.terminalTombstones)} terminal tombstones; ${String(manifest.stats.compacted)} compacted; ${String(manifest.stats.capturedText)} captured answers.`, `Retention: at most ${String(manifest.stats.limits.terminalMaxRecords)} terminal tombstones with a maximum age of ${String(manifest.stats.limits.terminalMaxAgeMs)} ms and ${String(manifest.stats.limits.capturedTextMaxRecords)} captured answers with a maximum age of ${String(manifest.stats.limits.capturedTextMaxAgeMs)} ms.`, transaction.detail, rollbackGuard.detail, originGroups.detail, ...(legacyMigrationPending ? ["Legacy continuation state is awaiting idempotent v3 migration."] : []), owner.detail);
         return {
             status: transaction.pending
+                || originGroups.hasEntries
+                || legacyMigrationPending
                 || manifest.stats.unresolvedDelivery > 0
                 || manifest.stats.deadLettered > 0
                 || manifest.stats.historyDegraded > 0
@@ -1766,6 +1988,19 @@ async function inspectContinuationState(stateDir) {
             details,
         };
     }
+    // Without a v3 manifest, derive one complete read-only recovery projection
+    // before choosing a status. A crash may leave a WAL, already-applied records
+    // after WAL removal, legacy inputs, or an activation marker in any
+    // combination; reporting one item as waiting must not mask another item that
+    // runtime recovery would reject.
+    const unmanifestedV3Transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v3.json"), CONTINUATION_RECORD_STORE_SCHEMA_VERSION);
+    if (!unmanifestedV3Transaction.valid) {
+        return { status: "error", details: [unmanifestedV3Transaction.detail] };
+    }
+    const unmanifestedV2Transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v2.json"), 2);
+    if (!unmanifestedV2Transaction.valid) {
+        return { status: "error", details: [unmanifestedV2Transaction.detail] };
+    }
     const legacyManifestPath = join(stateDir, "continuation-store-v2.json");
     let legacyManifestInfo;
     try {
@@ -1776,7 +2011,10 @@ async function inspectContinuationState(stateDir) {
             return { status: "error", details: [`Legacy continuation store manifest cannot be inspected: ${continuationReason(error)}`] };
         }
     }
+    let legacyManifestExists = false;
+    let legacyManifestDetails;
     if (legacyManifestInfo !== undefined) {
+        legacyManifestExists = true;
         if (!legacyManifestInfo.isFile() || legacyManifestInfo.isSymbolicLink()) {
             return { status: "error", details: ["Legacy continuation store manifest must be a regular file, not a symlink."] };
         }
@@ -1785,7 +2023,7 @@ async function inspectContinuationState(stateDir) {
             return { status: "error", details: [manifestSecurityError] };
         let legacyManifest;
         try {
-            legacyManifest = JSON.parse(await readFile(legacyManifestPath, "utf8"));
+            legacyManifest = JSON.parse(await readBoundedOwnerOnlyFile(legacyManifestPath, MAX_MANIFEST_BYTES, "Continuation v2 manifest"));
         }
         catch (error) {
             return { status: "error", details: [`Legacy continuation store manifest contains invalid JSON: ${continuationReason(error)}`] };
@@ -1793,22 +2031,71 @@ async function inspectContinuationState(stateDir) {
         if (!isContinuationStoreManifest(legacyManifest, 2, "per-record-v2")) {
             return { status: "error", details: ["Legacy continuation store manifest has an unsupported or malformed schema."] };
         }
-        const legacyRecordsDirectory = join(stateDir, "records-v2");
-        const recordsDirectoryError = await inspectContinuationRecordsDirectory(legacyRecordsDirectory, {
+        legacyManifestDetails = [
+            `Legacy store v2 awaiting v3 migration: ${String(legacyManifest.stats.records)} retained; ${String(legacyManifest.stats.active)} active; ${String(legacyManifest.stats.unresolvedDelivery)} delivery unknown; ${String(legacyManifest.stats.deadLettered)} dead-lettered; ${String(legacyManifest.stats.historyDegraded)} history-degraded deliveries; ${String(legacyManifest.stats.terminalTombstones)} terminal tombstones; ${String(legacyManifest.stats.compacted)} compacted; ${String(legacyManifest.stats.capturedText)} captured answers.`,
