@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/crash-cart-discovery.d.ts

@@ -0,0 +1,137 @@
+import Database from "better-sqlite3";
+/** Refusal: a live daemon holds the DB, so the direct read is unsafe (route to the live read API). */
+export declare class DaemonLiveError extends Error {
+    constructor(message: string);
+}
+/** Loud failure in the direct-read path (e.g. the daemon DB is not where we resolved it). */
+export declare class CrashCartReadError extends Error {
+    constructor(message: string);
+}
+/** The daemon's default DB basename (`$OPENRIG_HOME/openrig.sqlite`) — NOT `main.db`. */
+export declare const DAEMON_DB_BASENAME = "openrig.sqlite";
+/** The daemon state file shape (`$OPENRIG_HOME/daemon.json`) — the authoritative DB-path + liveness record. */
+export interface DaemonJson {
+    pid: number;
+    port: number;
+    host?: string;
+    /** The exact resolved DB path the daemon opened (prefer this over recomputing). */
+    db: string;
+    startedAt?: string;
+}
+export interface AssertDaemonDownDeps {
+    /** `$OPENRIG_HOME` — where daemon.json lives. */
+    openrigHome: string;
+    /** Parse `$OPENRIG_HOME/daemon.json` → the record, or undefined if absent/unparseable (treated as down). */
+    readDaemonJson: (openrigHome: string) => DaemonJson | undefined;
+    /** True if `pid` is a live process (e.g. `process.kill(pid, 0)` succeeds). */
+    isProcessAlive: (pid: number) => boolean;
+    /** GET `<url>` → true if ANY daemon answered (the control-plane is live). Never throws. */
+    probeHealthz: (url: string) => Promise<boolean>;
+    /** `OPENRIG_URL` override — when set, its /healthz is probed too (bypasses the state file, like getDaemonStatus). */
+    openrigUrl?: string;
+}
+/**
+ * FAIL-CLOSED guard: throw DaemonLiveError if a daemon is live, else resolve. A daemon counts as
+ * live if EITHER the recorded pid is alive OR a /healthz probe answers (both must be negative to
+ * proceed). Mirrors the daemon's own liveness logic (daemon.json pid + /healthz, honoring
+ * OPENRIG_URL) so the crash-cart never disagrees with `getDaemonStatus` about "is it running".
+ */
+export declare function assertDaemonDown(deps: AssertDaemonDownDeps): Promise<void>;
+/** The resolved daemon DB location + provenance. `relative` flags a state-file path we cannot
+ *  reliably locate (the daemon's CWD is unknown to a separate reader) — the caller must handle it. */
+export interface ResolvedDbPath {
+    path: string;
+    fromStateFile: boolean;
+    relative: boolean;
+}
+/**
+ * Resolve the daemon DB path. PREFER `daemon.json.db` (the exact path the daemon opened) over
+ * recomputing; fall back to `$OPENRIG_HOME/openrig.sqlite`. A relative state-file path is flagged
+ * (it resolves against the daemon's CWD, unknown here) rather than silently mis-located.
+ */
+export declare function resolveDaemonDbPath(openrigHome: string, readDaemonJson: (openrigHome: string) => DaemonJson | undefined): ResolvedDbPath;
+export interface SnapshotDeps {
+    /** Copy one file (e.g. `copyFileSync`). */
+    copyFile: (src: string, dest: string) => void;
+    /** True if the path exists (e.g. `existsSync`). */
+    exists: (p: string) => boolean;
+}
+/**
+ * Copy the `{db, -wal, -shm}` triple into `scratchDir` and return the copied db path. The db file is
+ * required (loud fail if absent); sidecars are copied only when present (a clean-shutdown DB may have
+ * no -wal). The daemon-down precondition (no concurrent writer) is what makes a plain file-copy
+ * consistent — opening the COPY then replays the WAL on the copy, never touching the originals.
+ */
+export declare function snapshotDaemonDb(dbPath: string, scratchDir: string, deps: SnapshotDeps): string;
+/**
+ * Open a COPIED daemon DB read-only. On the copy (in a writable scratch dir with its -wal/-shm
+ * alongside) SQLite replays the WAL → the fresh, last-pre-crash view. Read-only is safe here because
+ * the copy is disposable and the ORIGINALS are never opened by this path.
