@openrig/cli 0.4.4 → 0.4.6

package/daemon/dist/domain/workflow-boot-sweep.js

@@ -0,0 +1,102 @@
+// OPR.0.4.6.WF1 FR-4 (G5): the startup resume sweep — the workflow
+// twin of the existing rig/session boot reconcile.
+//
+// Before this slice NOTHING re-examined in-flight workflow instances
+// at daemon boot: a nudge lost to the commit-then-crash window stayed
+// lost, keepalives armed in a prior process (or never armed, pre-WF-1)
+// stayed dead, and a stuck instance surfaced nowhere. The sweep closes
+// all three on every boot:
+//
+//   1. RE-ARM — every active|waiting instance gets its per-instance
+//      keepalive ensured (idempotent; heals pre-WF-1 instances that
+//      never had one).
+//   2. LOST-NUDGE RECOVERY — a PENDING frontier packet whose
+//      last_nudge_attempt is NULL was routed but never nudged (the
+//      daemon died between the scribe commit and the post-commit
+//      nudge — the exact FR-3 window). It is re-nudged NOW, not after
+//      a threshold: the potato is provably alive on restart.
+//   3. DEADLINE EVALUATION — the FR-2 evaluator runs over each
+//      instance's frontier; overdue instances are surfaced (log line +
+//      re-nudge with the stuck steering) — never silently parked.
+//
+// The sweep is observable: ONE summary line naming counts. Zero
+// in-flight instances → a no-op (no state side effects).
+//
+// BR-2 holds: the sweep arms, nudges, and logs — it never advances an
+// instance (project() stays the sole advance write path).
+import { evaluateStepDeadline } from "./workflow-deadline.js";
+import { ensureWorkflowKeepaliveArmed } from "./workflow-keepalive-arming.js";
+export async function runWorkflowBootSweep(deps) {
+    const log = deps.log ?? (() => { });
+    const now = (deps.now ?? (() => new Date()))();
+    const instances = [
+        ...deps.instanceStore.listByStatus("active"),
+        ...deps.instanceStore.listByStatus("waiting"),
+    ];
+    const result = {
+        instancesSwept: instances.length,
+        keepalivesArmed: 0,
+        lostNudgesReissued: 0,
+        stuckSurfaced: 0,
+        exceptionItemsCreated: 0,
+    };
+    if (instances.length === 0) {
+        log("workflow boot sweep: 0 in-flight instances (no-op)");
+        return result;
+    }
+    for (const instance of instances) {
+        const packets = instance.currentFrontier
+            .map((id) => deps.queueRepo.getById(id))
+            .filter((p) => p != null);
+        // 1. Re-arm the keepalive (idempotent; heals pre-WF-1 instances).
+        const fallbackOwner = packets[0]?.destinationSession ?? instance.createdBySession;
+        if (fallbackOwner && fallbackOwner.includes("@")) {
+            const armed = ensureWorkflowKeepaliveArmed(deps.watchdogJobsRepo, {
+                instanceId: instance.instanceId,
+                targetSession: fallbackOwner,
+                registeredBySession: instance.createdBySession,
+            });
+            if (armed.newlyArmed)
+                result.keepalivesArmed += 1;
+        }
+        // 2. Lost-nudge recovery: routed-but-never-nudged pending packets.
+        for (const packet of packets) {
+            if (packet.state === "pending" && packet.lastNudgeAttempt === null) {
+                result.lostNudgesReissued += 1;
+                await deps.queueRepo.maybeNudge(packet.qitemId, packet.destinationSession, undefined, instance.createdBySession);
+            }
+        }
+        // 3. Deadline evaluation (derived; the unclaimed frontier is a
+        // FIRST-CLASS case here — never invisible to an in-progress-only
+        // scan like findOverdue).
+        const verdict = evaluateStepDeadline(instance, packets, now);
+        if (verdict.state !== "healthy" && verdict.evidence) {
+            result.stuckSurfaced += 1;
+            log(`workflow boot sweep: instance ${instance.instanceId} STUCK (${verdict.state}) — step ${verdict.evidence.stepId ?? "?"}, packet ${verdict.evidence.packetId}, owner ${verdict.evidence.ownerSession}, anchor ${verdict.evidence.anchor}@${verdict.evidence.anchorAt}, overdue ${verdict.evidence.overdueBySeconds}s`);
+            // Re-nudge the overdue owner (the keepalive will keep firing on
+            // its own cadence; boot gives the immediate wake).
+            await deps.queueRepo.maybeNudge(verdict.evidence.packetId, verdict.evidence.ownerSession, undefined, instance.createdBySession);
+            // OPR.0.4.6.WF5 FR-2 class (b): ensure the durable exception item
+            // at detection. Non-fatal: an item failure must not break the
+            // sweep's other legs (the next pass re-detects — the guarantee).
+            if (deps.ensureStuckExceptionItem) {
+                try {
+                    const ensured = await deps.ensureStuckExceptionItem({
+                        workflowName: instance.workflowName,
+                        workflowVersion: instance.workflowVersion,
+                        createdBySession: instance.createdBySession,
+                        verdict,
+                    });
+                    if (ensured.outcome === "created")
+                        result.exceptionItemsCreated += 1;
+                }
+                catch (err) {
+                    log(`workflow boot sweep: exception-item ensure failed (non-fatal) for ${instance.instanceId}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    log(`workflow boot sweep: ${result.instancesSwept} in-flight instance(s) — ${result.keepalivesArmed} keepalive(s) armed, ${result.lostNudgesReissued} lost nudge(s) reissued, ${result.stuckSurfaced} stuck surfaced, ${result.exceptionItemsCreated} exception item(s) created`);
+    return result;
+}
+//# sourceMappingURL=workflow-boot-sweep.js.map