+            `Retention: at most ${String(legacyManifest.stats.limits.terminalMaxRecords)} terminal tombstones with a maximum age of ${String(legacyManifest.stats.limits.terminalMaxAgeMs)} ms and ${String(legacyManifest.stats.limits.capturedTextMaxRecords)} captured answers with a maximum age of ${String(legacyManifest.stats.limits.capturedTextMaxAgeMs)} ms.`,
+        ];
+    }
+    const legacyV1Path = join(stateDir, "continuations-v1.json");
+    const legacyV1 = await inspectContinuationEvidenceFile(legacyV1Path, "v1 store");
+    if (!legacyV1.valid)
+        return { status: "error", details: [legacyV1.detail] };
+    let v3Directory;
+    let v2Directory;
+    let projectedRecords;
+    let hasCommittedV3Records = false;
+    try {
+        v3Directory = await loadOptionalContinuationRecordsForRecoveryInspection(join(stateDir, "records-v3"));
+        hasCommittedV3Records = v3Directory.records.size > 0;
+        v2Directory = await loadOptionalContinuationRecordsForRecoveryInspection(join(stateDir, "records-v2"), {
             allowV2RollbackGuard: true,
         });
-        if (recordsDirectoryError !== undefined)
-            return { status: "error", details: [recordsDirectoryError] };
-        const transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v2.json"));
-        if (!transaction.valid)
-            return { status: "error", details: [transaction.detail] };
-        const rollbackGuard = await inspectContinuationRollbackGuard(join(legacyRecordsDirectory, CONTINUATION_V2_ROLLBACK_GUARD), false);
-        if (!rollbackGuard.valid)
-            return { status: "error", details: [rollbackGuard.detail] };
+        const legacyRecords = v2Directory.records;
+        if (unmanifestedV2Transaction.transaction !== undefined) {
+            applyContinuationTransactionForInspection(legacyRecords, unmanifestedV2Transaction.transaction);
+        }
+        if (legacyV1.exists) {
+            mergeMigrationRecords(legacyRecords, await loadLegacyStore(legacyV1Path), "recoverable v1 and v2");
+        }
+        projectedRecords = v3Directory.records;
+        if (unmanifestedV3Transaction.transaction !== undefined) {
+            applyContinuationTransactionForInspection(projectedRecords, unmanifestedV3Transaction.transaction);
+        }
+        normalizeLegacyContinuationRecords(projectedRecords);
+        mergeMigrationRecords(projectedRecords, legacyRecords, "recoverable v2 and v3");
+    }
+    catch (error) {
+        return {
+            status: "error",
+            details: [`Continuation recovery evidence is malformed or conflicting: ${continuationReason(error)}`],
+        };
+    }
+    const originGroups = await inspectContinuationEvidenceDirectory(join(stateDir, "origin-context-groups-v1"), "origin-context activation directory", async () => projectedRecords);
+    if (!originGroups.valid)
+        return { status: "error", details: [originGroups.detail] };
+    try {
+        applyRetention(projectedRecords, retentionPolicy, new Date());
+    }
+    catch (error) {
+        return {
+            status: "error",
+            details: [`Continuation retention projection cannot be recovered safely: ${continuationReason(error)}`],
+        };
+    }
+    const rollbackGuard = await inspectContinuationRollbackGuard(join(stateDir, "records-v2", CONTINUATION_V2_ROLLBACK_GUARD), false, "The v2 rollback guard is not installed; the current runtime will install it during v3 migration before publishing v3 state.");
+    if (!rollbackGuard.valid)
+        return { status: "error", details: [rollbackGuard.detail] };
+    const recoverableEvidenceExists = legacyManifestExists
+        || v2Directory.exists
+        || hasCommittedV3Records
+        || unmanifestedV2Transaction.pending
+        || unmanifestedV3Transaction.pending
+        || originGroups.hasEntries;
+    if (recoverableEvidenceExists) {
         const owner = await inspectContinuationOwnerDatabase(join(stateDir, "continuations-owner.sqlite"));
         if (!owner.valid)
             return { status: "error", details: [owner.detail] };
-        details.push(`Legacy store v2 awaiting v3 migration: ${String(legacyManifest.stats.records)} retained; ${String(legacyManifest.stats.active)} active; ${String(legacyManifest.stats.unresolvedDelivery)} delivery unknown; ${String(legacyManifest.stats.deadLettered)} dead-lettered; ${String(legacyManifest.stats.historyDegraded)} history-degraded deliveries; ${String(legacyManifest.stats.terminalTombstones)} terminal tombstones; ${String(legacyManifest.stats.capturedText)} captured answers.`, `Retention: at most ${String(legacyManifest.stats.limits.terminalMaxRecords)} terminal tombstones and ${String(legacyManifest.stats.limits.capturedTextMaxRecords)} captured answers.`, transaction.detail, rollbackGuard.detail, owner.detail);
