@murmurv2/cli 2.11.0

package/runtime/scripts/wake-monitor.mjs

@@ -0,0 +1,653 @@
+import { execFile } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+
+const ensureObject = (value) => (value && typeof value === "object" ? value : {});
+const DEFAULT_WAKE_MAX_ATTEMPTS = 5;
+const DEFAULT_WAKE_RETRY_BACKOFF_MS = 30_000;
+const DEFAULT_WAKE_RETRY_BACKOFF_MAX_MS = 10 * 60_000;
+const DEFAULT_WAKE_CONCURRENCY = 4;
+const validMode = (mode) => mode === "stateless" || mode === "codex_app_server";
+
+export const normalizeWakeConfig = (config = {}) => {
+  const wake = ensureObject(config.wake);
+  const dedup = ensureObject(wake.dedup);
+  const loopBreaker = ensureObject(wake.loopBreaker);
+  const retry = ensureObject(wake.retry);
+  const hookTimeoutMs = wake.hookTimeoutMs === undefined ? 10000 : wake.hookTimeoutMs;
+  if (!Number.isSafeInteger(hookTimeoutMs) || hookTimeoutMs < 1 || hookTimeoutMs > 2147483647) {
+    throw new Error("wake-hook-timeout-invalid");
+  }
+  const peers = Object.fromEntries(
+    Object.entries(ensureObject(wake.peers)).map(([agentId, peer]) => {
+      const value = ensureObject(peer);
+      const normalized = {
+        mode: validMode(value.mode) ? value.mode : undefined,
+        socketPath: typeof value.socketPath === "string" && value.socketPath.trim() ? value.socketPath.trim() : undefined,
+        threadId: typeof value.threadId === "string" && value.threadId.trim() ? value.threadId.trim() : undefined,
+      };
+      if (typeof value.cwd === "string" && value.cwd.trim()) normalized.cwd = value.cwd.trim();
+      if (typeof value.model === "string" && value.model.trim()) normalized.model = value.model.trim();
+      if (typeof value.murmurRoot === "string" && value.murmurRoot.trim()) normalized.murmurRoot = value.murmurRoot.trim();
+      if (typeof value.dataDir === "string" && value.dataDir.trim()) normalized.dataDir = value.dataDir.trim();
+      if (typeof value.storePath === "string" && value.storePath.trim()) normalized.storePath = value.storePath.trim();
+      if (value.relayFinalToMurmur === true) normalized.relayFinalToMurmur = true;
+      // Without this the injector's `peer.resume === false` opt-out is unreachable
+      // from a real config: normalization used to drop the field entirely.
+      if (typeof value.resume === "boolean") normalized.resume = value.resume;
+      // Same story for baseInstructions: the channel binding resolver falls back to
+      // `peer.baseInstructions`, so dropping it here makes per-peer role instructions
+      // impossible to configure — the only remaining lever is `personaId`, which Codex
+      // rejects for anything outside its own `none|friendly|pragmatic` enum.
+      if (typeof value.baseInstructions === "string" && value.baseInstructions.trim()) {
+        normalized.baseInstructions = value.baseInstructions;
+      }
+      if (Number.isFinite(Number(value.replyTimeoutMs))) normalized.replyTimeoutMs = Number(value.replyTimeoutMs);
+      for (const [key, min, max] of [["steer_batch_window_ms", 0, 60000], ["steer_max_per_turn", 1, 100]]) {
+        if (value[key] === undefined) continue;
+        if (!Number.isInteger(value[key]) || value[key] < min || value[key] > max) throw new Error(`wake-batch-invalid:${key}`);
+        normalized[key] = value[key];
+      }
+      return [agentId, normalized];
+    }),
+  );
+  return {
+    enabled: wake.enabled !== false,
+    hookTimeoutMs,
+    mode: validMode(wake.mode) ? wake.mode : "stateless",
+    peers,
+    auditHook: typeof wake.auditHook === "string" && wake.auditHook.trim() ? wake.auditHook.trim() : null,
+    dedup: {
+      cooldownMs: Number.isFinite(Number(dedup.cooldownMs)) ? Number(dedup.cooldownMs) : 300000,
+    },
+    loopBreaker: {
+      maxWakes: Number.isFinite(Number(loopBreaker.maxWakes)) ? Number(loopBreaker.maxWakes) : 5,
+      windowMs: Number.isFinite(Number(loopBreaker.windowMs)) ? Number(loopBreaker.windowMs) : 60000,
+    },
+    // #107 — how many wakes may run at once. Lanes are keyed per peer/conversation, so
+    // this bounds parallelism across conversations; within one, order is kept.
