@open-everywhere/core 0.1.0

package/dist/agent/channels/generation-retirement.js

@@ -0,0 +1,473 @@
+// generation-retirement — terminally retire the OUTGOING seat generation at a window rotation, so that eve's own child reaper takes the children that generation left behind (OPE-627, split out of OPE-566 T5).
+//
+// ── WHAT A ROTATION USED TO LEAVE BEHIND ────────────────────────────────────────────────────────
+// A background worker PARKS when its task settles, and it never dies on its own. A rotation mints
+// generation N+1 and repoints the `channel_session` row at it, but generation N's own eve session
+// stays alive with every parked worker still attached to it. No seat on this deployment was ever
+// terminally retired, so eve's child reaper never ran anywhere.
+// A `reset` is the one act that runs that reaper: eve's `reset` arm calls `finalizeExpiredSession`,
+// which awaits `terminateChildSessionsStep` — the same reaper session expiry runs. It takes every
+// indexed task and every local child handle in one step. `packages/core/scripts/parked-child-lifecycle-test.ts` pins those bytes.
+//
+// ── 🔴 WHAT THE REAPER WOULD TAKE, AND THE GUARD THAT STOPS IT (OPE-1620) ───────────────────────
+// eve's reaper makes no distinction by task status. `terminate-child-sessions-step.js` awaits
+// `cancelAllIndexedSessionTasksStep` unconditionally, which loops EVERY entry in the session task
+// index through `cancelOwnedTask`, then `cancelRun`s every local child handle. So retiring a
+// generation would cancel its `working` and `input_required` delegations too — work a human asked
+// for and is still waiting on — and the room would NOT be told: the settlement wake never fires, and
+// no audit row names the cancelled work.
+// THE FIRST THREE GUARDS DO NOT COVER IT. A background worker holds no turn anchor, so the live-turn
+// guard reads `none` and the retirement would proceed. What the question needs is a DURABLE,
+// GENERATION-KEYED record of live delegations, and neither record this build already had is one:
+// the live-delegated set is session-local `defineState` (`access/live-delegated-tasks.ts`), readable
+// only inside the owning session's own hook context, and the delegation census rows key on an eve
+// SESSION id, which OE never holds for a seat generation.
+// {@link noteGenerationDelegation} is that record — see §THE OWED-DELEGATION LEDGER below — and the
+// FOURTH guard reads it.
+//
+// ── WHY THE RETIREMENT IS ISSUED FROM THE `unified` CHANNEL, AND NOWHERE ELSE ────────────────────
+// 🔴 CHANNEL LOCALITY IS THE WHOLE CONSTRAINT. eve dispatches a continuation command on the address
+// `${channelName}:${continuationToken}`, so `from(token).reset()` reaches only a session that lives
+// on the CALLING channel. Every window seat and every DM seat on this build lives on `unified`
+// (channels/unified.ts), so a Slack or GitHub route cannot retire one — its `from` can only ever
+// address `slack:<token>`. The other door, `attachSession(sessionId).reset()`, is channel-agnostic
+// but needs a durable eve session id, and Open Everywhere holds none for a seat generation.
+// So the retirement is issued in the `unified` channel's own `receive`, which is handed `from`.
+//
+// ── WHY IT IS A TWO-STEP HAND-OFF ───────────────────────────────────────────────────────────────
+// The rotation seam and the retirement door are in two different modules and only one of them holds
+// `from`. {@link noteGenerationForRetirement} records the outgoing token at the rotation;
+// {@link drainGenerationRetirements} retires it inside the next unified `receive`. The two run in
+// ONE process and usually in one call stack: eve's cross-channel `to(channel, target).send()`
+// invokes the target channel's `receive` directly, in-process (eve `channel/cross-channel-receive.js`),
+// and a rotation is always followed by the wake that caused it. The record is therefore process-local
+// and deliberately NOT durable — a retirement that is missed costs a generation's parked workers
+// their reap until the next rotation, and a retirement that fires on stale state would cost a live
+// turn (see the guards below). Bounded by {@link MAX_PENDING} so a rotation that never reaches a
+// receive cannot grow the list.
+//
+// ── THE OWED-DELEGATION LEDGER (OPE-1620) ───────────────────────────────────────────────────────
+// TWO DURABLE ROWS PER DISPATCH, in the operational store's task-result keyspace, both TTL-bounded:
+//   • `oe-gen-owes:<token>` — the task ids one generation dispatched and has not seen settle. This
+//     is the row the fourth guard reads, and the whole reason the ledger is keyed on the GENERATION
+//     rather than on the eve session: `from(token).reset()` is what the retirement issues, so the
+//     continuation token is the only handle both ends of this question hold.
