@openrig/cli 0.5.0 → 0.5.2

package/daemon/dist/domain/crash-cart-discovery.js

@@ -0,0 +1,214 @@
+// Crash-cart C2 — daemon-DOWN bounded direct-read discovery (plan c015d9ed §C2, arch a1344201).
+//
+// When the daemon is down (or won't start), the cockpit must still SHOW what is on this host —
+// looking is always safe. This module reads the daemon's durable SQLite state WITHOUT a running
+// daemon, via COPY-THEN-READ (arch Q1): the daemon DB is WAL-mode, so a post-crash `-wal` holds
+// the last committed-but-unreplayed frames (exactly the where-work-stopped rows we must show).
+// We copy the {db, -wal, -shm} triple to a disposable scratch dir and open the COPY read-only, so
+// SQLite replays the WAL on the copy → a FRESH view with ZERO interference to the originals a
+// restarting daemon will reopen. READ-ONLY by construction: nothing here ever writes daemon state.
+//
+// The read is fail-closed: it REFUSES if a daemon is live (see assertDaemonDown) — never contend
+// with the process it exists to recover. All process/IO probes are injected so the logic is
+// hermetically unit-testable.
+import Database from "better-sqlite3";
+import { basename, isAbsolute, join } from "node:path";
+/** Refusal: a live daemon holds the DB, so the direct read is unsafe (route to the live read API). */
+export class DaemonLiveError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DaemonLiveError";
+    }
+}
+/** Loud failure in the direct-read path (e.g. the daemon DB is not where we resolved it). */
+export class CrashCartReadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CrashCartReadError";
+    }
+}
+/** The daemon's default DB basename (`$OPENRIG_HOME/openrig.sqlite`) — NOT `main.db`. */
+export const DAEMON_DB_BASENAME = "openrig.sqlite";
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = 7433;
+function stripTrailingSlash(u) {
+    return u.endsWith("/") ? u.slice(0, -1) : u;
+}
+/**
+ * FAIL-CLOSED guard: throw DaemonLiveError if a daemon is live, else resolve. A daemon counts as
+ * live if EITHER the recorded pid is alive OR a /healthz probe answers (both must be negative to
+ * proceed). Mirrors the daemon's own liveness logic (daemon.json pid + /healthz, honoring
+ * OPENRIG_URL) so the crash-cart never disagrees with `getDaemonStatus` about "is it running".
+ */
+export async function assertDaemonDown(deps) {
+    const { openrigHome, readDaemonJson, isProcessAlive, probeHealthz, openrigUrl } = deps;
+    // OPENRIG_URL, when set, is a direct daemon target — probe it first (a live answer = refuse).
+    if (openrigUrl && openrigUrl.trim().length > 0) {
+        if (await probeHealthz(`${stripTrailingSlash(openrigUrl.trim())}/healthz`)) {
+            throw new DaemonLiveError(`a daemon answered OPENRIG_URL ${openrigUrl} — refusing the direct read`);
+        }
+    }
+    const state = readDaemonJson(openrigHome);
+    if (state) {
+        if (typeof state.pid === "number" && isProcessAlive(state.pid)) {
+            throw new DaemonLiveError(`daemon.json pid ${state.pid} is still alive — refusing the direct read`);
+        }
+        const host = state.host ?? DEFAULT_HOST;
+        const port = state.port ?? DEFAULT_PORT;
+        if (await probeHealthz(`http://${host}:${port}/healthz`)) {
+            throw new DaemonLiveError(`a daemon answered http://${host}:${port}/healthz — refusing the direct read`);
+        }
+        return;
+    }
+    // No state file — a daemon could still be up without a readable one; probe the default address.
+    if (await probeHealthz(`http://${DEFAULT_HOST}:${DEFAULT_PORT}/healthz`)) {
+        throw new DaemonLiveError(`a daemon answered the default http://${DEFAULT_HOST}:${DEFAULT_PORT}/healthz — refusing the direct read`);
+    }
+}
+/**
+ * Resolve the daemon DB path. PREFER `daemon.json.db` (the exact path the daemon opened) over
+ * recomputing; fall back to `$OPENRIG_HOME/openrig.sqlite`. A relative state-file path is flagged
+ * (it resolves against the daemon's CWD, unknown here) rather than silently mis-located.
+ */
+export function resolveDaemonDbPath(openrigHome, readDaemonJson) {
+    const state = readDaemonJson(openrigHome);
+    if (state?.db && state.db.trim().length > 0) {
+        return { path: state.db, fromStateFile: true, relative: !isAbsolute(state.db) };
+    }
+    return { path: join(openrigHome, DAEMON_DB_BASENAME), fromStateFile: false, relative: false };
+}
+/**
+ * Copy the `{db, -wal, -shm}` triple into `scratchDir` and return the copied db path. The db file is
+ * required (loud fail if absent); sidecars are copied only when present (a clean-shutdown DB may have
+ * no -wal). The daemon-down precondition (no concurrent writer) is what makes a plain file-copy
+ * consistent — opening the COPY then replays the WAL on the copy, never touching the originals.
+ */
+export function snapshotDaemonDb(dbPath, scratchDir, deps) {
+    if (!deps.exists(dbPath)) {
+        throw new CrashCartReadError(`daemon DB not found at ${dbPath} — cannot copy-then-read`);
+    }
+    const destDb = join(scratchDir, basename(dbPath));
+    deps.copyFile(dbPath, destDb);
+    for (const suffix of ["-wal", "-shm"]) {
+        if (deps.exists(dbPath + suffix))