+    concurrency: Number.isFinite(Number(wake.concurrency)) && Number(wake.concurrency) >= 1 ? Math.floor(Number(wake.concurrency)) : DEFAULT_WAKE_CONCURRENCY,
+    // #105 — how long a delivery keeps being retried before it is dead-lettered.
+    retry: {
+      maxAttempts: Number.isFinite(Number(retry.maxAttempts)) ? Number(retry.maxAttempts) : DEFAULT_WAKE_MAX_ATTEMPTS,
+      backoffMs: Number.isFinite(Number(retry.backoffMs)) ? Number(retry.backoffMs) : DEFAULT_WAKE_RETRY_BACKOFF_MS,
+      backoffMaxMs: Number.isFinite(Number(retry.backoffMaxMs)) ? Number(retry.backoffMaxMs) : DEFAULT_WAKE_RETRY_BACKOFF_MAX_MS,
+    },
+  };
+};
+
+export const createShellHook = ({ command, timeoutMs = 10000, baseEnv = process.env, log = () => {} }) => {
+  if (!command) return null;
+  return (payload) => new Promise((resolve, reject) => {
+    const env = {
+      ...baseEnv,
+      MURMUR_FROM: payload.from,
+      MURMUR_TEXT: payload.text,
+      MURMUR_MSG_ID: payload.msgId,
+      MURMUR_CONVERSATION_ID: payload.conversationId,
+      MURMUR_CHANNEL_ID: payload.channelId || "",
+      MURMUR_SENDER_MEMBER_ID: payload.senderMemberId || "",
+      MURMUR_ADDRESSEE_MEMBER_ID: payload.addresseeMemberId || "",
+      ...(payload.env || {}),
+    };
+    execFile("sh", ["-c", command], { env, timeout: timeoutMs }, (err) => {
+      if (err) {
+        // execFile's message includes the command and captured output. Persist only
+        // a stable failure code; hooks may contain credentials or private content.
+        const reason = err.killed ? "timeout-or-killed" : String(err.code ?? err.signal ?? "failed");
+        const failure = new Error(`wake-hook-${reason}`);
+        // Shell convention: 126/127 means the command cannot execute/is absent.
+        // Other exit codes (including 2) can belong to the invoked application.
+        failure.retryable = !["ENOENT", "EACCES", "EPERM", 126, 127].includes(err.code);
+        log("warn", "wake hook failed", { error: failure.message, msgId: payload.msgId });
+        reject(failure);
+        return;
+      }
+      resolve();
+    });
+  });
+};
+
+export const createAuditShellHook = ({ command, timeoutMs = 10000, baseEnv = process.env, log = () => {} }) => {
+  if (!command) return null;
+  return (payload) => new Promise((resolve) => {
+    const env = {
+      ...baseEnv,
+      MURMUR_FROM: payload.from,
+      MURMUR_TEXT: payload.text,
+      MURMUR_MSG_ID: payload.msgId,
+      MURMUR_CONVERSATION_ID: payload.conversationId,
+      MURMUR_CHANNEL_ID: payload.channelId || "",
+      MURMUR_SENDER_MEMBER_ID: payload.senderMemberId || "",
+      MURMUR_ADDRESSEE_MEMBER_ID: payload.addresseeMemberId || "",
+      ...(payload.env || {}),
+    };
+    execFile("sh", ["-c", command], { env, timeout: timeoutMs }, (err, stdout) => {
+      if (err) {
+        log("warn", "wake audit hook failed", { error: err.message, msgId: payload.msgId });
+        resolve("deny");
+        return;
+      }
+      const verdict = String(stdout || "").split(/\r?\n/, 1)[0]?.trim();
+      resolve(verdict === "deny" || verdict === "require_approval" || verdict === "allow" ? verdict : "deny");
+    });
+  });
+};
+
+/** Exponential backoff for wake retries: base·2^(attempt−1), capped. */
+export const wakeRetryBackoffMs = (attempt, baseMs = DEFAULT_WAKE_RETRY_BACKOFF_MS, maxMs = DEFAULT_WAKE_RETRY_BACKOFF_MAX_MS) =>
+  Math.min(maxMs, baseMs * 2 ** Math.max(0, Number(attempt || 1) - 1));
+
+/** Rebuild the hook payload from a stored inbound row (backlog and retries come from the table). */
+export const payloadFromDeliveryRow = (row) => ({
+  from: row.sender,
+  text: row.text,
+  msgId: row.msgId,
+  conversationId: row.conversationId,
+  channelId: row.channelId,
+  senderMemberId: row.senderMemberId,
+  addresseeMemberId: row.addresseeMemberId,