+ */
+export declare function openDaemonDbReadonly(copyDbPath: string): Database.Database;
+/** Header facts. `stopReason`/`priorUptimeMs` are ALWAYS null: no shutdown/uptime record is persisted
+ *  anywhere (verified at source), so they are honest-null daemon-down — never fabricated. */
+export interface CrashCartHeader {
+    /** Newest write-timestamp across the durable tables (best-effort "last activity"); null if empty. */
+    lastActivityAt: string | null;
+    /** Last daemon boot (self_host_identity.reconciled_at advances every boot); null if never booted. */
+    lastBootAt: string | null;
+    /** First-ever boot (self_host_identity.minted_at). */
+    firstBootAt: string | null;
+    hostId: string | null;
+    /** UNRECOVERABLE daemon-down — no shutdown record exists. Honest-null. */
+    stopReason: null;
+    /** UNRECOVERABLE daemon-down — no persisted uptime. Honest-null. */
+    priorUptimeMs: null;
+}
+/** One rig found on this host, with the recovery-relevant counts. */
+export interface RigFound {
+    rigId: string;
+    rigName: string;
+    seatCount: number;
+    runningCount: number;
+    /** Seats whose LATEST session was probed resumable (derived; the recoverable bucket). */
+    resumableCount: number;
+    /** Newest persisted `sessions.last_seen_at` for the rig; null if none. (Live "last active" is a
+     *  tmux observation, unavailable daemon-down — this is the honest DB approximation.) */
+    lastActiveAt: string | null;
+}
+/** One in-progress queue item at crash time (display-only; the cart never mutates queue state). */
+export interface StoppedWork {
+    qitemId: string;
+    destinationSession: string;
+    sourceSession: string;
+    state: string;
+    claimedAt: string | null;
+    summary: string | null;
+    tsUpdated: string;
+}
+export interface CrashCartDiscovery {
+    header: CrashCartHeader;
+    foundOnHost: RigFound[];
+    whereWorkStopped: StoppedWork[];
+}
+/** Read the full daemon-down discovery view from an already-opened (copied) daemon DB. Read-only. */
+export declare function readCrashCartDiscovery(db: Database.Database): CrashCartDiscovery;
+export interface LoadCrashCartDiscoveryDeps extends AssertDaemonDownDeps {
+    /** Copy one file (e.g. `copyFileSync`). */
+    copyFile: (src: string, dest: string) => void;
+    /** True if the path exists (e.g. `existsSync`). */
+    exists: (p: string) => boolean;
+    /** Create a fresh disposable scratch dir for the DB copy; returns its path. */
+    makeScratchDir: () => string;
+    /** Remove the scratch dir (best-effort cleanup). */
+    removeScratchDir: (dir: string) => void;
+    /** Open the copied DB read-only. Defaults to openDaemonDbReadonly; injected in tests. */
+    openDb?: (copyDbPath: string) => Database.Database;
+}
+/**
+ * The public C2 entry: safely read the daemon-down discovery view. FAIL-CLOSED FIRST (throws
+ * DaemonLiveError before touching disk if a daemon is live), then copy-then-read the DB into a
+ * disposable scratch dir, read the view, and ALWAYS clean up the scratch copy. Read-only end to end.
+ */
+export declare function loadCrashCartDiscovery(deps: LoadCrashCartDiscoveryDeps): Promise<{
+    discovery: CrashCartDiscovery;
+    dbPath: ResolvedDbPath;
+}>;
+//# sourceMappingURL=crash-cart-discovery.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-discovery.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-discovery.ts"],"names":[],"mappings":"AAcA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,sGAAsG;AACtG,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD,+GAA+G;AAC/G,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,4GAA4G;IAC5G,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IAChE,8EAA8E;IAC9E,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,2FAA2F;IAC3F,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,qHAAqH;IACrH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhF;AAED;sGACsG;AACtG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,GAC9D,cAAc,CAMhB;AAED,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAU/F;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAE1E;AAID;6FAC6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qGAAqG;IACrG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0EAA0E;IAC1E,UAAU,EAAE,IAAI,CAAC;IACjB,oEAAoE;IACpE,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAC;IACvB;4FACwF;IACxF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,QAAQ,EAAE,CAAC;IACxB,gBAAgB,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,qGAAqG;AACrG,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,kBAAkB,CAMhF;AAmED,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,2CAA2C;IAC3C,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,+EAA+E;IAC/E,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,yFAAyF;IACzF,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC;IAAE,SAAS,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC,CA0BpE"}

package/node_modules/@openrig/daemon/dist/domain/crash-cart-discovery.js

@@ -0,0 +1,214 @@
+// Crash-cart C2 — daemon-DOWN bounded direct-read discovery (plan c015d9ed §C2, arch a1344201).