+        details.push(...(legacyManifestDetails ?? ["Continuation records are awaiting completion of the v3 manifest."]), ...(unmanifestedV2Transaction.pending ? [unmanifestedV2Transaction.detail] : []), ...(unmanifestedV3Transaction.pending ? [unmanifestedV3Transaction.detail] : []), rollbackGuard.detail, originGroups.detail, owner.detail);
         return { status: "waiting", details };
     }
     const storePath = join(stateDir, "continuations-v1.json");
@@ -1834,7 +2121,7 @@ async function inspectContinuationState(stateDir) {
     }
     let parsed;
     try {
-        parsed = JSON.parse(await readFile(storePath, "utf8"));
+        parsed = JSON.parse(await readBoundedOwnerOnlyFile(storePath, MAX_LEGACY_STORE_BYTES, "Continuation legacy store"));
     }
     catch (error) {
         return { status: "error", details: [`Continuation ledger contains invalid JSON: ${continuationReason(error)}`] };
@@ -1936,6 +2223,14 @@ async function inspectContinuationRecordsDirectory(path, options = {}) {
             const securityError = continuationOwnershipError(recordInfo, "record", 0o600);
             if (securityError !== undefined)
                 return securityError;
+            if (entry.name.startsWith(".") && entry.name.endsWith(".tmp")) {
+                try {
+                    await readBoundedOwnerOnlyFile(join(path, entry.name), MAX_RECORD_BYTES, "Continuation temporary record");
+                }
+                catch (error) {
+                    return `Continuation temporary record is unsafe: ${continuationReason(error)}`;
+                }
+            }
         }
     }
     catch (error) {
@@ -1943,7 +2238,247 @@ async function inspectContinuationRecordsDirectory(path, options = {}) {
     }
     return undefined;
 }
-async function inspectContinuationRollbackGuard(path, required) {
+async function inspectContinuationEvidenceDirectory(path, label, loadRecoverableRecords) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? { valid: true, hasEntries: false, hasTemporaryDebris: false, detail: `${label} has not been created.` }
+            : {
+                valid: false,
+                hasEntries: false,
+                hasTemporaryDebris: false,
+                detail: `${label} cannot be inspected: ${continuationReason(error)}`,
+            };
+    }
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+        return { valid: false, hasEntries: false, hasTemporaryDebris: false, detail: `${label} must be a real directory.` };
+    }
+    const securityError = continuationOwnershipError(info, label, 0o700);
+    if (securityError !== undefined) {
+        return { valid: false, hasEntries: false, hasTemporaryDebris: false, detail: securityError };
+    }
+    try {
+        const entries = await readdir(path, { withFileTypes: true });
+        const temporaryEntries = entries.filter((entry) => entry.name.startsWith(".") && entry.name.endsWith(".tmp"));
+        let projectedRecords;
+        const recordsForRecovery = async () => {
+            if (projectedRecords !== undefined)
+                return projectedRecords;
+            projectedRecords = await loadRecoverableRecords();
+            return projectedRecords;
+        };
+        for (const entry of entries) {
+            const entryPath = join(path, entry.name);
+            const temporary = entry.name.startsWith(".") && entry.name.endsWith(".tmp");
+            if (temporary) {
+                if (!entry.isFile() || entry.isSymbolicLink()) {
+                    return {
+                        valid: false,
+                        hasEntries: true,
+                        hasTemporaryDebris: true,
+                        detail: `${label} temporary entry must be a regular file: ${entry.name}.`,
+                    };
+                }
+                try {
+                    await readBoundedOwnerOnlyFile(entryPath, 64 * 1024, "Continuation origin-context group temporary");
+                }
+                catch (error) {
+                    return {
+                        valid: false,
+                        hasEntries: false,
+                        hasTemporaryDebris: true,