+            deps.copyFile(dbPath + suffix, destDb + suffix);
+    }
+    return destDb;
+}
+/**
+ * Open a COPIED daemon DB read-only. On the copy (in a writable scratch dir with its -wal/-shm
+ * alongside) SQLite replays the WAL → the fresh, last-pre-crash view. Read-only is safe here because
+ * the copy is disposable and the ORIGINALS are never opened by this path.
+ */
+export function openDaemonDbReadonly(copyDbPath) {
+    return new Database(copyDbPath, { readonly: true, fileMustExist: true });
+}
+/** Read the full daemon-down discovery view from an already-opened (copied) daemon DB. Read-only. */
+export function readCrashCartDiscovery(db) {
+    return {
+        header: readHeader(db),
+        foundOnHost: readFoundOnHost(db),
+        whereWorkStopped: readWhereWorkStopped(db),
+    };
+}
+function readHeader(db) {
+    const id = db
+        .prepare("SELECT host_id, minted_at, reconciled_at FROM self_host_identity WHERE singleton = 1")
+        .get();
+    // Newest write across the durable tables. datetime() in ORDER BY normalizes the mixed timestamp
+    // formats (ISO-Z app writes vs SQLite `datetime('now')` defaults) so the comparison is chronological;
+    // we return the ORIGINAL string of that newest row.
+    const act = db
+        .prepare(`SELECT ts FROM (
+         SELECT last_seen_at AS ts FROM sessions
+         UNION ALL SELECT created_at FROM sessions
+         UNION ALL SELECT created_at FROM events
+         UNION ALL SELECT ts_updated FROM queue_items
+         UNION ALL SELECT last_seen_at FROM discovered_sessions
+         UNION ALL SELECT reconciled_at FROM self_host_identity WHERE singleton = 1
+       ) WHERE ts IS NOT NULL ORDER BY datetime(ts) DESC LIMIT 1`)
+        .get();
+    return {
+        lastActivityAt: act?.ts ?? null,
+        lastBootAt: id?.reconciled_at ?? null,
+        firstBootAt: id?.minted_at ?? null,
+        hostId: id?.host_id ?? null,
+        stopReason: null,
+        priorUptimeMs: null,
+    };
+}
+function readFoundOnHost(db) {
+    // Per rig: seat count + counts folded over the LATEST session per node (max ULID id, per the
+    // daemon's own latest-per-node convention) + newest persisted last_seen_at.
+    const rows = db
+        .prepare(`SELECT r.id AS rigId, r.name AS rigName,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id) AS seatCount,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id
+            AND (SELECT s.status FROM sessions s WHERE s.node_id = n.id ORDER BY s.id DESC LIMIT 1) = 'running'
+         ) AS runningCount,
+         (SELECT COUNT(*) FROM nodes n WHERE n.rig_id = r.id
+            AND (SELECT s.resume_last_probe_status FROM sessions s WHERE s.node_id = n.id ORDER BY s.id DESC LIMIT 1) = 'resumable'
+         ) AS resumableCount,
+         (SELECT MAX(s.last_seen_at) FROM sessions s JOIN nodes n ON s.node_id = n.id WHERE n.rig_id = r.id) AS lastActiveAt
+       FROM rigs r
+       WHERE r.archived_at IS NULL
+       ORDER BY r.name ASC`)
+        .all();
+    return rows.map((r) => ({
+        rigId: r.rigId,
+        rigName: r.rigName,
+        seatCount: r.seatCount,
+        runningCount: r.runningCount,
+        resumableCount: r.resumableCount,
+        lastActiveAt: r.lastActiveAt ?? null,
+    }));
+}
+/**
+ * The public C2 entry: safely read the daemon-down discovery view. FAIL-CLOSED FIRST (throws
+ * DaemonLiveError before touching disk if a daemon is live), then copy-then-read the DB into a
+ * disposable scratch dir, read the view, and ALWAYS clean up the scratch copy. Read-only end to end.
+ */
+export async function loadCrashCartDiscovery(deps) {
+    // Refuse before any disk work if a daemon holds the DB.
+    await assertDaemonDown(deps);
+    const resolved = resolveDaemonDbPath(deps.openrigHome, deps.readDaemonJson);
+    if (resolved.relative) {
+        throw new CrashCartReadError(`daemon DB path '${resolved.path}' is relative — the daemon CWD is unknown, cannot locate it daemon-down`);
+    }
+    const scratchDir = deps.makeScratchDir();
+    try {
+        const copyDb = snapshotDaemonDb(resolved.path, scratchDir, {
+            copyFile: deps.copyFile,
+            exists: deps.exists,
+        });
+        const db = (deps.openDb ?? openDaemonDbReadonly)(copyDb);
+        try {
+            return { discovery: readCrashCartDiscovery(db), dbPath: resolved };
+        }
+        finally {
+            db.close();
+        }
+    }
+    finally {
+        deps.removeScratchDir(scratchDir);
+    }
+}
+function readWhereWorkStopped(db) {
+    const rows = db
+        .prepare(`SELECT qitem_id AS qitemId, destination_session AS destinationSession, source_session AS sourceSession,
+              state, claimed_at AS claimedAt, summary, ts_updated AS tsUpdated
+       FROM queue_items
+       WHERE state = 'in-progress'
+       ORDER BY datetime(ts_updated) DESC, qitem_id DESC`)
+        .all();
+    return rows.map((r) => ({
+        qitemId: r.qitemId,
+        destinationSession: r.destinationSession,
+        sourceSession: r.sourceSession,
+        state: r.state,
+        claimedAt: r.claimedAt ?? null,
+        summary: r.summary ?? null,
+        tsUpdated: r.tsUpdated,
+    }));
+}
+//# sourceMappingURL=crash-cart-discovery.js.map