+  wakeEligible: row.wakeEligible === undefined ? true : Boolean(row.wakeEligible),
+  ts: row.createdAt,
+  cursor: Number(row.rowid),
+});
+
+export class WakeMonitor {
+  constructor(options = {}) {
+    const wakeConfig = normalizeWakeConfig({ wake: options });
+    this.enabled = options.enabled ?? wakeConfig.enabled;
+    this.mode = options.mode ?? wakeConfig.mode;
+    this.peers = options.peers ?? wakeConfig.peers;
+    this.cooldownMs = options.dedup?.cooldownMs ?? wakeConfig.dedup.cooldownMs;
+    this.loopBreaker = {
+      maxWakes: options.loopBreaker?.maxWakes ?? wakeConfig.loopBreaker.maxWakes,
+      windowMs: options.loopBreaker?.windowMs ?? wakeConfig.loopBreaker.windowMs,
+    };
+    this.hook = options.hook || null;
+    this.injector = options.injector || null;
+    this.auditHook = options.auditHook || null;
+    this.leaseGate = options.leaseGate || null;
+    this.notify = options.notify || null;
+    this.loadBacklogAfter = options.loadBacklogAfter || null;
+    // #105 — durable delivery state (a SQLiteMessageStore or anything with the same
+    // claimWake / settleWake / listOpenWakes / wakeCursor / recoverInflightWakes shape).
+    // With it, the table is the queue: the cursor is derived from settled rows, a failed
+    // wake is retried under the same delivery id, and a restart resumes from where the
+    // rows say it stopped. Without it the monitor behaves exactly as before.
+    this.deliveries = options.deliveries || null;
+    if (Object.entries(this.peers).some(([from]) => this.batchOptions({ from })) &&
+        (!this.deliveries?.assignWakeBatch || !this.deliveries?.settleWakeBatch || !this.deliveries?.getWakeBatch)) {
+      throw new Error("wake-batching-requires-durable-store");
+    }
+    this.maxAttempts = Number.isFinite(Number(options.maxAttempts)) ? Number(options.maxAttempts) : wakeConfig.retry.maxAttempts;
+    this.retryBackoffMs = Number.isFinite(Number(options.retryBackoffMs)) ? Number(options.retryBackoffMs) : wakeConfig.retry.backoffMs;
+    this.retryBackoffMaxMs = Number.isFinite(Number(options.retryBackoffMaxMs)) ? Number(options.retryBackoffMaxMs) : wakeConfig.retry.backoffMaxMs;
+    this.recoveredInflight = false;
+    this.concurrency = Number.isFinite(Number(options.concurrency)) && Number(options.concurrency) >= 1
+      ? Math.floor(Number(options.concurrency))
+      : wakeConfig.concurrency;
+    this.dispatchSignal = null;
+    this.now = options.now || (() => Date.now());
+    this.log = options.log || (() => {});
+    this.seen = new Map();
+    this.senderWindows = new Map();
+    this.suspendedSenders = new Map();
+    this.queue = [];
+    this.queuedKeys = new Set();
+    this.enqueuedAt = new Map();
+    this.processing = false;
+    this.cursor = Number.isFinite(Number(options.initialCursor)) ? Number(options.initialCursor) : 0;
+  }
+
+  async onInbound(payload) {
+    if (!this.enabled) return;
+    this.enqueue(payload);
+    await this.drain();
+  }
+
+  enqueue(payload) {
+    if (!payload?.msgId) return;
+    const key = this.keyFor(payload);
+    if (this.queuedKeys.has(key)) return;
+    this.queuedKeys.add(key);
+    this.enqueuedAt.set(key, Date.now());
+    this.queue.push(payload);
+    this.kickDispatcher();
+  }
+
+  nowIso() {
+    return new Date(this.now()).toISOString();
+  }
+
+  /** Wake a drain that is parked on busy lanes: something new is in the queue. */
+  kickDispatcher() {
+    const signal = this.dispatchSignal;
+    this.dispatchSignal = null;
+    signal?.resolve();
+  }
+
+  /**
+   * #107 — lanes instead of one line. Every queued payload belongs to a lane (see
+   * `laneKeyFor`); at most `concurrency` lanes run at once and a lane never runs two
+   * payloads together, so a long turn for one peer no longer holds a short question for
+   * another, while messages within one conversation keep their order.