+                        detail: `${label} temporary entry is unsafe: ${continuationReason(error)}`,
+                    };
+                }
+                continue;
+            }
+            if (!/^[a-f0-9]{64}\.json$/u.test(entry.name) || !entry.isFile() || entry.isSymbolicLink()) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} contains an unexpected entry: ${entry.name}.`,
+                };
+            }
+            const entryInfo = await lstat(entryPath);
+            if (!entryInfo.isFile() || entryInfo.isSymbolicLink() || entryInfo.nlink !== 1) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker must be a single-link regular file: ${entry.name}.`,
+                };
+            }
+            const entrySecurityError = continuationOwnershipError(entryInfo, `${label} marker`, 0o600);
+            if (entrySecurityError !== undefined) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: entrySecurityError,
+                };
+            }
+            if (entryInfo.size > 64 * 1024) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker exceeds its safety limit: ${entry.name}.`,
+                };
+            }
+            let markerBody;
+            try {
+                markerBody = await readBoundedOwnerOnlyFile(entryPath, 64 * 1024, "Continuation origin-context group commit");
+            }
+            catch (error) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker is unsafe to read: ${continuationReason(error)}`,
+                };
+            }
+            let marker;
+            try {
+                marker = JSON.parse(markerBody);
+            }
+            catch (error) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker contains invalid JSON: ${continuationReason(error)}`,
+                };
+            }
+            if (!isOriginContextGroupCommit(marker) || `${marker.groupKey}.json` !== entry.name) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker has a malformed schema or filename: ${entry.name}.`,
+                };
+            }
+            try {
+                applyOriginContextGroupCommit(await recordsForRecovery(), marker);
+            }
+            catch (error) {
+                return {
+                    valid: false,
+                    hasEntries: true,
+                    hasTemporaryDebris: temporaryEntries.length > 0,
+                    detail: `${label} marker does not match the recoverable durable records: ${continuationReason(error)}`,
+                };
+            }
+        }
+        const markerCount = entries.length - temporaryEntries.length;
+        const hasEntries = markerCount > 0;
+        const detail = markerCount > 0
+            ? `${label} contains ${markerCount === 1 ? "a durable marker" : `${String(markerCount)} durable markers`} awaiting idempotent recovery${temporaryEntries.length > 0 ? ", plus incomplete temporary debris awaiting cleanup" : ""}.`
+            : temporaryEntries.length > 0
+                ? `${label} contains only incomplete temporary debris awaiting cleanup.`
+                : `${label} is owner-only and empty.`;
+        return {
+            valid: true,
+            hasEntries,
+            hasTemporaryDebris: temporaryEntries.length > 0,
+            detail,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            hasEntries: false,
+            hasTemporaryDebris: false,
+            detail: `${label} cannot be inspected: ${continuationReason(error)}`,
+        };
+    }
+}
+async function loadContinuationRecordsForRecoveryInspection(path) {
+    const records = new Map();
+    for (const entry of await readdir(path, { withFileTypes: true })) {
+        if (entry.name.startsWith(".") && entry.name.endsWith(".tmp"))
+            continue;
+        if (!entry.name.endsWith(".json"))
+            continue;
+        const entryPath = join(path, entry.name);
+        let value;
+        try {
+            value = JSON.parse(await readBoundedOwnerOnlyFile(entryPath, MAX_RECORD_BYTES, "Continuation record"));
+        }
+        catch (error) {
+            throw new Error(`Continuation record cannot be validated for activation recovery: ${entry.name}`, {
+                cause: error,
+            });
+        }
+        if (!isDoctorObject(value)
+            || typeof value.continuationId !== "string"
+            || !isRecord(value, value.continuationId)