package/daemon/dist/domain/crash-cart-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-discovery.js","sourceRoot":"","sources":["../../src/domain/crash-cart-discovery.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,4FAA4F;AAC5F,8BAA8B;AAE9B,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEvD,sGAAsG;AACtG,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAyBnD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEvF,8FAA8F;IAC9F,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,YAAY,CAAC,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,eAAe,CAAC,iCAAiC,UAAU,6BAA6B,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,eAAe,CAAC,mBAAmB,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;QACxC,IAAI,MAAM,YAAY,CAAC,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,IAAI,IAAI,qCAAqC,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,IAAI,MAAM,YAAY,CAAC,UAAU,YAAY,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,eAAe,CACvB,wCAAwC,YAAY,IAAI,YAAY,qCAAqC,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,cAA+D;IAE/D,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChG,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAkB;IACrF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,MAAM,0BAA0B,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAkDD,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACtB,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAChC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,EAAqB;IACvC,MAAM,EAAE,GAAG,EAAE;SACV,OAAO,CAAC,sFAAsF,CAAC;SAC/F,GAAG,EAA+E,CAAC;IACtF,gGAAgG;IAChG,sGAAsG;IACtG,oDAAoD;IACpD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;;;;;iEAO2D,CAC5D;SACA,GAAG,EAAgC,CAAC;IACvC,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI;QAC/B,UAAU,EAAE,EAAE,EAAE,aAAa,IAAI,IAAI;QACrC,WAAW,EAAE,EAAE,EAAE,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI;QAC3B,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB;IAC5C,6FAA6F;IAC7F,4EAA4E;IAC5E,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;;;;;;;;2BAWqB,CACtB;SACA,GAAG,EAOJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC;IAEhC,wDAAwD;IACxD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,QAAQ,CAAC,IAAI,yEAAyE,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAqB;IACjD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;yDAImD,CACpD;SACA,GAAG,EAQJ,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/daemon/dist/domain/crash-cart-emit.d.ts