+   */
+  async runLanes() {
+    const active = new Map();
+    while (this.queue.length > 0 || active.size > 0) {
+      if (this.enabled && active.size < this.concurrency) {
+        const index = this.queue.findIndex((payload) => !active.has(this.laneKeyFor(payload)));
+        if (index >= 0) {
+          const [payload] = this.queue.splice(index, 1);
+          this.queuedKeys.delete(this.keyFor(payload));
+          const lane = this.laneKeyFor(payload);
+          const previousBatch = await this.deliveries?.getWakeBatch?.(payload.msgId);
+          if (!previousBatch && !this.batchOptions(payload)) this.enqueuedAt.delete(payload.msgId);
+          const run = (previousBatch || this.batchOptions(payload)
+            ? this.processLaneBatch(payload, previousBatch)
+            : this.processPayload(payload))
+            .catch((err) => {
+              const e = err instanceof Error ? err : new Error(String(err));
+              this.log("error", "WakeMonitor lane crashed", { error: e.message, msgId: payload.msgId, lane });
+            })
+            .then(() => { active.delete(lane); });
+          active.set(lane, run);
+          continue;
+        }
+      }
+      if (active.size === 0) break;
+      const parked = new Promise((resolve) => { this.dispatchSignal = { resolve }; });
+      await Promise.race([...active.values(), parked]);
+      this.dispatchSignal = null;
+    }
+  }
+
+  async drain() {
+    // The daemon timer enters here without onInbound(). Disabled means paused:
+    // keep rows and attempts intact, including recovery of old in-flight rows.
+    if (!this.enabled) return;
+    if (this.processing) {
+      this.kickDispatcher();
+      return;
+    }
+    this.processing = true;
+    try {
+      if (this.deliveries && !this.recoveredInflight) {
+        this.recoveredInflight = true;
+        const recovered = await this.deliveries.recoverInflightWakes?.({ now: this.nowIso() });
+        if (recovered) this.log("warn", "WakeMonitor recovered in-flight deliveries from a previous process", { count: recovered });
+        this.cursor = await this.deliveries.wakeCursor();
+      }
+      const offeredThisDrain = new Set();
+      while (this.enabled) {
+        await this.runLanes();
+        if (!this.enabled) break;
+
+        let backlog;
+        if (this.loadBacklogAfter) {
+          backlog = await this.loadBacklogAfter(this.cursor);
+        } else if (this.deliveries) {
+          const rows = await this.deliveries.listOpenWakes({ now: this.nowIso() });
+          // A row that came back after being processed in this very pass is not due
+          // again (its retry lies in the future); refusing it here keeps the loop finite.
+          backlog = rows.filter((row) => !offeredThisDrain.has(row.msgId)).map(payloadFromDeliveryRow);
+          for (const row of rows) offeredThisDrain.add(row.msgId);
+        }
+        if (!Array.isArray(backlog) || backlog.length === 0) break;
+        for (const payload of backlog) this.enqueue(payload);
+      }
+    } finally {
+      this.processing = false;
+    }
+  }
+
+  async processPayload(payload, { prepareOnly = false } = {}) {
+    const durable = Boolean(this.deliveries);
+    let claim = null;
+    if (durable) {
+      claim = await this.deliveries.claimWake(payload.msgId, { now: this.nowIso() });
+      if (!claim.claimed) {
+        // Handled, muted, dead-lettered, in flight elsewhere, or not yet due: whichever
+        // it is, this copy is not new work. The delivery itself already succeeded.