+//
+// When the daemon is down (or won't start), the cockpit must still SHOW what is on this host —
+// looking is always safe. This module reads the daemon's durable SQLite state WITHOUT a running
+// daemon, via COPY-THEN-READ (arch Q1): the daemon DB is WAL-mode, so a post-crash `-wal` holds
+// the last committed-but-unreplayed frames (exactly the where-work-stopped rows we must show).
+// We copy the {db, -wal, -shm} triple to a disposable scratch dir and open the COPY read-only, so
+// SQLite replays the WAL on the copy → a FRESH view with ZERO interference to the originals a
+// restarting daemon will reopen. READ-ONLY by construction: nothing here ever writes daemon state.
+//
+// The read is fail-closed: it REFUSES if a daemon is live (see assertDaemonDown) — never contend
+// with the process it exists to recover. All process/IO probes are injected so the logic is
+// hermetically unit-testable.
+import Database from "better-sqlite3";
+import { basename, isAbsolute, join } from "node:path";
+/** Refusal: a live daemon holds the DB, so the direct read is unsafe (route to the live read API). */
+export class DaemonLiveError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DaemonLiveError";
+    }
+}
+/** Loud failure in the direct-read path (e.g. the daemon DB is not where we resolved it). */
+export class CrashCartReadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CrashCartReadError";
+    }
+}
+/** The daemon's default DB basename (`$OPENRIG_HOME/openrig.sqlite`) — NOT `main.db`. */
+export const DAEMON_DB_BASENAME = "openrig.sqlite";
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = 7433;
+function stripTrailingSlash(u) {
+    return u.endsWith("/") ? u.slice(0, -1) : u;
+}
+/**
+ * FAIL-CLOSED guard: throw DaemonLiveError if a daemon is live, else resolve. A daemon counts as
+ * live if EITHER the recorded pid is alive OR a /healthz probe answers (both must be negative to
+ * proceed). Mirrors the daemon's own liveness logic (daemon.json pid + /healthz, honoring
+ * OPENRIG_URL) so the crash-cart never disagrees with `getDaemonStatus` about "is it running".
+ */
+export async function assertDaemonDown(deps) {
+    const { openrigHome, readDaemonJson, isProcessAlive, probeHealthz, openrigUrl } = deps;
+    // OPENRIG_URL, when set, is a direct daemon target — probe it first (a live answer = refuse).
+    if (openrigUrl && openrigUrl.trim().length > 0) {
+        if (await probeHealthz(`${stripTrailingSlash(openrigUrl.trim())}/healthz`)) {
+            throw new DaemonLiveError(`a daemon answered OPENRIG_URL ${openrigUrl} — refusing the direct read`);
+        }
+    }
+    const state = readDaemonJson(openrigHome);
+    if (state) {
+        if (typeof state.pid === "number" && isProcessAlive(state.pid)) {
+            throw new DaemonLiveError(`daemon.json pid ${state.pid} is still alive — refusing the direct read`);
+        }
+        const host = state.host ?? DEFAULT_HOST;
+        const port = state.port ?? DEFAULT_PORT;
+        if (await probeHealthz(`http://${host}:${port}/healthz`)) {
+            throw new DaemonLiveError(`a daemon answered http://${host}:${port}/healthz — refusing the direct read`);
+        }
+        return;
+    }
+    // No state file — a daemon could still be up without a readable one; probe the default address.
+    if (await probeHealthz(`http://${DEFAULT_HOST}:${DEFAULT_PORT}/healthz`)) {
+        throw new DaemonLiveError(`a daemon answered the default http://${DEFAULT_HOST}:${DEFAULT_PORT}/healthz — refusing the direct read`);
+    }
+}
+/**
+ * Resolve the daemon DB path. PREFER `daemon.json.db` (the exact path the daemon opened) over
+ * recomputing; fall back to `$OPENRIG_HOME/openrig.sqlite`. A relative state-file path is flagged
+ * (it resolves against the daemon's CWD, unknown here) rather than silently mis-located.