@@ -0,0 +1,22 @@
+import type { DaemonState, DaemonUnverifiedEvidence } from "./crash-cart-detect.js";
+import type { CrashCartDiscovery } from "./crash-cart-discovery.js";
+/** The verb's JSON payload. Exactly one of {evidence | discovery | refusal} accompanies the state
+ *  (up → none; unverified → evidence; down → discovery, or refusal if the read fail-closed). */
+export interface CrashCartEmit {
+    state: DaemonState;
+    evidence?: DaemonUnverifiedEvidence;
+    discovery?: CrashCartDiscovery;
+    refusal?: string;
+}
+export interface EmitCrashCartDeps {
+    /** Resolve the 3-state verdict (bounded-retry detector). */
+    resolveState: () => Promise<DaemonState>;
+    /** Assemble the UNVERIFIED evidence (pid state + last probe). */
+    assembleEvidence: () => Promise<DaemonUnverifiedEvidence>;
+    /** Run the C2 daemon-down read (loadCrashCartDiscovery) VERBATIM; may fail-closed (throws). */
+    loadDiscovery: () => Promise<CrashCartDiscovery>;
+}
+/** Assemble the verb's verdict. UP → state only; UNVERIFIED → state + evidence (no read); DOWN → the
+ *  read's discovery, or a structured refusal note if the read fail-closed. */
+export declare function emitCrashCartState(deps: EmitCrashCartDeps): Promise<CrashCartEmit>;
+//# sourceMappingURL=crash-cart-emit.d.ts.map

package/daemon/dist/domain/crash-cart-emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-emit.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-emit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;gGACgG;AAChG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,YAAY,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1D,+FAA+F;IAC/F,aAAa,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClD;AAED;8EAC8E;AAC9E,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAUxF"}

package/daemon/dist/domain/crash-cart-emit.js

@@ -0,0 +1,23 @@
+// Crash-cart C3 — the SSOT for the `rig crash-cart --json` payload (plan c015d9ed §C3, coupling
+// ruling option C, 4 rails). ONE JSON = the 3-state detector verdict + (on DOWN) the discovery
+// (rail 3). Composes the detector + the C2 read VERBATIM (rail 2 — never a parallel read). A
+// fail-closed refusal of the read emits a STRUCTURED refusal note (NOT exit-code-only, NO discovery)
+// so the TUI never renders the recovery cockpit from a refusal. Read-only (rail 1). The sub-steps are
+// injected so this decision layer is deterministic; the CLI verb wires the real detector + read.
+/** Assemble the verb's verdict. UP → state only; UNVERIFIED → state + evidence (no read); DOWN → the
+ *  read's discovery, or a structured refusal note if the read fail-closed. */
+export async function emitCrashCartState(deps) {
+    const state = await deps.resolveState();
+    if (state === "up")
+        return { state };
+    if (state === "unverified")
+        return { state, evidence: await deps.assembleEvidence() };
+    // down — attempt the C2 read; a refusal is structured, never a rendered cockpit.
+    try {
+        return { state, discovery: await deps.loadDiscovery() };
+    }
+    catch (e) {
+        return { state, refusal: e instanceof Error ? e.message : String(e) };
+    }
+}
+//# sourceMappingURL=crash-cart-emit.js.map

package/daemon/dist/domain/crash-cart-emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-emit.js","sourceRoot":"","sources":["../../src/domain/crash-cart-emit.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,+FAA+F;AAC/F,6FAA6F;AAC7F,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AAuBjG;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAuB;IAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACtF,iFAAiF;IACjF,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;AACH,CAAC"}