+        this.log("info", "WakeMonitor delivery already claimed", {
+          msgId: payload.msgId,
+          conversationId: payload.conversationId,
+          status: claim.status ?? null,
+        });
+        await this.advanceCursor(payload);
+        return;
+      }
+      payload.attempt = claim.attempts;
+    }
+    const settle = async (status, extra = {}) => {
+      if (durable) await this.deliveries.settleWake(payload.msgId, { status, ...extra, now: this.nowIso() });
+      await this.advanceCursor(payload);
+    };
+
+    // `wakeEligible` is a local receive-time authorization decision persisted by
+    // the daemon. Check it at the shared effect boundary so delayed backlog rows
+    // cannot bypass the immediate channel-addressing gate. Missing means legacy.
+    if (payload.wakeEligible === false) {
+      await settle("muted", { error: "receive-time-ineligible" });
+      this.log("info", "WakeMonitor policy mute", {
+        msgId: payload.msgId,
+        conversationId: payload.conversationId,
+        reason: "receive-time-ineligible",
+      });
+      return;
+    }
+    const key = this.keyFor(payload);
+    const now = this.now();
+    this.pruneSeen(now);
+    if (!durable) {
+      // Without durable state the in-memory cooldown is the only duplicate guard. With
+      // it, the claim above already refused every copy that is not a due retry.
+      const lastWakeAt = this.seen.get(key);
+      if (lastWakeAt !== undefined && now - lastWakeAt < this.cooldownMs) {
+        await this.advanceCursor(payload);
+        this.log("info", "WakeMonitor duplicate dropped", { msgId: payload.msgId, conversationId: payload.conversationId });
+        return;
+      }
+    }
+
+    this.seen.set(key, now);
+    if (!prepareOnly && await this.isLoopBreakerBlocked(payload, now)) {
+      await settle("muted", { error: "loop-breaker" });
+      return;
+    }
+
+    const verdict = await this.audit(payload);
+    if (verdict === "deny") {
+      this.log("warn", "WakeMonitor audit denied wake", { msgId: payload.msgId, conversationId: payload.conversationId, from: payload.from });
+      await settle("muted", { error: "audit-deny" });
+      return;
+    }
+    if (verdict === "require_approval") {
+      await this.notify?.(payload, "require_approval");
+      this.log("warn", "WakeMonitor audit requires approval", { msgId: payload.msgId, conversationId: payload.conversationId, from: payload.from });
+      await settle("muted", { error: "audit-require-approval" });
+      return;
+    }
+
+    // Scoped-channels lease gate (#82): the native daemon wake is a fallback owner.
+    // If a live chat session already owns this conversation, mute the native wake so it
+    // does not spawn a competing thread; otherwise claim and route as the cold-wake owner.
+    if (this.leaseGate) {
+      let decision;
+      try {
+        decision = await this.leaseGate(payload, this.peerFor(payload));
+      } catch (err) {
+        const e = err instanceof Error ? err : new Error(String(err));
+        decision = { allow: false, reason: `lease-gate-error:${e.message}` };
+      }
+      if (!decision || decision.allow !== true) {
+        this.log("info", "WakeMonitor lease mute (non-owner)", {
+          msgId: payload.msgId,
+          conversationId: payload.conversationId,
+          ownerSessionId: decision?.ownerSessionId ?? null,
+          reason: decision?.reason ?? "non-owner",
+        });
+        await settle("muted", { error: `lease:${decision?.reason ?? "non-owner"}` });
+        return;
+      }
+      payload.leaseToken = decision.token ?? null;
+    }
+
+    const execute = async (effect, settleEffect = settle) => {
+      let result;
+      try {
+        const peer = this.peerFor(payload);
+        if (effect) {
+          result = await effect();
+        } else if (peer.mode === "codex_app_server") {
+          if (!this.injector) throw new Error(`wake-native-injector-missing:${payload.from}`);
+          result = await this.injector(payload, peer);
+          this.log("info", "WakeMonitor native wake completed", { msgId: payload.msgId, conversationId: payload.conversationId, mode: peer.mode });
+        } else if (this.hook) {
+          result = await this.hook(payload);
+          this.log("info", "WakeMonitor hook completed", { msgId: payload.msgId, conversationId: payload.conversationId });
+        } else {
+          // Nothing was woken. There is no native injector for this peer and no onReceive
+          // hook, so the message reached the store and stopped there.