package/daemon/dist/domain/workflow-boot-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-boot-sweep.js","sourceRoot":"","sources":["../../src/domain/workflow-boot-sweep.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,mDAAmD;AACnD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,2BAA2B;AAC3B,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,uBAAuB;AACvB,6DAA6D;AAC7D,mEAAmE;AACnE,iEAAiE;AACjE,sEAAsE;AACtE,6DAA6D;AAC7D,+DAA+D;AAC/D,uEAAuE;AACvE,kEAAkE;AAClE,EAAE;AACF,gEAAgE;AAChE,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,0DAA0D;AAK1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AA0B9E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC5C,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC;KAC9C,CAAC;IACF,MAAM,MAAM,GAA4B;QACtC,cAAc,EAAE,SAAS,CAAC,MAAM;QAChC,eAAe,EAAE,CAAC;QAClB,kBAAkB,EAAE,CAAC;QACrB,aAAa,EAAE,CAAC;QAChB,qBAAqB,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe;aACrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAExD,kEAAkE;QAClE,MAAM,aAAa,GACjB,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,IAAI,QAAQ,CAAC,gBAAgB,CAAC;QAC9D,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAChE,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,aAAa,EAAE,aAAa;gBAC5B,mBAAmB,EAAE,QAAQ,CAAC,gBAAgB;aAC/C,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,mEAAmE;QACnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACnE,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAC7B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,kBAAkB,EACzB,SAAS,EACT,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,iEAAiE;QACjE,0BAA0B;QAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1B,GAAG,CACD,iCAAiC,QAAQ,CAAC,UAAU,WAAW,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,YAAY,OAAO,CAAC,QAAQ,CAAC,QAAQ,WAAW,OAAO,CAAC,QAAQ,CAAC,YAAY,YAAY,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,aAAa,OAAO,CAAC,QAAQ,CAAC,gBAAgB,GAAG,CACrT,CAAC;YACF,gEAAgE;YAChE,mDAAmD;YACnD,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,EACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,EAC7B,SAAS,EACT,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;YACF,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC;wBAClD,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;wBACzC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;wBAC3C,OAAO;qBACR,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;wBAAE,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CACD,qEAAqE,QAAQ,CAAC,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,GAAG,CACD,wBAAwB,MAAM,CAAC,cAAc,4BAA4B,MAAM,CAAC,eAAe,wBAAwB,MAAM,CAAC,kBAAkB,4BAA4B,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,qBAAqB,4BAA4B,CAC7Q,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/daemon/dist/domain/workflow-deadline.d.ts