package/daemon/dist/domain/crash-cart-probes.d.ts

@@ -0,0 +1,24 @@
+import type { DaemonStateFile, HealthzProbeResult } from "./crash-cart-detect.js";
+/** Classify a fetch REJECTION into a probe result — POSITIVE-FORM predicate (guard/orch rail):
+ *  DOWN (refused) ONLY when (a) at least one terminal attempt exists AND (b) EVERY terminal attempt is
+ *  recognizably ECONNREFUSED. Anything else — a timeout, an abort, another code, or a CODE-LESS /
+ *  unrecognized failure — is ambiguous evidence and stays timeout/unverified (a timeout never promotes to
+ *  a confirmed down; the cart never offers RESTORE on partial evidence). "No known-bad sibling" (a negated
+ *  code-Set) erased a code-less sibling; "ALL known-good" (this positive form) closes the whole family. */
+export declare function classifyProbeError(err: unknown): HealthzProbeResult;
+export interface ProbeDeps {
+    fetch: (url: string, init?: {
+        signal?: AbortSignal;
+    }) => Promise<Response>;
+    timeoutMs?: number;
+}
+/** Probe `<url>` (a daemon /healthz): 2xx → answered; non-2xx (foreign occupant) → not-openrig; a
+ *  rejection is classified (refused/timeout). Bounded by an abort timeout. */
+export declare function probeHealthz(url: string, deps: ProbeDeps): Promise<HealthzProbeResult>;
+/** True if `pid` is a live process. `process.kill(pid, 0)` throws ESRCH when absent, EPERM when it
+ *  exists but we can't signal it (still alive). */
+export declare function isProcessAlive(pid: number): boolean;
+/** Read + parse `$OPENRIG_HOME/daemon.json` → the {pid,port,host} record, or undefined if absent or
+ *  malformed (treated as "no state file"). */
+export declare function readDaemonJson(openrigHome: string): DaemonStateFile | undefined;
+//# sourceMappingURL=crash-cart-probes.d.ts.map

package/daemon/dist/domain/crash-cart-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-probes.d.ts","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAiDlF;;;;;2GAK2G;AAC3G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAInE;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;8EAC8E;AAC9E,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW5F;AAED;mDACmD;AACnD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;8CAC8C;AAC9C,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAY/E"}

package/daemon/dist/domain/crash-cart-probes.js

@@ -0,0 +1,109 @@
+// Crash-cart C3 — the REAL probe adapters wired into resolveDaemonState (main.ts). The classification
+// logic is unit-tested (injected fetch); isProcessAlive/readDaemonJson are thin node-API wrappers
+// proven by the real-daemon-down run.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** Collect the TERMINAL ATTEMPTS from a rejection tree — the leaf error nodes that represent an actual
+ *  connect attempt. Node/Undici's global fetch wraps a refused socket as an OUTER `TypeError
+ *  {message:"fetch failed", code:undefined}` → `cause` (single address), or an `AggregateError` whose
+ *  `.errors[]` are the per-address attempts. A node WITH a `cause` or non-empty `errors[]` is a WRAPPER
+ *  (it recurses, never counts as a terminal attempt); a node with neither is a terminal attempt — which
+ *  may carry a `code` (ECONNREFUSED/ETIMEDOUT/…) or NONE at all. A code-less attempt is retained here,
+ *  which a flattened code-Set would erase. Depth-bounded (cycle-safe); a node hit at the cap is treated
+ *  as a terminal attempt (its code, typically absent, then counts — conservatively). */
+const MAX_WALK_DEPTH = 10; // real Undici chains are 2–3 deep; this is generous. Beyond it = UNRESOLVED.
+function collectTerminalAttempts(err) {
+    const attempts = [];
+    const onPath = new Set(); // cycle detection by IDENTITY (a back-edge cannot be resolved)
+    const visit = (e, depth) => {
+        // A non-object rejection (string/undefined/…) is not a resolvable terminal → unknown (non-refused).
+        if (!e || typeof e !== "object") {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        const o = e;
+        // CYCLE: this exact object is already on the current path — it cannot be fully resolved → unknown.
+        if (onPath.has(o)) {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        const children = [];
+        if (o.cause)
+            children.push(o.cause);
+        if (Array.isArray(o.errors))
+            children.push(...o.errors);
+        if (children.length === 0) {
+            // A FULLY-RESOLVED terminal attempt (no cause, no errors): its own code is real evidence.
+            attempts.push({ code: typeof o.code === "string" ? o.code : undefined, name: typeof o.name === "string" ? o.name : undefined });
+            return;
+        }
+        // A WRAPPER (has children). If depth is exhausted, we CANNOT resolve it → record an UNKNOWN attempt;
+        // NEVER reinterpret an unresolved wrapper's OWN code as terminal evidence (exhaustion is not evidence).
+        if (depth >= MAX_WALK_DEPTH) {
+            attempts.push({ unresolved: true });
+            return;
+        }
+        onPath.add(o);
+        for (const c of children)
+            visit(c, depth + 1);
+        onPath.delete(o);
+    };
+    visit(err, 0);
+    return attempts;
+}
+/** Classify a fetch REJECTION into a probe result — POSITIVE-FORM predicate (guard/orch rail):
+ *  DOWN (refused) ONLY when (a) at least one terminal attempt exists AND (b) EVERY terminal attempt is
+ *  recognizably ECONNREFUSED. Anything else — a timeout, an abort, another code, or a CODE-LESS /
+ *  unrecognized failure — is ambiguous evidence and stays timeout/unverified (a timeout never promotes to
+ *  a confirmed down; the cart never offers RESTORE on partial evidence). "No known-bad sibling" (a negated
+ *  code-Set) erased a code-less sibling; "ALL known-good" (this positive form) closes the whole family. */
+export function classifyProbeError(err) {
+    const attempts = collectTerminalAttempts(err);
+    const refusedUnanimous = attempts.length > 0 && attempts.every((a) => a.code === "ECONNREFUSED");
+    return refusedUnanimous ? "refused" : "timeout";
+}
+/** Probe `<url>` (a daemon /healthz): 2xx → answered; non-2xx (foreign occupant) → not-openrig; a
+ *  rejection is classified (refused/timeout). Bounded by an abort timeout. */
+export async function probeHealthz(url, deps) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? 800);
+    try {
+        const res = await deps.fetch(url, { signal: controller.signal });
+        return res.ok ? "answered" : "not-openrig";
+    }
+    catch (e) {
+        return classifyProbeError((e ?? {}));
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** True if `pid` is a live process. `process.kill(pid, 0)` throws ESRCH when absent, EPERM when it
+ *  exists but we can't signal it (still alive). */
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === "EPERM";
+    }
+}
+/** Read + parse `$OPENRIG_HOME/daemon.json` → the {pid,port,host} record, or undefined if absent or
+ *  malformed (treated as "no state file"). */
+export function readDaemonJson(openrigHome) {
+    const p = join(openrigHome, "daemon.json");
+    if (!existsSync(p))
+        return undefined;
+    try {
+        const j = JSON.parse(readFileSync(p, "utf8"));
+        if (typeof j.pid === "number" && typeof j.port === "number") {
+            return { pid: j.pid, port: j.port, host: typeof j.host === "string" ? j.host : undefined };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=crash-cart-probes.js.map