+          //
+          // This branch used to log "WakeMonitor hook completed" as well, which read as a
+          // delivered wake. On 2026-09-15 three messages landed on an agent whose config had
+          // neither `wake` nor `onReceive`; the log said "hook completed" four milliseconds
+          // after "Message received" for each of them, and an operator spent an hour looking
+          // for a broken responder that had never been configured. A log line that cannot
+          // distinguish "woke somebody" from "nobody to wake" is worse than no line at all.
+          this.log("warn", "WakeMonitor: hook not configured, message stored only", {
+            msgId: payload.msgId,
+            conversationId: payload.conversationId,
+            from: payload.from,
+          });
+          await settleEffect("stored-only", { error: "wake-no-responder" });
+          return;
+        }
+      } catch (err) {
+        const e = err instanceof Error ? err : new Error(String(err));
+        this.log("warn", "WakeMonitor hook error", { error: e.message, msgId: payload.msgId, attempt: claim?.attempts ?? null });
+        if (!durable) {
+          // Legacy behaviour: the failure is logged and the cursor moves on.
+          await this.advanceCursor(payload);
+          return;
+        }
+        const attempts = claim.attempts;
+        const retryable = e.retryable !== false && attempts < this.maxAttempts;
+        if (retryable) {
+          const delayMs = wakeRetryBackoffMs(attempts, this.retryBackoffMs, this.retryBackoffMaxMs);
+          await settleEffect("failed", { error: e.message, nextAttemptAt: new Date(this.now() + delayMs).toISOString() });
+          this.log("warn", "WakeMonitor wake scheduled for retry", { msgId: payload.msgId, attempt: attempts, retryInMs: delayMs });
+          return;
+        }
+        // Out of attempts, or the error says a retry cannot help: settle visibly. The
+        // delivery is done with — the cursor may pass it — but somebody gets told.
+        await settleEffect("dlq", { error: e.message });
+        await this.notify?.(payload, "wake-dlq");
+        this.log("error", "WakeMonitor wake dead-lettered", { msgId: payload.msgId, attempts, error: e.message, retryable: e.retryable !== false });
+        return;
+      }
+      const replyMsgId = result?.replyMsgId ?? result?.relay?.msgId ?? undefined;
+      await settleEffect("handled", replyMsgId ? { replyMsgId } : {});
+    };
+    if (prepareOnly) return execute;
+    await execute();
+  }
+
+  batchOptions(payload) {
+    const peer = this.peerFor(payload);
+    if (peer.mode !== "codex_app_server") return null;
+    if (peer.steer_batch_window_ms === undefined && peer.steer_max_per_turn === undefined) return null;
+    return { windowMs: peer.steer_batch_window_ms ?? 0, limit: peer.steer_max_per_turn ?? 20 };
+  }
+
+  batchKeyFor(payload) {
+    return JSON.stringify([payload.from, payload.conversationId, payload.channelId, payload.senderMemberId, payload.addresseeMemberId]);
+  }
+
+  async processLaneBatch(first, previousBatch) {
+    if (!this.deliveries?.assignWakeBatch || !this.deliveries?.settleWakeBatch) throw new Error("wake-batching-requires-durable-store");
+    const options = this.batchOptions(first) ?? { windowMs: 0, limit: 100 };
+    const key = this.batchKeyFor(first);
+    const lane = this.laneKeyFor(first);
+    let payloads;
+    if (previousBatch) {
+      payloads = previousBatch.messages.map(payloadFromDeliveryRow);
+      const ids = new Set(payloads.map((p) => p.msgId));
+      this.queue = this.queue.filter((p) => !ids.has(p.msgId));
+    } else {
+      // Messages remain pending in SQLite throughout the quiet window. A stopped
+      // session therefore leaves a recoverable queue, never an in-memory-only batch.
+      while (options.windowMs > 0) {
+        const same = this.queue.filter((p) => this.batchKeyFor(p) === key);
+        if (same.length + 1 >= options.limit) break;
+        const latest = Math.max(this.enqueuedAt.get(first.msgId) ?? 0, ...same.map((p) => this.enqueuedAt.get(p.msgId) ?? 0));
+        const remaining = latest + options.windowMs - Date.now();
+        if (remaining <= 0) break;
+        await delay(remaining);
+      }
+      payloads = [first];
+      for (let i = 0; i < this.queue.length && payloads.length < options.limit;) {
+        const candidate = this.queue[i];
+        if (this.laneKeyFor(candidate) !== lane) { i += 1; continue; }
+        // Never step over another conversation/member in the same static thread.