+ */
+export function resolveDaemonDbPath(openrigHome, readDaemonJson) {
+    const state = readDaemonJson(openrigHome);
+    if (state?.db && state.db.trim().length > 0) {
+        return { path: state.db, fromStateFile: true, relative: !isAbsolute(state.db) };
+    }
+    return { path: join(openrigHome, DAEMON_DB_BASENAME), fromStateFile: false, relative: false };
+}
+/**
+ * Copy the `{db, -wal, -shm}` triple into `scratchDir` and return the copied db path. The db file is
+ * required (loud fail if absent); sidecars are copied only when present (a clean-shutdown DB may have
+ * no -wal). The daemon-down precondition (no concurrent writer) is what makes a plain file-copy
+ * consistent — opening the COPY then replays the WAL on the copy, never touching the originals.
+ */
+export function snapshotDaemonDb(dbPath, scratchDir, deps) {
+    if (!deps.exists(dbPath)) {
+        throw new CrashCartReadError(`daemon DB not found at ${dbPath} — cannot copy-then-read`);
+    }
+    const destDb = join(scratchDir, basename(dbPath));
+    deps.copyFile(dbPath, destDb);
+    for (const suffix of ["-wal", "-shm"]) {
+        if (deps.exists(dbPath + suffix))
+            deps.copyFile(dbPath + suffix, destDb + suffix);
+    }
+    return destDb;
+}
+/**
+ * Open a COPIED daemon DB read-only. On the copy (in a writable scratch dir with its -wal/-shm
+ * alongside) SQLite replays the WAL → the fresh, last-pre-crash view. Read-only is safe here because
+ * the copy is disposable and the ORIGINALS are never opened by this path.
+ */
+export function openDaemonDbReadonly(copyDbPath) {
+    return new Database(copyDbPath, { readonly: true, fileMustExist: true });
+}
+/** Read the full daemon-down discovery view from an already-opened (copied) daemon DB. Read-only. */
+export function readCrashCartDiscovery(db) {
+    return {
+        header: readHeader(db),
+        foundOnHost: readFoundOnHost(db),
+        whereWorkStopped: readWhereWorkStopped(db),
+    };
+}
+function readHeader(db) {
+    const id = db
+        .prepare("SELECT host_id, minted_at, reconciled_at FROM self_host_identity WHERE singleton = 1")
+        .get();
+    // Newest write across the durable tables. datetime() in ORDER BY normalizes the mixed timestamp
+    // formats (ISO-Z app writes vs SQLite `datetime('now')` defaults) so the comparison is chronological;
+    // we return the ORIGINAL string of that newest row.
+    const act = db
+        .prepare(`SELECT ts FROM (
+         SELECT last_seen_at AS ts FROM sessions
+         UNION ALL SELECT created_at FROM sessions
+         UNION ALL SELECT created_at FROM events
+         UNION ALL SELECT ts_updated FROM queue_items
+         UNION ALL SELECT last_seen_at FROM discovered_sessions
+         UNION ALL SELECT reconciled_at FROM self_host_identity WHERE singleton = 1
+       ) WHERE ts IS NOT NULL ORDER BY datetime(ts) DESC LIMIT 1`)
+        .get();
+    return {
+        lastActivityAt: act?.ts ?? null,
+        lastBootAt: id?.reconciled_at ?? null,
+        firstBootAt: id?.minted_at ?? null,
+        hostId: id?.host_id ?? null,
+        stopReason: null,
+        priorUptimeMs: null,
+    };
+}
+function readFoundOnHost(db) {
+    // Per rig: seat count + counts folded over the LATEST session per node (max ULID id, per the
+    // daemon's own latest-per-node convention) + newest persisted last_seen_at.