+//   • `oe-task-gen:<taskId>` — the reverse pointer, so the SETTLEMENT can find the generation that
+//     dispatched the task. It must: a settlement can land on a turn whose seat has already rotated,
+//     where the seat's own token names the WRONG generation, and clearing the wrong row would leave
+//     the outgoing one owing forever.
+// 🔴 IT IS FAIL-SOFT ON THE WRITE AND FAIL-CLOSED ON THE READ. A dispatch whose write is lost simply
+// is not counted, which is the pre-OPE-1620 position; a read that THROWS refuses the retirement, the
+// same direction the registry and turn-anchor reads take. Both writers read-modify-write ONE row, so
+// a dispatch racing another dispatch — or racing a CLEAR, which rewrites the same list — can drop a
+// task the other just appended. A narrow, stated fail-open in both shapes, and the cost is one
+// uncounted task on one rotation.
+// 🔴 THE TTL IS WHAT BOUNDS A LEAK. A task that never settles — a crashed worker, a lost settlement
+// edge — would otherwise hold its generation un-reapable for the life of the deployment. At
+// {@link GENERATION_DELEGATION_TTL_MS} the row expires and the next rotation of that seat retires it
+// normally. The bound is the wake-target TTL, because past it the task's own `oe-task-wake:` row has
+// expired too: the report could no longer be delivered to the conversation that asked, so there is
+// no live work left to protect.
+//
+// ── THE FOUR GUARDS, AND WHY EACH ONE IS REAL ───────────────────────────────────────────────────
+//   • INCOMING. Never retire the token this wake is being delivered to. It is the fresh generation.
+//   • STILL-LIVE. The registry row must no longer point at the token. `carryTailForward` runs
+//     BEFORE `rotateChannelSession`, so a rotate that throws leaves the seat running on the very
+//     token this module was told to retire — the row is what proves the rotation completed.
+//   • LIVE TURN. A `reset` that lands mid-turn does not queue politely: eve's control receiver
+//     forwards a turn CANCELLATION first and then buffers the retirement, and Open Everywhere's own
+//     `turn.cancelled` hook posts a "Stood down" note into the room. A generation with a live turn
+//     anchor is therefore SKIPPED, audited, and never queued for later — the next rotation of that
+//     seat notes it again.
+//   • OWED DELEGATION. The generation still owes a worker its answer, per the ledger above. The
+//     posture is the live-turn guard's, for the same reason: the retirement is bookkeeping, the
+//     delegation is a human's work, and a skip costs only the parked workers their reap.
+//
+// ── 🔴 THE OWED-DELEGATION GUARD'S ONE COST, STATED PLAINLY ─────────────────────────────────────
+// A SKIPPED GENERATION IS NEVER RETIRED BY THIS MODULE AT ALL. Every skip arm is final, because
+// {@link takeGenerationsForRetirement} consumes the entry and nothing re-queues it — and the phrase
+// "the seat's next rotation notes it again" means the NEXT generation, never this one. Generation A
+// is noted exactly once, by the rotate leg that replaced it. So an A that owed a worker keeps its
+// parked children for the life of its eve session, whatever the worker does afterwards; clearing the
+// ledger row un-blocks nothing, because no reader ever asks about A again.
+// THAT IS THE RULING, NOT AN OVERSIGHT (OPE-1620): a skipped generation is not queued for later. The
+// alternative — re-noting A so a later wake retires it — would make every unified receive for the org
+// pay three more store reads until A cleared, to reap workers that are inert by construction (see
+// §WHAT A ROTATION USED TO LEAVE BEHIND: a parked worker calls no model and costs no tokens). It
+// buys back the pre-OPE-627 position for ONE generation, and it buys it in exchange for never
+// cancelling work a human is waiting on. eve's own session-expiry finalizer still runs the same
+// reaper over A whenever that session expires; this module simply stops being the thing that does it.
+// A THROWN read fails SAFE: a store that cannot answer means SKIP, never retire.
+// 🔴 AN ABSENT TURN ANCHOR IS NOT PROOF THAT NO TURN RUNS, and the live-turn guard is therefore not
+// airtight. `recordTurnAnchor` is best-effort and swallows a store failure (`channels/turn-registry.ts`),
+// and an anchor row expires after `TURN_ANCHOR_TTL_MS` (45 minutes). So a lost anchor write, or a
+// turn that has run longer than the TTL, reads as `none` and the retirement proceeds — cancelling
+// that turn and posting a "Stood down" note into the room. A stronger signal is not available at
+// this seam; the residual is stated rather than papered over.
+//
+// ── WHAT THE RETIREMENT ANNOUNCES, AND WHY THAT IS ACCEPTED ─────────────────────────────────────
+// Since eve 0.48.0 a retirement is NOT silent: the shared finalizer emits a terminal
+// `session.completed` unconditionally, and no flag suppresses it. That emit is INERT here.