+        if (this.batchKeyFor(candidate) !== key || await this.deliveries.getWakeBatch(candidate.msgId)) break;
+        payloads.push(...this.queue.splice(i, 1));
+      }
+    }
+    for (const payload of payloads) {
+      this.queuedKeys.delete(this.keyFor(payload));
+      this.enqueuedAt.delete(this.keyFor(payload));
+    }
+    const ready = [];
+    for (const payload of payloads) {
+      const run = await this.processPayload(payload, { prepareOnly: true });
+      if (run) ready.push({ payload, run });
+    }
+    if (ready.length === 0) return;
+    if (previousBatch && ready.length !== payloads.length) {
+      // A previously grouped member is now muted/not claimable. Do not replay its
+      // content by borrowing another member's permission or silently regroup IDs.
+      await this.deliveries.settleWakeBatch(ready.map(({ payload }) => ({ msgId: payload.msgId, input: { status: "muted", error: "batch-member-ineligible", now: this.nowIso() } })));
+      await this.advanceCursor(first);
+      this.log("warn", "WakeMonitor batch blocked by member eligibility", { batchId: previousBatch.batchId });
+      return;
+    }
+    // The breaker limits wake effects, so a batch counts once, not once per letter.
+    if (await this.isLoopBreakerBlocked(ready[0].payload, this.now())) {
+      await this.deliveries.settleWakeBatch(ready.map(({ payload }) => ({ msgId: payload.msgId, input: { status: "muted", error: "loop-breaker", now: this.nowIso() } })));
+      await this.advanceCursor(first);
+      return;
+    }
+    if (ready.length === 1 && !previousBatch) { await ready[0].run(); return; }
+    let batch;
+    try {
+      batch = previousBatch ?? await this.deliveries.assignWakeBatch(ready.map(({ payload }) => payload.msgId));
+    } catch (error) {
+      await this.deliveries.settleWakeBatch(ready.map(({ payload }) => ({ msgId: payload.msgId, input: { status: "failed", error: String(error), nextAttemptAt: new Date(this.now() + this.retryBackoffMs).toISOString(), now: this.nowIso() } })));
+      throw error;
+    }
+    const combined = {
+      ...ready[0].payload,
+      leaseToken: ready.at(-1).payload.leaseToken,
+      msgId: batch.batchId,
+      batchMsgIds: ready.map(({ payload }) => payload.msgId),
+      text: ready.map(({ payload }) => `[Murmur message ${payload.msgId}]\n${payload.text}`).join("\n\n"),
+    };
+    this.log("info", "WakeMonitor batch dispatch", { msgId: batch.batchId, msgIds: combined.batchMsgIds, count: ready.length, remaining: this.queue.filter((p) => this.laneKeyFor(p) === lane).length });
+    // All pre-effect audit/eligibility/lease gates ran for every individual member.
+    let outcome;
+    try {
+      if (!this.injector) throw new Error(`wake-native-injector-missing:${first.from}`);
+      const result = await this.injector(combined, this.peerFor(first));
+      const replyMsgId = result?.replyMsgId ?? result?.relay?.msgId;
+      outcome = { status: "handled", ...(replyMsgId ? { replyMsgId } : {}), now: this.nowIso() };
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      // One effect has one retry deadline and terminal decision. Per-member clocks
+      // or prior attempts must not leave half a persisted batch ineligible to retry.