package/daemon/dist/domain/crash-cart-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-cart-probes.js","sourceRoot":"","sources":["../../src/domain/crash-cart-probes.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;wFAOwF;AACxF,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,6EAA6E;AAExG,SAAS,uBAAuB,CAAC,GAAY;IAC3C,MAAM,QAAQ,GAAkE,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,+DAA+D;IACjG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,KAAa,EAAQ,EAAE;QAChD,oGAAoG;QACpG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAA0E,CAAC;QACrF,mGAAmG;QACnG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,MAAoB,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,0FAA0F;YAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QACD,qGAAqG;QACrG,wGAAwG;QACxG,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;2GAK2G;AAC3G,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACjG,OAAO,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAOD;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAe;IAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAsD,CAAC;QACnG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/daemon/dist/domain/daemon-lifecycle-store.d.ts

@@ -0,0 +1,30 @@
+import type Database from "better-sqlite3";
+/** The daemon's lifecycle record (mig-061 singleton) — started / last-seen /
+ *  stopped for the current boot epoch. Distinct from the identity record (059). */
+export interface DaemonLifecycleRecord {
+    bootEpoch: string;
+    startedAt: string;
+    lastHeartbeatAt: string | null;
+    stoppedAt: string | null;
+}
+/**
+ * P7 — accessors for the daemon_lifecycle singleton. Each write is a single
+ * statement = its own implicit SQLite transaction (arch: "own tiny transaction").
+ * The heartbeat guards not-stopped and the stop is terminal-per-epoch, so a stray
+ * post-stop tick can never advance last-seen (the binding write-order pin).
+ */
+export declare class DaemonLifecycleStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    /** A new boot: mint a new epoch, set started_at, and CLEAR the prior run's
+     *  heartbeat + stopped_at (a fresh epoch never shows the previous run's stop). */
+    recordBoot(bootEpoch: string, nowIso: string): void;
+    /** Advance last-seen — ONLY while not stopped (a stray tick after stopped_at
+     *  must never move last-seen; stopped_at is terminal per epoch). */
+    recordHeartbeat(nowIso: string): void;
+    /** Clean-shutdown mark — set stopped_at ONLY for the matching epoch and only if
+     *  not already stopped (terminal per epoch). */
+    recordStop(bootEpoch: string, nowIso: string): void;
+    get(): DaemonLifecycleRecord | null;
+}
+//# sourceMappingURL=daemon-lifecycle-store.d.ts.map