+            || `${continuationDigest(value.continuationId)}.json` !== entry.name
+            || records.has(value.continuationId)) {
+            throw new Error(`Continuation record has a malformed schema, duplicate id, or mismatched filename: ${entry.name}`);
+        }
+        records.set(value.continuationId, structuredClone(value));
+    }
+    return records;
+}
+async function loadOptionalContinuationRecordsForRecoveryInspection(path, options = {}) {
+    try {
+        const info = await lstat(path);
+        if (!info.isDirectory() || info.isSymbolicLink()) {
+            throw new Error("Continuation record directory must be a real directory, not a file or symlink.");
+        }
+    }
+    catch (error) {
+        if (continuationFsCode(error) === "ENOENT") {
+            return { exists: false, records: new Map() };
+        }
+        throw error;
+    }
+    const inspectionError = await inspectContinuationRecordsDirectory(path, options);
+    if (inspectionError !== undefined)
+        throw new Error(inspectionError);
+    return {
+        exists: true,
+        records: await loadContinuationRecordsForRecoveryInspection(path),
+    };
+}
+function applyContinuationTransactionForInspection(records, transaction) {
+    for (const record of transaction.writes) {
+        records.set(record.continuationId, structuredClone(record));
+    }
+    for (const id of transaction.deletes)
+        records.delete(id);
+}
+async function inspectContinuationEvidenceFile(path, label) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? { valid: true, exists: false, detail: `Legacy continuation ${label} is absent.` }
+            : {
+                valid: false,
+                exists: false,
+                detail: `Legacy continuation ${label} cannot be inspected: ${continuationReason(error)}`,
+            };
+    }
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+        return {
+            valid: false,
+            exists: true,
+            detail: `Legacy continuation ${label} must be a single-link regular file.`,
+        };
+    }
+    const securityError = continuationOwnershipError(info, `legacy ${label}`, 0o600);
+    return securityError === undefined
+        ? { valid: true, exists: true, detail: `Legacy continuation ${label} is owner-only.` }
+        : { valid: false, exists: true, detail: securityError };
+}
+async function inspectContinuationRollbackGuard(path, required, missingDetail = "The v2 rollback guard is not installed; the current runtime will install it during v3 migration.") {
     let info;
     try {
         info = await lstat(path);
@@ -1952,12 +2487,12 @@ async function inspectContinuationRollbackGuard(path, required) {
         if (continuationFsCode(error) === "ENOENT") {
             return required
                 ? { valid: false, detail: "Continuation v2 rollback guard is missing from the v3 store." }
-                : { valid: true, detail: "The v2 rollback guard is not installed; the current runtime will install it during v3 migration." };
+                : { valid: true, detail: missingDetail };
         }
         return { valid: false, detail: `Continuation v2 rollback guard cannot be inspected: ${continuationReason(error)}` };
     }
-    if (!info.isFile() || info.isSymbolicLink()) {
-        return { valid: false, detail: "Continuation v2 rollback guard must be a regular file, not a symlink." };
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+        return { valid: false, detail: "Continuation v2 rollback guard must be a single-link regular file, not a symlink." };
     }
     const securityError = continuationOwnershipError(info, "v2 rollback guard", 0o600);
     if (securityError !== undefined)
@@ -1967,7 +2502,7 @@ async function inspectContinuationRollbackGuard(path, required) {
     }
     let contents;
     try {
-        contents = await readFile(path, "utf8");
+        contents = await readBoundedOwnerOnlyFile(path, 4 * 1024, "Continuation v2 rollback guard");
     }
     catch (error) {
         return { valid: false, detail: `Continuation v2 rollback guard cannot be read: ${continuationReason(error)}` };
@@ -1980,26 +2515,62 @@ async function inspectContinuationRollbackGuard(path, required) {
         detail: "The owner-only v2 rollback guard prevents older runtimes from opening stale continuation records.",
     };
 }
-async function inspectContinuationTransaction(path) {