+// eve's `emitTerminalSessionEvent` calls the channel ADAPTER's event handler and writes the durable
+// stream; it never calls `dispatchStreamEventHooks`. EVERY Open Everywhere `session.completed`
+// binding is a `defineHook` — today `hooks/memory.ts`, `hooks/log-flush.ts` and the sandbox
+// lifecycle hook — so none of them can fire from that path, and the `unified` channel declares no
+// `session.completed` handler at all. The CLASS claim is the load-bearing one, so re-derive it with
+// `rg '"session\.completed"' --glob '*.ts'` rather than trusting this list to stay complete;
+// `scripts/runtime-rotation-test.ts` §8 holds the channel half. The OPE-281 objection — that a
+// terminal completion would make a timed-out worker look finished — does not reach this road.
+import { appendAudit } from "../audit/audit.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { isUnifiedSupervisorToken } from "./unified-supervisor.js";
+import { bareTokenFromEveContext } from "./window-key.js";
+/** The durable audit action for "Open Everywhere terminally retired a rotated generation, so eve
+ *  reaped its parked workers". One row per retirement. */
+export const GENERATION_RETIRED_AUDIT_ACTION = "session.generation_retired";
+/** The durable audit action for a retirement that was NOT issued, with the guard that refused it.
+ *  A skip is audited, never silent: a generation whose workers were not reaped must be visible. */
+export const GENERATION_RETIRE_SKIPPED_AUDIT_ACTION = "session.generation_retire_skipped";
+/** No acting human — the rotation is the actor — so a synthetic, low-cardinality service identity,
+ *  the same posture channels/runtime-rotation.ts and channels/session-park.ts take. */
+export const GENERATION_RETIREMENT_PRINCIPAL = "oe:rotation";
+/** The `reason` eve records on the retired session. Human prose, no ids: it is read in eve's own
+ *  logs, not joined against anything here. */
+export const GENERATION_RETIREMENT_REASON = "open-everywhere: the seat rotated to a fresh generation";
+/**
+ * How many outgoing generations may wait for a `receive` at once. A rotation is normally followed by
+ * its own wake within the same call stack, so the real depth is 0 or 1; the cap exists for the
+ * rotation whose wake never reaches the unified channel (a per-container grain, a wake that threw
+ * before the divert). Oldest entries are dropped first — a generation that waited longest is the one
+ * whose wake is least likely to still be coming.
+ */
+export const MAX_PENDING = 64;
+let pending = [];
+/**
+ * Record that `token`'s generation has been rotated away and its workers are owed a reap. Called at
+ * the rotation seam, which holds the outgoing token but not `from`.
+ * IGNORES a token that is not a WINDOW supervisor token: a per-container seat lives on its own
+ * provider channel, so `from(token)` on `unified` would address a session that does not exist.
+ * Idempotent per (org, token) — a rotation seam that is reached twice notes one retirement.
+ */
+export function noteGenerationForRetirement(input) {
+    const token = bareTokenFromEveContext(input.token) ?? input.token;
+    if (!isUnifiedSupervisorToken(token))
+        return;
+    if (pending.some((p) => p.org === input.org && p.token === token))
+        return;
+    pending.push({ org: input.org, registryKey: input.registryKey, token });
+    if (pending.length > MAX_PENDING)
+        pending = pending.slice(pending.length - MAX_PENDING);
+}
+/** Take every generation noted for `org` and clear them from the list. A taken entry is NEVER
+ *  re-queued, whatever the verdict: the ticket's rule is that a skipped generation is simply not
+ *  retired, and the seat's next rotation notes it again. */
+export function takeGenerationsForRetirement(org) {
+    const mine = pending.filter((p) => p.org === org);
+    if (mine.length > 0)
+        pending = pending.filter((p) => p.org !== org);
+    return mine;
+}
+/** Test seam: the current list, unfiltered. Not part of the contract. */
+export function __pendingGenerationRetirementsForTest() {
+    return [...pending];
+}
+/** Test seam: empty the list, so one test's rotation cannot leak into another's drain. */
+export function __resetGenerationRetirementsForTest() {
+    pending = [];
+}
+// ── THE OWED-DELEGATION LEDGER — see this file's header for the shape and the two failure directions.
+/** The store key of one generation's owed-task list. */
+function generationOwesKey(token) {
+    return `oe-gen-owes:${token}`;
+}
+/** The store key of one task's reverse pointer back to the generation that dispatched it. */
+function taskGenerationKey(taskId) {
+    return `oe-task-gen:${taskId}`;
+}
+/**
+ * How long an owed-delegation row lives. Six hours — the wake-target TTL
+ * ({@link import("./unified-window.js").WAKE_TARGET_TTL_MS}), duplicated as a literal so this module
+ * keeps the leaf import set its header promises, and pinned equal by
+ * `scripts/generation-retirement-test.ts`.