+    const rows = db
+        .prepare(`SELECT r.id AS rigId, r.name AS rigName,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id) AS seatCount,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id
+            AND (SELECT s.status FROM sessions s WHERE s.node_id = n.id ORDER BY s.id DESC LIMIT 1) = 'running'
+         ) AS runningCount,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id
+            AND (SELECT s.resume_last_probe_status FROM sessions s WHERE s.node_id = n.id ORDER BY s.id DESC LIMIT 1) = 'resumable'
+         ) AS resumableCount,
+         (SELECT MAX(s.last_seen_at) FROM sessions s JOIN nodes n ON s.node_id = n.id WHERE n.rig_id = r.id) AS lastActiveAt
+       FROM rigs r
+       WHERE r.archived_at IS NULL
+       ORDER BY r.name ASC`)
+        .all();
+    return rows.map((r) => ({
+        rigId: r.rigId,
+        rigName: r.rigName,
+        seatCount: r.seatCount,
+        runningCount: r.runningCount,
+        resumableCount: r.resumableCount,
+        lastActiveAt: r.lastActiveAt ?? null,
+    }));
+}
+/**
+ * The public C2 entry: safely read the daemon-down discovery view. FAIL-CLOSED FIRST (throws
+ * DaemonLiveError before touching disk if a daemon is live), then copy-then-read the DB into a
+ * disposable scratch dir, read the view, and ALWAYS clean up the scratch copy. Read-only end to end.
+ */
+export async function loadCrashCartDiscovery(deps) {
+    // Refuse before any disk work if a daemon holds the DB.
+    await assertDaemonDown(deps);
+    const resolved = resolveDaemonDbPath(deps.openrigHome, deps.readDaemonJson);
+    if (resolved.relative) {
+        throw new CrashCartReadError(`daemon DB path '${resolved.path}' is relative — the daemon CWD is unknown, cannot locate it daemon-down`);
+    }
+    const scratchDir = deps.makeScratchDir();
+    try {
+        const copyDb = snapshotDaemonDb(resolved.path, scratchDir, {
+            copyFile: deps.copyFile,
+            exists: deps.exists,
+        });
+        const db = (deps.openDb ?? openDaemonDbReadonly)(copyDb);
+        try {
+            return { discovery: readCrashCartDiscovery(db), dbPath: resolved };
+        }
+        finally {
+            db.close();
+        }
+    }
+    finally {
+        deps.removeScratchDir(scratchDir);
+    }
+}
+function readWhereWorkStopped(db) {
+    const rows = db
+        .prepare(`SELECT qitem_id AS qitemId, destination_session AS destinationSession, source_session AS sourceSession,
+              state, claimed_at AS claimedAt, summary, ts_updated AS tsUpdated
+       FROM queue_items
+       WHERE state = 'in-progress'
+       ORDER BY datetime(ts_updated) DESC, qitem_id DESC`)
+        .all();
+    return rows.map((r) => ({
+        qitemId: r.qitemId,
+        destinationSession: r.destinationSession,
+        sourceSession: r.sourceSession,
+        state: r.state,
+        claimedAt: r.claimedAt ?? null,
+        summary: r.summary ?? null,
+        tsUpdated: r.tsUpdated,
+    }));
+}
+//# sourceMappingURL=crash-cart-discovery.js.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-discovery.js","sourceRoot":"","sources":["../../src/domain/crash-cart-discovery.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,4FAA4F;AAC5F,8BAA8B;AAE9B,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEvD,sGAAsG;AACtG,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAyBnD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEvF,8FAA8F;IAC9F,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,YAAY,CAAC,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,eAAe,CAAC,iCAAiC,UAAU,6BAA6B,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,eAAe,CAAC,mBAAmB,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;QACxC,IAAI,MAAM,YAAY,CAAC,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,IAAI,IAAI,qCAAqC,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,IAAI,MAAM,YAAY,CAAC,UAAU,YAAY,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,eAAe,CACvB,wCAAwC,YAAY,IAAI,YAAY,qCAAqC,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,cAA+D;IAE/D,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChG,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAkB;IACrF