@@ -0,0 +1,74 @@
+export interface DeadlineInstanceView {
+    instanceId: string;
+    status: string;
+    currentFrontier: string[];
+    currentStepId: string | null;
+}
+export interface DeadlinePacketView {
+    qitemId: string;
+    state: string;
+    destinationSession: string;
+    tsCreated: string;
+    claimedAt: string | null;
+    closureRequiredAt: string | null;
+}
+/**
+ * THE single threshold home (arch gate-leg ruling: EXPORTED, documented
+ * as the one place this number lives — WF-5's class-(b) stuck/overdue
+ * thresholds bind to this constant by ruling; they never redefine it).
+ *
+ * Derivation: the shipped routine-tier SLA (TIER_SLA_SECONDS.routine =
+ * 4h in hot-potato-enforcer.ts — module-private there, so the value is
+ * restated rather than imported; the derivation is this sentence).
+ * Workflow step packets carry tier "mode2" with no SLA entry, so this
+ * constant is the effective deadline for both unclaimed anchors and
+ * the claimed-null-deadline anchor.
+ */
+export declare const WORKFLOW_STEP_STUCK_THRESHOLD_SECONDS: number;
+export type WorkflowStepDeadlineState = "healthy" | "overdue-claimed" | "overdue-unclaimed";
+export interface WorkflowStepDeadlineEvidence {
+    instanceId: string;
+    /** The instance's durable current step binding (may be null pre-R2). */
+    stepId: string | null;
+    packetId: string;
+    ownerSession: string;
+    packetState: string;
+    /** Which anchor classified this packet (the JSDoc classification). */
+    anchor: "closure_required_at" | "claimed_at" | "created_at";
+    /** ISO timestamp the anchor points at (deadline or anchor start). */
+    anchorAt: string;
+    /** Seconds past the effective deadline (>= 0 when overdue). */
+    overdueBySeconds: number;
+    /** Age of the packet since creation, seconds. */
+    ageSeconds: number;
+    /** claimed_at when the row still carries it (sub-states 1/2). */
+    claimedAt: string | null;
+}
+export interface WorkflowDeadlineVerdict {
+    state: WorkflowStepDeadlineState;
+    /** Present iff state != healthy. */
+    evidence: WorkflowStepDeadlineEvidence | null;
+}
+/**
+ * Evaluate one instance's frontier against the deadline model. Pure:
+ * (instance, packets, now) -> verdict. `packets` are the queue rows
+ * for instance.currentFrontier (missing rows are ignored — a frontier
+ * id that no longer resolves is a different corruption class, guarded
+ * elsewhere).
+ *
+ * Only `active` and `waiting` instances can be overdue; terminal
+ * instances are always healthy (nothing to nudge).
+ */
+export declare function evaluateStepDeadline(instance: DeadlineInstanceView, packets: Array<DeadlinePacketView | null | undefined>, now: Date): WorkflowDeadlineVerdict;
+/**
+ * FR-6 (G4) helper: the max_hops comparison, structured against an
+ * EFFECTIVE BASELINE (arch N1 ruling). v1 pins baseline = 0
+ * (MAX_HOPS_BASELINE_V1); WF-5 FR-4's resume later amends the baseline
+ * so each redrive gets one bounded window — this helper is the seam,
+ * never hard-welded to lifetime-total.
+ *
+ * Returns true when executing ONE MORE hop would exceed the guard.
+ */
+export declare const MAX_HOPS_BASELINE_V1 = 0;
+export declare function exceedsMaxHops(hopCount: number, baseline: number, maxHops: number | undefined): boolean;
+//# sourceMappingURL=workflow-deadline.d.ts.map

package/daemon/dist/domain/workflow-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-deadline.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-deadline.ts"],"names":[],"mappings":"AAwDA,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,QAAc,CAAC;AAEjE,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,MAAM,EAAE,qBAAqB,GAAG,YAAY,GAAG,YAAY,CAAC;IAC5D,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,yBAAyB,CAAC;IACjC,oCAAoC;IACpC,QAAQ,EAAE,4BAA4B,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,KAAK,CAAC,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC,EACrD,GAAG,EAAE,IAAI,GACR,uBAAuB,CAuDzB;AA6BD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAST"}