+ *
+ * 🔴 IT BOUNDS THE KEYSPACE, NOT REAPABILITY, and the difference matters. A generation's row is read
+ * ONCE — by the drain, on the wake that follows its own rotation — so an expiry hours later reaches
+ * no reader and un-blocks no retirement (see §THE OWED-DELEGATION LEDGER'S ONE COST). What the TTL
+ * really stops is a row outliving every question anyone could ask of it: past six hours the task's own
+ * `oe-task-wake:` row has expired too, so its report could no longer reach the conversation that asked
+ * for it, and the row is then pure residue.
+ */
+export const GENERATION_DELEGATION_TTL_MS = 6 * 60 * 60 * 1000;
+/** How many owed tasks one generation's row carries. A seat fans out a handful per conversation; the
+ *  cap only stops a looping seat from growing the serialized row without bound. Past it the ledger
+ *  stops recording, so the extra tasks are UNCOUNTED — the guard never starts refusing on work it
+ *  cannot account for, which is the same direction `access/pending-delegation-signal.ts` takes. */
+export const MAX_GENERATION_DELEGATIONS = 32;
+/** Read the owed list defensively — a resumed deployment can hand back anything a previous one
+ *  wrote, and anything unrecognised reads as "owes nothing". */
+function readOwedTasks(raw) {
+    if (raw === null)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        const tasks = parsed?.tasks;
+        if (!Array.isArray(tasks))
+            return [];
+        return tasks.filter((t) => typeof t === "string" && t.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * DISPATCH EDGE — record that the generation `windowToken` names has started a background task that
+ * has not settled. Called from `hooks/spawn-taint.ts` BRANCH 1, with the same
+ * `resolveOwnWindowToken` value the wake mint takes.
+ *
+ * IGNORES a token that is not a WINDOW supervisor token, for the reason
+ * {@link noteGenerationForRetirement} does: no other seat is ever retired by this module, so a row
+ * for one would be a row nothing reads.
+ *
+ * NEVER THROWS. A hook edge may not fail because a store blipped, and an unwritten row leaves this
+ * generation exactly where it was before this ledger existed.
+ */
+export async function noteGenerationDelegation(org, windowToken, taskId, store) {
+    try {
+        if (windowToken === undefined || taskId.length === 0)
+            return;
+        const token = bareTokenFromEveContext(windowToken) ?? windowToken;
+        if (!isUnifiedSupervisorToken(token))
+            return;
+        const s = store ?? getOperationalStore();
+        const at = new Date().toISOString();
+        const owed = readOwedTasks(await s.getTaskResult(org, generationOwesKey(token)));
+        if (!owed.includes(taskId)) {
+            if (owed.length >= MAX_GENERATION_DELEGATIONS)
+                return;
+            await s.putTaskResult(org, generationOwesKey(token), JSON.stringify({ tasks: [...owed, taskId] }), at, GENERATION_DELEGATION_TTL_MS);
+        }
+        // The reverse pointer goes SECOND: a crash between the two leaves a task counted as owed until
+        // its TTL, which costs one generation one reap. The other order would leave a pointer to a row
+        // that never records the task, and the settlement would then clear nothing.
+        await s.putTaskResult(org, taskGenerationKey(taskId), JSON.stringify({ token }), at, GENERATION_DELEGATION_TTL_MS);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:generation-retirement] could not record the owed delegation ${taskId}: ${String(err)}`);
+    }
+}
+/**
+ * SETTLEMENT EDGE — the task has reached a terminal state, so the generation that dispatched it no
+ * longer owes it. Called from `hooks/spawn-taint.ts` {@link import("../hooks/spawn-taint.js").applyTaskSettlement}.
+ *
+ * 🔴 IT FINDS THE GENERATION THROUGH THE REVERSE POINTER, never through the settling seat's own
+ * token. A settlement can land on a turn whose seat has already rotated, and clearing the row the
+ * NEW generation names would leave the outgoing one owing a task that has finished — the exact state
+ * that blocks its reap for a full TTL.
+ *
+ * NEVER THROWS, for the same reason the writer does not.
+ */
+export async function clearGenerationDelegation(org, taskId, store) {
+    try {
+        if (taskId.length === 0)
+            return;
+        const s = store ?? getOperationalStore();
+        const raw = await s.getTaskResult(org, taskGenerationKey(taskId));
+        if (raw === null)
+            return;
+        const token = JSON.parse(raw)?.token;
+        if (typeof token !== "string" || token.length === 0)
+            return;
+        const owed = readOwedTasks(await s.getTaskResult(org, generationOwesKey(token)));
+        if (owed.includes(taskId)) {
+            const next = owed.filter((t) => t !== taskId);
+            const at = new Date().toISOString();
+            // The row is DELETED when it empties rather than written as an empty list: an absent row and a
+            // row owing nothing are the same answer, and deleting keeps the keyspace from carrying one
+            // entry per generation the deployment ever rotated.