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,MAAM,0BAA0B,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAkDD,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACtB,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAChC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,EAAqB;IACvC,MAAM,EAAE,GAAG,EAAE;SACV,OAAO,CAAC,sFAAsF,CAAC;SAC/F,GAAG,EAA+E,CAAC;IACtF,gGAAgG;IAChG,sGAAsG;IACtG,oDAAoD;IACpD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;;;;;iEAO2D,CAC5D;SACA,GAAG,EAAgC,CAAC;IACvC,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI;QAC/B,UAAU,EAAE,EAAE,EAAE,aAAa,IAAI,IAAI;QACrC,WAAW,EAAE,EAAE,EAAE,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI;QAC3B,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB;IAC5C,6FAA6F;IAC7F,4EAA4E;IAC5E,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;;;;;;;;2BAWqB,CACtB;SACA,GAAG,EAOJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC;IAEhC,wDAAwD;IACxD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,QAAQ,CAAC,IAAI,yEAAyE,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAqB;IACjD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;yDAImD,CACpD;SACA,GAAG,EAQJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/crash-cart-emit.d.ts

@@ -0,0 +1,22 @@
+import type { DaemonState, DaemonUnverifiedEvidence } from "./crash-cart-detect.js";
+import type { CrashCartDiscovery } from "./crash-cart-discovery.js";
+/** The verb's JSON payload. Exactly one of {evidence | discovery | refusal} accompanies the state
+ *  (up → none; unverified → evidence; down → discovery, or refusal if the read fail-closed). */
+export interface CrashCartEmit {
+    state: DaemonState;
+    evidence?: DaemonUnverifiedEvidence;
+    discovery?: CrashCartDiscovery;
+    refusal?: string;
+}
+export interface EmitCrashCartDeps {
+    /** Resolve the 3-state verdict (bounded-retry detector). */
+    resolveState: () => Promise<DaemonState>;
+    /** Assemble the UNVERIFIED evidence (pid state + last probe). */
+    assembleEvidence: () => Promise<DaemonUnverifiedEvidence>;
+    /** Run the C2 daemon-down read (loadCrashCartDiscovery) VERBATIM; may fail-closed (throws). */
+    loadDiscovery: () => Promise<CrashCartDiscovery>;
+}
+/** Assemble the verb's verdict. UP → state only; UNVERIFIED → state + evidence (no read); DOWN → the
+ *  read's discovery, or a structured refusal note if the read fail-closed. */
+export declare function emitCrashCartState(deps: EmitCrashCartDeps): Promise<CrashCartEmit>;
+//# sourceMappingURL=crash-cart-emit.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-emit.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-emit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;gGACgG;AAChG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,YAAY,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1D,+FAA+F;IAC/F,aAAa,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClD;AAED;8EAC8E;AAC9E,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAUxF"}

package/node_modules/@openrig/daemon/dist/domain/crash-cart-emit.js

@@ -0,0 +1,23 @@
+// Crash-cart C3 — the SSOT for the `rig crash-cart --json` payload (plan c015d9ed §C3, coupling
+// ruling option C, 4 rails). ONE JSON = the 3-state detector verdict + (on DOWN) the discovery
+// (rail 3). Composes the detector + the C2 read VERBATIM (rail 2 — never a parallel read). A
+// fail-closed refusal of the read emits a STRUCTURED refusal note (NOT exit-code-only, NO discovery)
+// so the TUI never renders the recovery cockpit from a refusal. Read-only (rail 1). The sub-steps are
+// injected so this decision layer is deterministic; the CLI verb wires the real detector + read.
+/** Assemble the verb's verdict. UP → state only; UNVERIFIED → state + evidence (no read); DOWN → the
+ *  read's discovery, or a structured refusal note if the read fail-closed. */
+export async function emitCrashCartState(deps) {
+    const state = await deps.resolveState();
+    if (state === "up")
+        return { state };
+    if (state === "unverified")
+        return { state, evidence: await deps.assembleEvidence() };
+    // down — attempt the C2 read; a refusal is structured, never a rendered cockpit.