package/daemon/dist/domain/workflow-deadline.js

@@ -0,0 +1,165 @@
+// OPR.0.4.6.WF1 FR-2: the step-deadline evaluator (pure).
+//
+// Closes G1 — the 0.4.3 dead-seat class: before this slice a dead or
+// compacted seat parked a workflow step forever because NO deadline
+// existed anywhere in the workflow domain. This evaluator derives a
+// stuck/overdue verdict for an instance from queue mechanics the
+// system already records — it introduces NO new clock, NO new stored
+// state, and NO queue-layer change.
+//
+// STUCK IS DERIVED STATE, NEVER STORED (ACK plan commit 2): every
+// caller (keepalive policy, boot sweep, list/show/trace surfaces)
+// recomputes the verdict from (instance, frontier packets, now); a
+// normal re-projection therefore self-clears the stuck marker (the
+// FR-2 AC) and nothing can go stale. BR-1 holds: this evaluator is
+// consumed by observability + nudge paths ONLY — never by a routing
+// decision.
+//
+// THE ANCHOR CLASSIFICATION (arch gate-leg ruling + third-state note,
+// Rev-1; extended by the mode2-tier source discovery, flagged to arch
+// 2026-07-06):
+//
+//   1. CLAIMED with a deadline — state=in-progress and
+//      closure_required_at set (computed only at claim,
+//      queue-repository.ts:858-870). Anchor = closure_required_at.
+//      NOTE: workflow step packets ship with tier "mode2", which has
+//      no TIER_SLA_SECONDS entry, so TODAY this sub-state is empty for
+//      workflow packets — kept because it is the honest anchor the
+//      moment tiers change, and the evaluator must never silently
+//      ignore a real closure_required_at.
+//   2. CLAIMED with NO deadline — state=in-progress,
+//      closure_required_at NULL (the mode2 reality). Anchor =
+//      claimed_at + WORKFLOW_STEP_STUCK_THRESHOLD_SECONDS.
+//   3. NEVER-CLAIMED — state=pending, never claimed (the
+//      dead-seat-BEFORE-claim / lost-nudge case: the projector creates
+//      the next packet PENDING in-txn and nudges only post-commit, so
+//      a dead owner leaves it unclaimed forever). Anchor =
+//      created_at + threshold.
+//   4. UNCLAIMED-AFTER-CLAIM (the arch third state) — state=pending
+//      after an unclaim, which NULLs claimed_at AND
+//      closure_required_at (queue-repository.ts:908-917), making the
+//      row indistinguishable from never-claimed. Anchor = created_at +
+//      threshold — deliberately INCLUDING the elapsed claimed period,
+//      so the packet may surface overdue immediately after unclaim.
+//      That direction is safe (early nudge noise beats silent parking;
+//      BR-4 — nothing blocks). Claim history remains recoverable via
+//      queue_transitions; callers that render evidence may enrich from
+//      there.
+//
+// A `blocked` frontier packet (a waiting park) is HEALTHY here: the
+// park is an honest recorded state and waiting instances are already
+// keepalive-eligible; park-duration policy is WF-5's lane.
+/**
+ * THE single threshold home (arch gate-leg ruling: EXPORTED, documented
+ * as the one place this number lives — WF-5's class-(b) stuck/overdue
+ * thresholds bind to this constant by ruling; they never redefine it).
+ *
+ * Derivation: the shipped routine-tier SLA (TIER_SLA_SECONDS.routine =
+ * 4h in hot-potato-enforcer.ts — module-private there, so the value is
+ * restated rather than imported; the derivation is this sentence).
+ * Workflow step packets carry tier "mode2" with no SLA entry, so this
+ * constant is the effective deadline for both unclaimed anchors and
+ * the claimed-null-deadline anchor.
+ */
+export const WORKFLOW_STEP_STUCK_THRESHOLD_SECONDS = 4 * 60 * 60;
+/**
+ * Evaluate one instance's frontier against the deadline model. Pure:
+ * (instance, packets, now) -> verdict. `packets` are the queue rows
+ * for instance.currentFrontier (missing rows are ignored — a frontier
+ * id that no longer resolves is a different corruption class, guarded
+ * elsewhere).
+ *
+ * Only `active` and `waiting` instances can be overdue; terminal
+ * instances are always healthy (nothing to nudge).
+ */
+export function evaluateStepDeadline(instance, packets, now) {
+    if (instance.status !== "active" && instance.status !== "waiting") {
+        return { state: "healthy", evidence: null };
+    }
+    const nowMs = now.getTime();
+    const thresholdMs = WORKFLOW_STEP_STUCK_THRESHOLD_SECONDS * 1000;
+    for (const packet of packets) {
+        if (!packet)
+            continue;
+        if (!instance.currentFrontier.includes(packet.qitemId))
+            continue;
+        if (packet.state === "in-progress") {
+            // Sub-states 1 + 2: claimed.
+            const deadlineMs = packet.closureRequiredAt
+                ? new Date(packet.closureRequiredAt).getTime()
+                : packet.claimedAt
+                    ? new Date(packet.claimedAt).getTime() + thresholdMs
+                    : new Date(packet.tsCreated).getTime() + thresholdMs;
+            if (nowMs >= deadlineMs) {
+                return {
+                    state: "overdue-claimed",
+                    evidence: buildEvidence(instance, packet, nowMs, {
+                        anchor: packet.closureRequiredAt
+                            ? "closure_required_at"
+                            : packet.claimedAt
+                                ? "claimed_at"
+                                : "created_at",
+                        anchorAt: packet.closureRequiredAt ??
+                            packet.claimedAt ??
+                            packet.tsCreated,
+                        deadlineMs,
+                    }),
+                };
+            }
+        }
+        else if (packet.state === "pending") {
+            // Sub-states 3 + 4: never-claimed OR unclaimed-after-claim
+            // (indistinguishable at the row after unclaim NULLs claimed_at;
+            // both deliberately anchor on created_at).
+            const deadlineMs = new Date(packet.tsCreated).getTime() + thresholdMs;
+            if (nowMs >= deadlineMs) {
+                return {
+                    state: "overdue-unclaimed",
+                    evidence: buildEvidence(instance, packet, nowMs, {
+                        anchor: "created_at",
+                        anchorAt: packet.tsCreated,
+                        deadlineMs,
+                    }),
+                };
+            }
+        }
+        // `blocked` (waiting park) and any closed state on the frontier:
+        // healthy by classification.
+    }
+    return { state: "healthy", evidence: null };
+}
+function buildEvidence(instance, packet, nowMs, input) {
+    return {
+        instanceId: instance.instanceId,
+        stepId: instance.currentStepId,
+        packetId: packet.qitemId,
+        ownerSession: packet.destinationSession,
+        packetState: packet.state,
+        anchor: input.anchor,
+        anchorAt: input.anchorAt,
+        overdueBySeconds: Math.max(0, Math.floor((nowMs - input.deadlineMs) / 1000)),
+        ageSeconds: Math.max(0, Math.floor((nowMs - new Date(packet.tsCreated).getTime()) / 1000)),
+        claimedAt: packet.claimedAt,
+    };
+}
+/**
+ * FR-6 (G4) helper: the max_hops comparison, structured against an
+ * EFFECTIVE BASELINE (arch N1 ruling). v1 pins baseline = 0
+ * (MAX_HOPS_BASELINE_V1); WF-5 FR-4's resume later amends the baseline
+ * so each redrive gets one bounded window — this helper is the seam,
+ * never hard-welded to lifetime-total.
+ *
+ * Returns true when executing ONE MORE hop would exceed the guard.
+ */
+export const MAX_HOPS_BASELINE_V1 = 0;
+export function exceedsMaxHops(hopCount, baseline, maxHops) {
+    // Guard blocker 2 hardening: only an ENFORCEABLE guard compares.
+    // The parser rejects malformed values going forward; this check
+    // protects against pre-fix cached spec_json blobs (a string would
+    // silently never trip; a null would coerce to 0 and ALWAYS trip).
+    if (typeof maxHops !== "number" || !Number.isInteger(maxHops) || maxHops < 1) {
+        return false;
+    }
+    return hopCount + 1 - baseline > maxHops;
+}
+//# sourceMappingURL=workflow-deadline.js.map