+            if (next.length === 0)
+                await s.deleteTaskResult(org, generationOwesKey(token));
+            else
+                await s.putTaskResult(org, generationOwesKey(token), JSON.stringify({ tasks: next }), at, GENERATION_DELEGATION_TTL_MS);
+        }
+        await s.deleteTaskResult(org, taskGenerationKey(taskId));
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:generation-retirement] could not clear the owed delegation ${taskId}: ${String(err)}`);
+    }
+}
+/**
+ * Does `token`'s generation still owe a delegation its answer? The FOURTH guard's own read, and the
+ * one reader of the ledger — exported so a test drives the real parse rather than a copy of it.
+ *
+ * `unreadable` on any store error, which the verdict turns into a refusal — the same posture
+ * {@link registryState} takes. A row this build cannot recognise reads as `none`: a resumed
+ * deployment can hand back anything a previous one wrote, and a value nobody can parse is no evidence
+ * that a worker is running. That is the one place this reader fails OPEN, and it must: the other
+ * direction would hold a generation un-reapable forever on one malformed row.
+ */
+export async function generationOwedDelegation(org, token, store) {
+    try {
+        const s = store ?? getOperationalStore();
+        return readOwedTasks(await s.getTaskResult(org, generationOwesKey(token))).length > 0 ? "owed" : "none";
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:generation-retirement] owed-delegation row unreadable for ${token}: ${String(err)} — not retiring`);
+        return "unreadable";
+    }
+}
+/**
+ * THE DECISION, kept PURE so every arm is testable without a store, a channel or a live turn.
+ * The ORDER is the policy, most-certain refusal first: a token that is the wake's own target is the
+ * FRESH generation and retiring it would kill the session this wake is being delivered into; a
+ * registry row that still points at the token means the rotation did not complete; an unreadable
+ * read proves nothing, so it refuses; a live turn anchor means a reset would cancel that turn; an
+ * owed delegation means the reset would cancel a worker a human is still waiting on.
+ *
+ * 🔴 THE OWED-DELEGATION ARM IS LAST AMONG THE SKIPS, AND ONLY THE ORDER OF THE AUDIT ROWS TURNS ON
+ * IT. Every arm refuses, so a generation meeting two of them is not retired either way; what the
+ * order decides is which single reason the skip row names. A live turn is the more urgent fact — it
+ * would cost a human's turn a "Stood down" note — so it is named first.
+ */
+export function retirementVerdict(input) {
+    if (input.token === input.incomingToken)
+        return "skip-incoming";
+    if (input.registry === "unreadable" || input.turn === "unreadable" || input.delegation === "unreadable")
+        return "skip-unreadable";
+    if (input.registry === "still-live")
+        return "skip-still-live";
+    if (input.turn === "live")
+        return "skip-live-turn";
+    if (input.delegation === "owed")
+        return "skip-owed-delegation";
+    return "retire";
+}
+/** eve's `ResetSessionResult` status for a retirement that really happened (`channel/types.d.ts`). */
+export const RESET_STATUS_RETIRED = "reset";
+/**
+ * Wait for eve's reset result, bounded. `confirmed: true` carries eve's own status; `confirmed:
+ * false` means the bound passed first and the reset may still land. A rejection is left to
+ * propagate: a refused reset is a different outcome from a slow one, and the caller audits them apart.
+ * The timer is always cleared, so a settled reset cannot hold the process open.
+ */
+async function withConfirmTimeout(reset, ms) {
+    let timer;
+    // `Promise.race` attaches a rejection handler to this arm, so a refusal that arrives AFTER the
+    // bound is already handled and cannot surface as an unhandled rejection.
+    const confirmed = reset.then((r) => ({ confirmed: true, ...(r?.status !== undefined ? { status: r.status } : {}) }));
+    try {
+        return await Promise.race([
+            confirmed,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve({ confirmed: false }), ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/** eve's channel namespace on a unified continuation token — the second spelling a turn anchor row
+ *  can wear, because the anchor writer stores eve's RAW token while every caller holds the bare one. */
+const UNIFIED_TOKEN_PREFIX = "unified:";
+/**
+ * How long the drain waits for eve to confirm one `reset`, in ms. The drain runs INSIDE a `receive`,
+ * on the path of a human's wake, so an unbounded await would let a slow dispatch to a dead address
+ * hold that wake open. The retirement is bookkeeping about a generation the registry has already
+ * replaced; the message is not. On the bound the drain stops WAITING — it does not cancel the reset,
+ * which may still land — and audits the retirement as unconfirmed rather than claiming it.