+    try {
+        return { state, discovery: await deps.loadDiscovery() };
+    }
+    catch (e) {
+        return { state, refusal: e instanceof Error ? e.message : String(e) };
+    }
+}
+//# sourceMappingURL=crash-cart-emit.js.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-emit.js","sourceRoot":"","sources":["../../src/domain/crash-cart-emit.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,+FAA+F;AAC/F,6FAA6F;AAC7F,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AAuBjG;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAuB;IAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACtF,iFAAiF;IACjF,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;AACH,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/crash-cart-probes.d.ts

@@ -0,0 +1,23 @@
+import type { DaemonStateFile, HealthzProbeResult } from "./crash-cart-detect.js";
+/** Classify a fetch REJECTION into a probe result. ECONNREFUSED = the only strong down signal; an
+ *  abort/timeout = unverified; anything else = timeout (conservative — never a fabricated down). */
+export declare function classifyProbeError(err: {
+    code?: string;
+    name?: string;
+}): HealthzProbeResult;
+export interface ProbeDeps {
+    fetch: (url: string, init?: {
+        signal?: AbortSignal;
+    }) => Promise<Response>;
+    timeoutMs?: number;
+}
+/** Probe `<url>` (a daemon /healthz): 2xx → answered; non-2xx (foreign occupant) → not-openrig; a
+ *  rejection is classified (refused/timeout). Bounded by an abort timeout. */
+export declare function probeHealthz(url: string, deps: ProbeDeps): Promise<HealthzProbeResult>;
+/** True if `pid` is a live process. `process.kill(pid, 0)` throws ESRCH when absent, EPERM when it
+ *  exists but we can't signal it (still alive). */
+export declare function isProcessAlive(pid: number): boolean;
+/** Read + parse `$OPENRIG_HOME/daemon.json` → the {pid,port,host} record, or undefined if absent or
+ *  malformed (treated as "no state file"). */
+export declare function readDaemonJson(openrigHome: string): DaemonStateFile | undefined;
+//# sourceMappingURL=crash-cart-probes.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-probes.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAElF;oGACoG;AACpG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAI5F;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;8EAC8E;AAC9E,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW5F;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;8CAC8C;AAC9C,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAY/E"}

package/node_modules/@openrig/daemon/dist/domain/crash-cart-probes.js

@@ -0,0 +1,59 @@
+// Crash-cart C3 — the REAL probe adapters wired into resolveDaemonState (main.ts). The classification
+// logic is unit-tested (injected fetch); isProcessAlive/readDaemonJson are thin node-API wrappers
+// proven by the real-daemon-down run.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** Classify a fetch REJECTION into a probe result. ECONNREFUSED = the only strong down signal; an
+ *  abort/timeout = unverified; anything else = timeout (conservative — never a fabricated down). */
+export function classifyProbeError(err) {
+    if (err.code === "ECONNREFUSED")
+        return "refused";
+    if (err.name === "AbortError" || err.code === "ETIMEDOUT" || err.code === "UND_ERR_CONNECT_TIMEOUT")
+        return "timeout";
+    return "timeout";
+}
+/** Probe `<url>` (a daemon /healthz): 2xx → answered; non-2xx (foreign occupant) → not-openrig; a
+ *  rejection is classified (refused/timeout). Bounded by an abort timeout. */
+export async function probeHealthz(url, deps) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? 800);
+    try {
+        const res = await deps.fetch(url, { signal: controller.signal });
+        return res.ok ? "answered" : "not-openrig";
+    }
+    catch (e) {
+        return classifyProbeError((e ?? {}));
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** True if `pid` is a live process. `process.kill(pid, 0)` throws ESRCH when absent, EPERM when it
+ *  exists but we can't signal it (still alive). */
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === "EPERM";
+    }
+}
+/** Read + parse `$OPENRIG_HOME/daemon.json` → the {pid,port,host} record, or undefined if absent or
+ *  malformed (treated as "no state file"). */
+export function readDaemonJson(openrigHome) {
+    const p = join(openrigHome, "daemon.json");
+    if (!existsSync(p))
+        return undefined;
+    try {
+        const j = JSON.parse(readFileSync(p, "utf8"));
+        if (typeof j.pid === "number" && typeof j.port === "number") {
+            return { pid: j.pid, port: j.port, host: typeof j.host === "string" ? j.host : undefined };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=crash-cart-probes.js.map

package/node_modules/@openrig/daemon/dist/domain/crash-cart-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-probes.js","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;oGACoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,GAAqC;IACtE,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,SAAS,CAAC;IACtH,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAe;IAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAsD,CAAC;QACnG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/cwd-resolution.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveLaunchCwd(authoredCwd: string | null | undefined, specRoot: string, cwdOverride?: string | null): string;