+      const attempts = Math.max(...ready.map(({ payload }) => payload.attempt));
+      const retryable = error.retryable !== false && attempts < this.maxAttempts;
+      const now = this.now();
+      outcome = { status: retryable ? "failed" : "dlq", error: error.message, now: new Date(now).toISOString(),
+        ...(retryable ? { nextAttemptAt: new Date(now + wakeRetryBackoffMs(attempts, this.retryBackoffMs, this.retryBackoffMaxMs)).toISOString() } : {}) };
+      this.log("warn", "WakeMonitor batch effect failed", { batchId: batch.batchId, attempts, status: outcome.status, error: error.message });
+    }
+    await this.deliveries.settleWakeBatch(ready.map(({ payload }) => ({ msgId: payload.msgId, input: outcome })));
+    await this.advanceCursor(first);
+    if (outcome.status === "dlq") for (const { payload } of ready) await this.notify?.(payload, "wake-dlq");
+  }
+
+  pruneSeen(now = this.now()) {
+    for (const [key, wokeAt] of this.seen.entries()) {
+      if (now - wokeAt >= this.cooldownMs) this.seen.delete(key);
+    }
+  }
+
+  async isLoopBreakerBlocked(payload, now) {
+    const sender = payload.from || "unknown";
+    const suspendedUntil = this.suspendedSenders.get(sender);
+    if (suspendedUntil !== undefined) {
+      if (now < suspendedUntil) {
+        this.suspendedSenders.set(sender, now + this.loopBreaker.windowMs);
+        await this.notify?.(payload, "loop-breaker");
+        this.log("warn", "WakeMonitor loop-breaker suspended wake", { sender, msgId: payload.msgId, suspendedUntil: this.suspendedSenders.get(sender) });
+        return true;
+      }
+      this.suspendedSenders.delete(sender);
+    }
+
+    const since = now - this.loopBreaker.windowMs;
+    const window = (this.senderWindows.get(sender) || []).filter((ts) => ts > since);
+    if (window.length >= this.loopBreaker.maxWakes) {
+      this.suspendedSenders.set(sender, now + this.loopBreaker.windowMs);
+      this.senderWindows.set(sender, window);
+      await this.notify?.(payload, "loop-breaker");
+      this.log("warn", "WakeMonitor loop-breaker tripped", { sender, count: window.length + 1, msgId: payload.msgId });
+      return true;
+    }
+
+    window.push(now);
+    this.senderWindows.set(sender, window);
+    return false;
+  }
+
+  async audit(payload) {
+    if (!this.auditHook) return "allow";
+    const verdict = await this.auditHook(payload);
+    return verdict === "allow" || verdict === "require_approval" || verdict === "deny" ? verdict : "deny";
+  }
+
+  async advanceCursor(payload) {
+    if (this.deliveries) {
+      // The cursor is not a counter we bump: it is the highest contiguous settled
+      // delivery, read back from the rows. A gap holds it; nothing skips it.
+      this.cursor = await this.deliveries.wakeCursor();
+      return;
+    }
+    const cursor = Number(payload?.cursor);
+    if (Number.isFinite(cursor) && cursor > this.cursor) this.cursor = cursor;
+  }
+
+  keyFor(payload) {
+    return payload.msgId;
+  }
+
+  /**
+   * Which payloads must never run together. A Codex peer pinned to one static thread
+   * takes one turn at a time whatever the conversation; everything else is serialised
+   * per (peer, conversation), which is also how #108 scopes Codex threads.
+   */
+  laneKeyFor(payload) {
+    const peer = this.peerFor(payload);
+    if (peer.mode === "codex_app_server" && peer.threadId) return `peer:${payload.from}`;
+    return `conv:${payload.from}|${payload.conversationId ?? ""}`;
+  }
+
+  /**
+   * Can this monitor wake anybody at all?
+   *
+   * `configured: false` means every inbound message will be stored and nothing else —
+   * the zero-responder state that reads like a working contour until somebody waits
+   * half an hour for a reply. Surfaced by the daemon on startup so it is visible
+   * before the first message arrives, not only in the per-message log afterwards.
+   */
+  responderStatus() {
+    const peers = ensureObject(this.peers);
+    const nativePeers = Object.keys(peers).filter(
+      (agentId) => (validMode(peers[agentId]?.mode) ? peers[agentId].mode : this.mode) === "codex_app_server",
+    );
+    const hook = Boolean(this.hook);
+    // A native peer without an injector wired in is not a responder, it is an error waiting
+    // to be thrown on the first message — do not count it as configured.
+    const native = Boolean(this.injector) && (this.mode === "codex_app_server" || nativePeers.length > 0);
+    return { configured: hook || native, hook, native, nativePeers };
+  }
+
+  peerFor(payload) {
+    const peer = ensureObject(this.peers?.[payload.from]);
+    return {
+      ...peer,
+      mode: validMode(peer.mode) ? peer.mode : this.mode,
+    };
+  }
+}