+ */
+export const RETIREMENT_CONFIRM_TIMEOUT_MS = 5_000;
+/** Is the registry row for `registryKey` still pointing at `token`? `unreadable` on any store error,
+ *  which the verdict turns into a refusal. */
+async function registryState(store, org, registryKey, token) {
+    try {
+        const row = await store.getChannelSession(org, registryKey);
+        return row?.token === token ? "still-live" : "rotated";
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:generation-retirement] registry row unreadable for ${registryKey}: ${String(err)} — not retiring`);
+        return "unreadable";
+    }
+}
+/** Does `token` carry a live turn anchor? Both spellings are tried, for the reason
+ *  channels/turn-registry.ts states. `unreadable` on any store error. */
+async function turnState(store, org, token) {
+    try {
+        for (const key of [token, `${UNIFIED_TOKEN_PREFIX}${token}`]) {
+            if (await store.getTurnAnchorByWindow(org, key))
+                return "live";
+        }
+        return "none";
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:generation-retirement] turn anchor unreadable for ${token}: ${String(err)} — not retiring`);
+        return "unreadable";
+    }
+}
+/**
+ * Retire every generation noted for this org, from inside the `unified` channel's `receive`.
+ * NEVER THROWS and never delays a wake's meaning: a retirement is bookkeeping about a generation
+ * that is already gone from the registry, and a failed one must not cost the message that triggered it.
+ * Every outcome — one retirement, one skip, one failed reset — writes exactly one audit row.
+ */
+export async function drainGenerationRetirements(from, input, deps) {
+    const taken = takeGenerationsForRetirement(input.org);
+    if (taken.length === 0)
+        return;
+    const store = deps.store ?? getOperationalStore();
+    const incoming = bareTokenFromEveContext(input.incomingToken) ?? input.incomingToken;
+    // ONE deadline for the WHOLE drain, not one per entry. The list can hold up to MAX_PENDING
+    // generations, so a per-entry bound would let a slow eve hold a human's wake for the cap times the
+    // bound. The wake owns the clock; the retirements share what is left of it.
+    const deadline = Date.now() + (deps.confirmTimeoutMs ?? RETIREMENT_CONFIRM_TIMEOUT_MS);
+    for (const p of taken) {
+        // The incoming guard is decided before any read: it needs none, and it is the one arm where a
+        // read would be work spent on a token we already refuse.
+        const registry = p.token === incoming ? "rotated" : await registryState(store, input.org, p.registryKey, p.token);
+        const turn = p.token === incoming ? "none" : await turnState(store, input.org, p.token);
+        const delegation = p.token === incoming ? "none" : await generationOwedDelegation(input.org, p.token, store);
+        const verdict = retirementVerdict({ token: p.token, incomingToken: incoming, registry, turn, delegation });
+        if (verdict !== "retire") {
+            await auditRetirement(p, deps, GENERATION_RETIRE_SKIPPED_AUDIT_ACTION, { skipped: verdict });
+            continue;
+        }
+        try {
+            const outcome = await withConfirmTimeout(from(p.token).reset({ reason: GENERATION_RETIREMENT_REASON }), Math.max(0, deadline - Date.now()));
+            if (outcome.confirmed === false) {
+                await auditRetirement(p, deps, GENERATION_RETIRE_SKIPPED_AUDIT_ACTION, { skipped: "reset-unconfirmed" });
+            }
+            else if (outcome.status === RESET_STATUS_RETIRED) {
+                await auditRetirement(p, deps, GENERATION_RETIRED_AUDIT_ACTION, {});
+            }
+            else {
+                // eve resolved, but with no session to retire — so nothing was reaped, and claiming a
+                // retirement here would put a phantom reap in the census.