package/daemon/dist/domain/workflow-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-deadline.js","sourceRoot":"","sources":["../../src/domain/workflow-deadline.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,iEAAiE;AACjE,qEAAqE;AACrE,oCAAoC;AACpC,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,YAAY;AACZ,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,eAAe;AACf,EAAE;AACF,uDAAuD;AACvD,wDAAwD;AACxD,mEAAmE;AACnE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,kEAAkE;AAClE,0CAA0C;AAC1C,qDAAqD;AACrD,8DAA8D;AAC9D,2DAA2D;AAC3D,yDAAyD;AACzD,uEAAuE;AACvE,sEAAsE;AACtE,2DAA2D;AAC3D,+BAA+B;AAC/B,oEAAoE;AACpE,oDAAoD;AACpD,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,cAAc;AACd,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2DAA2D;AAsB3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAgCjE;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA8B,EAC9B,OAAqD,EACrD,GAAS;IAET,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,qCAAqC,GAAG,IAAI,CAAC;IAEjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,SAAS;QAEjE,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACnC,6BAA6B;YAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB;gBACzC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;gBAC9C,CAAC,CAAC,MAAM,CAAC,SAAS;oBAChB,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW;oBACpD,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;YACzD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;wBAC/C,MAAM,EAAE,MAAM,CAAC,iBAAiB;4BAC9B,CAAC,CAAC,qBAAqB;4BACvB,CAAC,CAAC,MAAM,CAAC,SAAS;gCAChB,CAAC,CAAC,YAAY;gCACd,CAAC,CAAC,YAAY;wBAClB,QAAQ,EACN,MAAM,CAAC,iBAAiB;4BACxB,MAAM,CAAC,SAAS;4BAChB,MAAM,CAAC,SAAS;wBAClB,UAAU;qBACX,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,2DAA2D;YAC3D,gEAAgE;YAChE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;YACtE,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;wBAC/C,MAAM,EAAE,YAAY;wBACpB,QAAQ,EAAE,MAAM,CAAC,SAAS;wBAC1B,UAAU;qBACX,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,6BAA6B;IAC/B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CACpB,QAA8B,EAC9B,MAA0B,EAC1B,KAAa,EACb,KAIC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,MAAM,EAAE,QAAQ,CAAC,aAAa;QAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5E,UAAU,EAAE,IAAI,CAAC,GAAG,CAClB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAClE;QACD,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,QAAgB,EAChB,OAA2B;IAE3B,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,GAAG,CAAC,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC3C,CAAC"}