+export declare function getOpenRigInstallRoot(): string;
+export declare function isPathInsideRoot(candidatePath: string, rootPath: string): boolean;
+export declare function getOpenRigInstallCwdError(resolvedCwd: string, cwdOverride?: string | null, installRoot?: string): string | null;
+//# sourceMappingURL=cwd-resolution.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/cwd-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwd-resolution.d.ts","sourceRoot":"","sources":["../../src/domain/cwd-resolution.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,MAAM,CAUR;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjF;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAC3B,WAAW,GAAE,MAAgC,GAC5C,MAAM,GAAG,IAAI,CAQf"}

package/node_modules/@openrig/daemon/dist/domain/cwd-resolution.js

@@ -0,0 +1,29 @@
+import nodePath from "node:path";
+export function resolveLaunchCwd(authoredCwd, specRoot, cwdOverride) {
+    if (cwdOverride && cwdOverride.trim().length > 0) {
+        return nodePath.resolve(cwdOverride);
+    }
+    if (!authoredCwd || authoredCwd.trim().length === 0) {
+        return nodePath.resolve(specRoot);
+    }
+    return nodePath.isAbsolute(authoredCwd)
+        ? authoredCwd
+        : nodePath.resolve(specRoot, authoredCwd);
+}
+export function getOpenRigInstallRoot() {
+    return nodePath.resolve(import.meta.dirname, "../..");
+}
+export function isPathInsideRoot(candidatePath, rootPath) {
+    const relative = nodePath.relative(nodePath.resolve(rootPath), nodePath.resolve(candidatePath));
+    return relative === "" || (!relative.startsWith("..") && !nodePath.isAbsolute(relative));
+}
+export function getOpenRigInstallCwdError(resolvedCwd, cwdOverride, installRoot = getOpenRigInstallRoot()) {
+    if (cwdOverride && cwdOverride.trim().length > 0) {
+        return null;
+    }
+    if (!isPathInsideRoot(resolvedCwd, installRoot)) {
+        return null;
+    }
+    return `Resolved cwd '${resolvedCwd}' is inside the OpenRig installation '${installRoot}', which is not a valid project workspace. Pass --cwd <path> to launch into your project directory.`;
+}
+//# sourceMappingURL=cwd-resolution.js.map

package/node_modules/@openrig/daemon/dist/domain/cwd-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwd-resolution.js","sourceRoot":"","sources":["../../src/domain/cwd-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAC9B,WAAsC,EACtC,QAAgB,EAChB,WAA2B;IAE3B,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QACrC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAAqB,EAAE,QAAgB;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAChG,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,WAA2B,EAC3B,cAAsB,qBAAqB,EAAE;IAE7C,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,iBAAiB,WAAW,yCAAyC,WAAW,qGAAqG,CAAC;AAC/L,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/daemon-lifecycle-store.d.ts

@@ -0,0 +1,30 @@
+import type Database from "better-sqlite3";
+/** The daemon's lifecycle record (mig-061 singleton) — started / last-seen /
+ *  stopped for the current boot epoch. Distinct from the identity record (059). */
+export interface DaemonLifecycleRecord {
+    bootEpoch: string;
+    startedAt: string;
+    lastHeartbeatAt: string | null;
+    stoppedAt: string | null;
+}
+/**
+ * P7 — accessors for the daemon_lifecycle singleton. Each write is a single
+ * statement = its own implicit SQLite transaction (arch: "own tiny transaction").
+ * The heartbeat guards not-stopped and the stop is terminal-per-epoch, so a stray
+ * post-stop tick can never advance last-seen (the binding write-order pin).
+ */
+export declare class DaemonLifecycleStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    /** A new boot: mint a new epoch, set started_at, and CLEAR the prior run's
+     *  heartbeat + stopped_at (a fresh epoch never shows the previous run's stop). */
+    recordBoot(bootEpoch: string, nowIso: string): void;
+    /** Advance last-seen — ONLY while not stopped (a stray tick after stopped_at
+     *  must never move last-seen; stopped_at is terminal per epoch). */
+    recordHeartbeat(nowIso: string): void;
+    /** Clean-shutdown mark — set stopped_at ONLY for the matching epoch and only if
+     *  not already stopped (terminal per epoch). */
+    recordStop(bootEpoch: string, nowIso: string): void;
+    get(): DaemonLifecycleRecord | null;
+}
+//# sourceMappingURL=daemon-lifecycle-store.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/daemon-lifecycle-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-lifecycle-store.d.ts","sourceRoot":"","sources":["../../src/domain/daemon-lifecycle-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C;mFACmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD;;;;;GAKG;AACH,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD;sFACkF;IAClF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAcnD;wEACoE;IACpE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMrC;oDACgD;IAChD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMnD,GAAG,IAAI,qBAAqB,GAAG,IAAI;CAYpC"}