+                await auditRetirement(p, deps, GENERATION_RETIRE_SKIPPED_AUDIT_ACTION, { skipped: "no-active-session", status: outcome.status ?? "" });
+            }
+        }
+        catch (err) {
+            const error = (err instanceof Error ? err.message : String(err)).slice(0, 300);
+            console.warn(`[open-everywhere:generation-retirement] reset refused for ${p.token}: ${error} — the generation's workers stay parked`);
+            await auditRetirement(p, deps, GENERATION_RETIRE_SKIPPED_AUDIT_ACTION, { skipped: "reset-failed", error });
+        }
+    }
+}
+/** One audit row, partitioned exactly like every other row the unified channel writes: platform
+ *  `unified`, workspace and surface derived from the RETIRED token. 🔴 The row does NOT join the
+ *  delegation census by generation: those rows key on the eve SESSION id of the dispatching session,
+ *  which OE never holds for a seat generation (`hooks/spawn-taint.ts`, OPE-1620). Best-effort — an
+ *  audit that cannot be written must not undo a retirement that already happened. */
+async function auditRetirement(p, deps, action, extra) {
+    const { workspace, surface } = deps.labelsFor(p.token);
+    await appendAudit({
+        org: p.org,
+        platform: "unified",
+        workspace,
+        ...(surface !== undefined ? { surface } : {}),
+        principalId: GENERATION_RETIREMENT_PRINCIPAL,
+        action,
+        detail: { registryKey: p.registryKey, token: p.token, ...extra },
+    }).catch(() => undefined);
+}
+//# sourceMappingURL=generation-retirement.js.map

package/dist/agent/channels/generation-retirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generation-retirement.js","sourceRoot":"","sources":["../../../agent/channels/generation-retirement.ts"],"names":[],"mappings":"AAAA,iNAAiN;AACjN,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,gEAAgE;AAChE,oGAAoG;AACpG,kGAAkG;AAClG,kIAAkI;AAClI,EAAE;AACF,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,6FAA6F;AAC7F,kGAAkG;AAClG,qGAAqG;AACrG,yCAAyC;AACzC,qGAAqG;AACrG,6FAA6F;AAC7F,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,0DAA0D;AAC1D,oGAAoG;AACpG,yBAAyB;AACzB,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,oGAAoG;AACpG,+FAA+F;AAC/F,iGAAiG;AACjG,mGAAmG;AACnG,4FAA4F;AAC5F,gGAAgG;AAChG,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,0FAA0F;AAC1F,kGAAkG;AAClG,8FAA8F;AAC9F,wGAAwG;AACxG,sGAAsG;AACtG,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,gCAAgC;AAChC,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,6EAA6E;AAC7E,mGAAmG;AACnG,oGAAoG;AACpG,oGAAoG;AACpG,sCAAsC;AACtC,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,+FAA+F;AAC/F,kCAAkC;AAClC,oGAAoG;AACpG,4FAA4F;AAC5F,qGAAqG;AACrG,qGAAqG;AACrG,mGAAmG;AACnG,gCAAgC;AAChC,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,iGAAiG;AACjG,4FAA4F;AAC5F,+FAA+F;AAC/F,oGAAoG;AACpG,mGAAmG;AACnG,mGAAmG;AACnG,2BAA2B;AAC3B,gGAAgG;AAChG,gGAAgG;AAChG,yFAAyF;AACzF,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,oGAAoG;AACpG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,2EAA2E;AAC3E,qGAAqG;AACrG,sGAAsG;AACtG,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,gGAAgG;AAChG,sGAAsG;AACtG,iFAAiF;AACjF,oGAAoG;AACpG,0GAA0G;AAC1G,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,2FAA2F;AAC3F,oGAAoG;AACpG,+FAA+F;AAC/F,4FAA4F;AAC5F,kGAAkG;AAClG,oGAAoG;AACpG,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAE9F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;0DAC0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAE5E;mGACmG;AACnG,MAAM,CAAC,MAAM,sCAAsC,GAAG,mCAAmC,CAAC;AAE1F;uFACuF;AACvF,MAAM,CAAC,MAAM,+BAA+B,GAAG,aAAa,CAAC;AAE7D;8CAC8C;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,yDAAyD,CAAC;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAY9B,IAAI,OAAO,GAAkC,EAAE,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAqF;IAC/H,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;IAClE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;QAAE,OAAO;IAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;QAAE,OAAO;IAC1E,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;AAC1F,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qCAAqC;IACnD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mCAAmC;IACjD,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,uGAAuG;AAEvG,wDAAwD;AACxD,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,eAAe,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,eAAe,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D;;;mGAGmG;AACnG,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;gEACgE;AAChE,SAAS,aAAa,CAAC,GAAkB;IACvC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,WAA+B,EAC/B,MAAc,EACd,KAA6B;IAE7B,IAAI,CAAC;QACH,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7D,MAAM,KAAK,GAAG,uBAAuB,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;QAClE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;YAAE,OAAO;QAC7C,MAAM,CAAC,GAAG,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,IAAI,0BAA0B;gBAAE,OAAO;YACtD,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACvI,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACrH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,gFAAgF,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAW,EAAE,MAAc,EAAE,KAA6B;IACxG,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,CAAC,GAAG,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QACzB,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,EAAE,KAAK,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpC,+FAA+F;YAC/F,2FAA2F;YAC3F,oDAAoD;YACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;;gBAC1E,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+EAA+E,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,KAAa,EACb,KAA+C;IAE/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACzC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8EAA8E,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnI,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAKD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAWjC;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAChE,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;QAAE,OAAO,iBAAiB,CAAC;IAClI,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,iBAAiB,CAAC;IAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM;QAAE,OAAO,sBAAsB,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAeD,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAkB5C;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAwD,EACxD,EAAU;IAEV,IAAI,KAAgD,CAAC;IACrD,+FAA+F;IAC/F,yEAAyE;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,SAAS;YACT,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;gBAC9C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;wGACwG;AACxG,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAEnD;8CAC8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,KAAkD,EAClD,GAAW,EACX,WAAmB,EACnB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uEAAuE,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClI,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,SAAS,CACtB,KAAsD,EACtD,GAAW,EACX,KAAa;IAEb,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,oBAAoB,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;QACjE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sEAAsE,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3H,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAoB,EACpB,KAA+D,EAC/D,IAAoB;IAEpB,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC;IACrF,2FAA2F;IAC3F,mGAAmG;IACnG,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,6BAA6B,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5I,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAChC,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC3G,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACnD,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,sFAAsF;gBACtF,0DAA0D;gBAC1D,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YACzI,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC,KAAK,KAAK,KAAK,yCAAyC,CAAC,CAAC;YACtI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;qFAIqF;AACrF,KAAK,UAAU,eAAe,CAC5B,CAA8B,EAC9B,IAAoB,EACpB,MAAc,EACd,KAA8B;IAE9B,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,QAAQ,EAAE,SAAS;QACnB,SAAS;QACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,WAAW,EAAE,+BAA+B;QAC5C,MAAM;QACN,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE;KACjE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC"}

package/dist/agent/channels/halt-per-wake.d.ts

@@ -0,0 +1,53 @@
+import type { BindableContext } from "../identity/binding.js";
+import { type HaltDeps, type HaltState } from "../access/halt.js";
+import type { PendingUnifiedWake } from "./unified-window.js";
+/** What one turn's rooms agree, or fail to agree, about the pause. */
+export type TurnHaltReach = 
+/** No conversation this turn holds is covered — render nothing, exactly as today. */
+{
+    readonly kind: "none";
+}
+/** Every conversation this turn holds is covered by a halt. `state` is the one to render, so the
+ *  width clause still names a real row. */
+ | {
+    readonly kind: "all";
+    readonly state: HaltState;
+}
+/** THE BLEED CASE. Some of this turn's conversations are covered and some are not. `state` is a
+ *  covering one, kept so the paragraph can still say how wide THAT pause is. */
+ | {
+    readonly kind: "partial";
+    readonly state: HaltState;
+    readonly haltedRooms: number;
+    readonly totalRooms: number;
+};
+export interface TurnHaltReachDeps {
+    /** The org's active halt rows — `resolveHalt`'s own injectable reader, threaded through so this
+     *  module is decided by one store read rather than by two opinions about where rows live. */
+    readonly rows?: HaltDeps["rows"];
+    /** The pending-wake read. Injected in tests; the live default is the operational store's own. */
+    readonly pendingWakes?: (org: string, windowToken: string, afterIso: string, limit: number) => Promise<readonly PendingUnifiedWake[]>;
+}
+/**
+ * The halt reach across every conversation THIS turn holds an unanswered wake in.
+ *
+ * `turnState` is the caller's own single-address read (`resolveHalt(haltScopeForCtx(ctx))`) — the
+ * answer for the delivery whose auth the turn happens to carry. It is the floor here, never
+ * discarded: a turn with exactly one room, a turn whose window token cannot be read, and a turn whose
+ * wake rows predate the stored surface key all answer from it alone, which is byte-identical to the
+ * behaviour before this module existed.
+ *
+ * Never throws.
+ */
+export declare function resolveTurnHaltReach(ctx: BindableContext, turnState: HaltState, org: string, deps?: TurnHaltReachDeps): Promise<TurnHaltReach>;
+/**
+ * The one sentence a PARTIAL reach adds in front of the standing halt paragraph.
+ *
+ * 🔴 IT IS THE WHOLE OF THE FIX THE ROOM CAN SEE, so it has to be actionable rather than merely
+ * hedged: it tells the seat that the pause does not cover every conversation in front of it, and that
+ * a room it was not asked about must not be told it is paused. It names NO room and NO scope key —
+ * the same product-copy rule the paragraph itself holds — because what the seat needs is not this
+ * plane's addresses but the knowledge that the claim is not turn-wide.
+ */
+export declare function partialHaltPrefix(reach: TurnHaltReach): string | null;
+//# sourceMappingURL=halt-per-wake.d.ts.map

package/dist/agent/channels/halt-per-wake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt-per-wake.d.ts","sourceRoot":"","sources":["../../../agent/channels/halt-per-wake.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAA6B,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAW9D,sEAAsE;AACtE,MAAM,MAAM,aAAa;AACvB,qFAAqF;AACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3B;2CAC2C;GACzC;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE;AACrD;gFACgF;GAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvH,MAAM,WAAW,iBAAiB;IAChC;iGAC6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;CACvI;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6DxJ;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CASrE"}