package/daemon/dist/domain/workflow-exception-escalation.d.ts

@@ -0,0 +1,33 @@
+import type Database from "better-sqlite3";
+import type { QueueRepository } from "./queue-repository.js";
+import type { WorkflowDeadlineVerdict } from "./workflow-deadline.js";
+import { type WorkflowExceptionClass } from "./workflow-exception.js";
+import type { ExceptionRoute } from "./workflow-exception-router.js";
+export interface EnsureStuckExceptionInput {
+    workflowName: string;
+    workflowVersion: string;
+    /** The session recorded as the item's source (the instance creator —
+     *  a real, validated session; the detector is machinery, not a seat). */
+    createdBySession: string;
+    verdict: WorkflowDeadlineVerdict;
+}
+export interface EnsureStuckExceptionResult {
+    outcome: "skipped-healthy" | "deduped" | "created";
+    qitemId?: string;
+}
+export type EnsureStuckExceptionItem = (input: EnsureStuckExceptionInput) => Promise<EnsureStuckExceptionResult>;
+export interface StuckExceptionDeps {
+    db: Database.Database;
+    queueRepo: QueueRepository;
+    /** The maturity-dial resolution for a cached spec (runtime-owned —
+     *  spec lookup + the shipped role resolution live there). null =
+     *  spec not cached; the never-lost fallback applies.
+     *  OPR.0.4.6.FAC1 (arch Q3): boundRig = the stuck instance's bound
+     *  rig (read from workflow_instances at detection time) so the
+     *  orchestrator-role dial position resolves capability-aware. */
+    resolveRoute: (workflowName: string, workflowVersion: string, exceptionClass: WorkflowExceptionClass, boundRig?: string | null) => ExceptionRoute | null;
+    humanFallbackSeat?: string;
+    log?: (line: string) => void;
+}
+export declare function makeEnsureStuckExceptionItem(deps: StuckExceptionDeps): EnsureStuckExceptionItem;
+//# sourceMappingURL=workflow-exception-escalation.d.ts.map

package/daemon/dist/domain/workflow-exception-escalation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-exception-escalation.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-exception-escalation.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;6EACyE;IACzE,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,yBAAyB,KAC7B,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;qEAKiE;IACjE,YAAY,EAAE,CACZ,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,sBAAsB,EACtC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,KACrB,cAAc,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,kBAAkB,GAAG,wBAAwB,CAwF/F"}