+async function inspectContinuationTransaction(path, expectedSchemaVersion) {
+    const versionLabel = `v${String(expectedSchemaVersion)}`;
     let info;
     try {
         info = await lstat(path);
     }
     catch (error) {
         return continuationFsCode(error) === "ENOENT"
-            ? { valid: true, pending: false, detail: "No interrupted durable transaction is awaiting recovery." }
-            : { valid: false, pending: false, detail: `Continuation transaction cannot be inspected: ${continuationReason(error)}` };
+            ? { valid: true, pending: false, detail: `No interrupted durable ${versionLabel} transaction is awaiting recovery.` }
+            : {
+                valid: false,
+                pending: false,
+                detail: `Continuation ${versionLabel} transaction cannot be inspected: ${continuationReason(error)}`,
+            };
     }
-    if (!info.isFile() || info.isSymbolicLink()) {
-        return { valid: false, pending: true, detail: "Continuation transaction must be a regular file, not a symlink." };
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+        return {
+            valid: false,
+            pending: true,
+            detail: `Continuation ${versionLabel} transaction must be a single-link regular file, not a symlink.`,
+        };
     }
-    const securityError = continuationOwnershipError(info, "transaction", 0o600);
+    const securityError = continuationOwnershipError(info, `${versionLabel} transaction`, 0o600);
     if (securityError !== undefined)
         return { valid: false, pending: true, detail: securityError };
+    let transaction;
+    try {
+        transaction = JSON.parse(await readBoundedOwnerOnlyFile(path, MAX_TRANSACTION_BYTES, `Continuation ${versionLabel} transaction`));
+    }
+    catch (error) {
+        return {
+            valid: false,
+            pending: true,
+            detail: `Continuation ${versionLabel} transaction cannot be read as bounded JSON: ${continuationReason(error)}`,
+        };
+    }
+    if (!isRecordTransaction(transaction, expectedSchemaVersion)) {
+        return {
+            valid: false,
+            pending: true,
+            detail: `Continuation ${versionLabel} transaction has an unsupported or malformed schema.`,
+        };
+    }
+    const oversizedRecord = transaction.writes.find((record) => Buffer.byteLength(`${JSON.stringify(record, null, 2)}\n`, "utf8") > MAX_RECORD_BYTES);
+    if (oversizedRecord !== undefined) {
+        return {
+            valid: false,
+            pending: true,
+            detail: `Continuation ${versionLabel} transaction contains a record over its ${String(MAX_RECORD_BYTES)} byte safety limit: ${oversizedRecord.continuationId}.`,
+        };
+    }
     return {
         valid: true,
         pending: true,
-        detail: "An interrupted durable transaction is present and will be completed idempotently by the state owner.",
+        transaction,
+        detail: `An interrupted durable ${versionLabel} transaction is present and will be completed idempotently by the state owner.`,
     };
 }
 function continuationOwnershipError(info, label, expectedMode) {
@@ -2012,14 +2583,14 @@ function continuationOwnershipError(info, label, expectedMode) {
     return undefined;
 }
 function isContinuationLedger(value) {
-    return isDoctorObject(value)
-        && value.schemaVersion === CONTINUATION_STORE_SCHEMA_VERSION
-        && isDoctorObject(value.records);
+    return isStoreFile(value);
 }
 function isContinuationStoreManifest(value, schemaVersion, format) {
     if (!isDoctorObject(value)
         || value.schemaVersion !== schemaVersion
-        || typeof value.generation !== "string"
+        || !isDurableGeneration(value.generation)
+        || !requiredDate(value.updatedAt)
+        || (value.rollbackGuardRequired !== undefined && typeof value.rollbackGuardRequired !== "boolean")
         || !isDoctorObject(value.stats)
         || value.stats.format !== format
         || !isDoctorObject(value.stats.limits))
@@ -2364,7 +2935,7 @@ async function exporterSection(input, liveness) {
  */
 async function probeExporterEndpoint(endpoint) {
     const ctrl = new AbortController();
-    const timer = setTimeout(() => { ctrl.abort(); }, BUJO_PROBE_TIMEOUT_MS);
+    const timer = setTimeout(() => { ctrl.abort(); }, LIVENESS_PROBE_TIMEOUT_MS);
     try {
         const response = await fetch(endpoint, {
             method: "POST",