package/daemon/dist/domain/workflow-exception-escalation.js

@@ -0,0 +1,104 @@
+// OPR.0.4.6.WF5 FR-2 class (b): detection-time exception items for
+// STUCK/OVERDUE instances.
+//
+// Class (b) has NO state-change transaction to ride — the item is created
+// AT DETECTION TIME by the sweep/keepalive evaluation, and its never-lost
+// guarantee is WF-1's crash-surviving sweep: re-detection re-creates a
+// missed item on the next pass (P2 cleanup honored: no same-txn claim is
+// made or implemented here).
+//
+// DEDUP (the occurrence contract): exactly ONE OPEN item per
+// (instance, step, class, occurrence) — the occurrence key is the overdue
+// packet id named by the WF-1 evaluator's evidence. Re-detections of the
+// same unresolved episode find the open item by TAG QUERY (never summary
+// parsing) and re-nudge it instead of minting a duplicate. A resolved/
+// closed item with the episode still live is a MISSED item — the next
+// detection re-creates it (the sweep guarantee), keeping exactly one
+// OPEN item per occurrence at all times.
+//
+// The policy shape is untouched (X5 stands: PolicyEvaluation remains
+// send|skip|terminal) — the keepalive calls this injected helper as a
+// side effect of its EXISTING evaluation; the sweep likewise. Injection
+// at startup per the validateRig precedent.
+import { classifyDeadlineVerdict, workflowExceptionTags, } from "./workflow-exception.js";
+export function makeEnsureStuckExceptionItem(deps) {
+    const log = deps.log ?? (() => { });
+    const fallbackSeat = deps.humanFallbackSeat ?? "human@host";
+    return async (input) => {
+        const exception = classifyDeadlineVerdict(input.workflowName, input.verdict);
+        if (!exception)
+            return { outcome: "skipped-healthy" };
+        // Dedup by tag query against OPEN states only (pending | in-progress
+        // | blocked): one open item per occurrence; a closed item with the
+        // episode still live is missed and gets re-created.
+        const open = deps.db
+            .prepare(`SELECT qitem_id, destination_session FROM queue_items
+         WHERE state IN ('pending','in-progress','blocked')
+           AND tags LIKE ? AND tags LIKE ?`)
+            .get(`%"occurrence:${exception.identity.occurrenceKey}"%`, `%"exception:stuck_overdue"%`);
+        if (open) {
+            // Re-detection of the same unresolved episode: re-nudge the ONE
+            // item (best-effort — the durable item is the guarantee).
+            await deps.queueRepo.maybeNudge(open.qitem_id, open.destination_session, undefined);
+            return { outcome: "deduped", qitemId: open.qitem_id };
+        }
+        // OPR.0.4.6.FAC1 (arch Q3): each exception item is a FRESH routing
+        // decision at its own detection moment — read the stuck instance's
+        // bound rig NOW (defensive to a pre-052 fixture db: absent column
+        // reads as unbound, the shipped behavior).
+        let detectionBoundRig = null;
+        const stuckInstanceId = exception.deadlineEvidence?.instanceId;
+        if (stuckInstanceId) {
+            try {
+                const row = deps.db
+                    .prepare(`SELECT bound_rig FROM workflow_instances WHERE instance_id = ?`)
+                    .get(stuckInstanceId);
+                detectionBoundRig = row?.bound_rig ?? null;
+            }
+            catch {
+                detectionBoundRig = null;
+            }
+        }
+        const route = deps.resolveRoute(input.workflowName, input.workflowVersion, "stuck_overdue", detectionBoundRig) ?? {
+            position: "fallback",
+            destinationSession: fallbackSeat,
+            tier: "human-gate",
+            humanRouted: true,
+            resolvedVia: "engine-default",
+        };
+        const e = exception.deadlineEvidence;
+        const evidenceRef = `rig workflow trace ${e.instanceId}`;
+        const body = `WORKFLOW EXCEPTION (stuck_overdue)\n` +
+            `workflow: ${input.workflowName} v${input.workflowVersion}\n` +
+            `instance: ${e.instanceId}\n` +
+            `step: ${e.stepId ?? "(unbound)"} — packet ${e.packetId} held by ${e.ownerSession} (${e.packetState})\n` +
+            `deadline: ${e.overdueBySeconds}s past the ${e.anchor} anchor (${e.anchorAt}); packet age ${e.ageSeconds}s\n` +
+            `reason: ${exception.reason}\n` +
+            `evidence: ${evidenceRef}\n` +
+            `resolve: re-nudge/replace the owner per the WF-1 dead-seat mechanics (the step re-projects and the flow continues from this step); this item clears when the instance leaves the exception state.`;
+        const createItem = (destination, tier) => deps.queueRepo.create({
+            sourceSession: input.createdBySession,
+            destinationSession: destination,
+            body,
+            priority: "urgent",
+            tier,
+            tags: workflowExceptionTags(exception.identity),
+            summary: exception.reason,
+            evidenceRef,
+        });
+        let created;
+        try {
+            created = await createItem(route.destinationSession, route.tier);
+        }
+        catch {
+            // THE NEVER-LOST WRITE-GATE FALLBACK (same contract as class (a)):
+            // a gate-rejected routed destination re-routes human@host rather
+            // than losing the exception. A failure of THIS create is a real
+            // storage error and propagates to the caller's non-fatal handling.
+            created = await createItem(fallbackSeat, "human-gate");
+        }
+        log(`workflow exception: stuck_overdue item ${created.qitemId} created for instance ${e.instanceId} (step ${e.stepId ?? "?"}, ${route.position})`);
+        return { outcome: "created", qitemId: created.qitemId };
+    };
+}
+//# sourceMappingURL=workflow-exception-escalation.js.map

package/daemon/dist/domain/workflow-exception-escalation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-exception-escalation.js","sourceRoot":"","sources":["../../src/domain/workflow-exception-escalation.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,2BAA2B;AAC3B,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,6BAA6B;AAC7B,EAAE;AACF,6DAA6D;AAC7D,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,yCAAyC;AACzC,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,4CAA4C;AAK5C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAwCjC,MAAM,UAAU,4BAA4B,CAAC,IAAwB;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC;IAC5D,OAAO,KAAK,EAAE,KAAgC,EAAuC,EAAE;QACrF,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAEtD,qEAAqE;QACrE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;2CAEmC,CACpC;aACA,GAAG,CACF,gBAAgB,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,EACpD,6BAA6B,CACmC,CAAC;QACrE,IAAI,IAAI,EAAE,CAAC;YACT,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,2CAA2C;QAC3C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,gBAAgB,EAAE,UAAU,CAAC;QAC/D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;qBAChB,OAAO,CAAC,gEAAgE,CAAC;qBACzE,GAAG,CAAC,eAAe,CAA6C,CAAC;gBACpE,iBAAiB,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GACT,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,IAAI;YAClG,QAAQ,EAAE,UAAmB;YAC7B,kBAAkB,EAAE,YAAY;YAChC,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,IAAI;YACjB,WAAW,EAAE,gBAAyB;SACvC,CAAC;QACJ,MAAM,CAAC,GAAG,SAAS,CAAC,gBAAiB,CAAC;QACtC,MAAM,WAAW,GAAG,sBAAsB,CAAC,CAAC,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,GACR,sCAAsC;YACtC,aAAa,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,eAAe,IAAI;YAC7D,aAAa,CAAC,CAAC,UAAU,IAAI;YAC7B,SAAS,CAAC,CAAC,MAAM,IAAI,WAAW,aAAa,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,WAAW,KAAK;YACxG,aAAa,CAAC,CAAC,gBAAgB,cAAc,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,QAAQ,iBAAiB,CAAC,CAAC,UAAU,KAAK;YAC7G,WAAW,SAAS,CAAC,MAAM,IAAI;YAC/B,aAAa,WAAW,IAAI;YAC5B,mMAAmM,CAAC;QACtM,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,IAAY,EAAE,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACpB,aAAa,EAAE,KAAK,CAAC,gBAAgB;YACrC,kBAAkB,EAAE,WAAW;YAC/B,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,IAAI;YACJ,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC/C,OAAO,EAAE,SAAS,CAAC,MAAM;YACzB,WAAW;SACZ,CAAC,CAAC;QACL,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QACD,GAAG,CACD,0CAA0C,OAAO,CAAC,OAAO,yBAAyB,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,QAAQ,GAAG,CAC9I,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/workflow-exception-router.d.ts

@@ -0,0 +1,33 @@
+import type { WorkflowExceptionClass } from "./workflow-exception.js";
+import type { WorkflowExceptionDialPosition, WorkflowSpec } from "./workflow-types.js";
+/** The ordinary workflow-packet tier (the shipped default the attention
+ *  union deliberately does NOT match on). */
+export declare const WORKFLOW_EXCEPTION_ORCHESTRATOR_TIER = "mode2";
+/** The human-routed tier — the attention union's first leg. */
+export declare const WORKFLOW_EXCEPTION_HUMAN_TIER = "human-gate";
+export interface ExceptionRouteInput {
+    exceptionClass: WorkflowExceptionClass;
+    spec: Pick<WorkflowSpec, "exception_routing" | "roles">;
+    /** The host-level dial default (settings `workflow.exception_routing`),
+     *  read by the caller; null = key unset. */
+    hostDialDefault: WorkflowExceptionDialPosition | null;
+    /** The shipped role→preferred_targets resolution, wrapped by the caller
+     *  (workflow-runtime owns runtime matching). null = unresolvable. */
+    resolveRoleTarget: (roleName: string) => string | null;
+    /** The honest never-lost fallback seat (human@<host> form). */
+    humanFallbackSeat: string;
+}
+export interface ExceptionRoute {
+    /** Where the chain landed. `fallback` = orchestrator position whose
+     *  role target did not resolve (still never lost). */
+    position: "orchestrator" | "human_only" | "fallback";
+    destinationSession: string;
+    /** THE TIER SPLIT — human-gate iff humanRouted. */
+    tier: string;
+    humanRouted: boolean;
+    /** Which chain link decided the position (recorded in item evidence —
+     *  the dial walks assert it). */
+    resolvedVia: "class-intrinsic" | "class-declared" | "workflow-declared" | "host-default" | "engine-default";
+}
+export declare function resolveExceptionRoute(input: ExceptionRouteInput): ExceptionRoute;
+//# sourceMappingURL=workflow-exception-router.d.ts.map

package/daemon/dist/domain/workflow-exception-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-exception-router.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-exception-router.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,6BAA6B,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvF;6CAC6C;AAC7C,eAAO,MAAM,oCAAoC,UAAU,CAAC;AAC5D,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,eAAe,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,sBAAsB,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC;IACxD;gDAC4C;IAC5C,eAAe,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACtD;yEACqE;IACrE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACvD,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B;0DACsD;IACtD,QAAQ,EAAE,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC;IACrD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB;qCACiC;IACjC,WAAW,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,gBAAgB,CAAC;CAC7G;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAsDhF"}