package/daemon/dist/domain/daemon-lifecycle-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-lifecycle-store.d.ts","sourceRoot":"","sources":["../../src/domain/daemon-lifecycle-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C;mFACmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD;;;;;GAKG;AACH,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD;sFACkF;IAClF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAcnD;wEACoE;IACpE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMrC;oDACgD;IAChD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMnD,GAAG,IAAI,qBAAqB,GAAG,IAAI;CAYpC"}

package/daemon/dist/domain/daemon-lifecycle-store.js

@@ -0,0 +1,53 @@
+/**
+ * P7 — accessors for the daemon_lifecycle singleton. Each write is a single
+ * statement = its own implicit SQLite transaction (arch: "own tiny transaction").
+ * The heartbeat guards not-stopped and the stop is terminal-per-epoch, so a stray
+ * post-stop tick can never advance last-seen (the binding write-order pin).
+ */
+export class DaemonLifecycleStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** A new boot: mint a new epoch, set started_at, and CLEAR the prior run's
+     *  heartbeat + stopped_at (a fresh epoch never shows the previous run's stop). */
+    recordBoot(bootEpoch, nowIso) {
+        this.db
+            .prepare(`INSERT INTO daemon_lifecycle (singleton, boot_epoch, started_at, last_heartbeat_at, stopped_at)
+           VALUES (1, ?, ?, NULL, NULL)
+         ON CONFLICT(singleton) DO UPDATE SET
+           boot_epoch = excluded.boot_epoch,
+           started_at = excluded.started_at,
+           last_heartbeat_at = NULL,
+           stopped_at = NULL`)
+            .run(bootEpoch, nowIso);
+    }
+    /** Advance last-seen — ONLY while not stopped (a stray tick after stopped_at
+     *  must never move last-seen; stopped_at is terminal per epoch). */
+    recordHeartbeat(nowIso) {
+        this.db
+            .prepare(`UPDATE daemon_lifecycle SET last_heartbeat_at = ? WHERE singleton = 1 AND stopped_at IS NULL`)
+            .run(nowIso);
+    }
+    /** Clean-shutdown mark — set stopped_at ONLY for the matching epoch and only if
+     *  not already stopped (terminal per epoch). */
+    recordStop(bootEpoch, nowIso) {
+        this.db
+            .prepare(`UPDATE daemon_lifecycle SET stopped_at = ? WHERE singleton = 1 AND boot_epoch = ? AND stopped_at IS NULL`)
+            .run(nowIso, bootEpoch);
+    }
+    get() {
+        const row = this.db
+            .prepare(`SELECT boot_epoch, started_at, last_heartbeat_at, stopped_at FROM daemon_lifecycle WHERE singleton = 1`)
+            .get();
+        if (!row)
+            return null;
+        return {
+            bootEpoch: row.boot_epoch,
+            startedAt: row.started_at,
+            lastHeartbeatAt: row.last_heartbeat_at ?? null,
+            stoppedAt: row.stopped_at ?? null,
+        };
+    }
+}
+//# sourceMappingURL=daemon-lifecycle-store.js.map

package/daemon/dist/domain/daemon-lifecycle-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-lifecycle-store.js","sourceRoot":"","sources":["../../src/domain/daemon-lifecycle-store.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD;sFACkF;IAClF,UAAU,CAAC,SAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;6BAMqB,CACtB;aACA,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;wEACoE;IACpE,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,8FAA8F,CAAC;aACvG,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED;oDACgD;IAChD,UAAU,CAAC,SAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,0GAA0G,CAAC;aACnH,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,GAAG;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,wGAAwG,CAAC;aACjH,GAAG,EAAqB,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,eAAe,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;YAC9C,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;SAClC,CAAC;IACJ,CAAC;CACF"}

package/daemon/dist/domain/event-bus.d.ts

@@ -1,8 +1,30 @@
 import type Database from "better-sqlite3";
 import type { RigEvent, PersistedEvent } from "./types.js";
 type Subscriber = (event: PersistedEvent) => void;
+declare const notifyTokenBrand: unique symbol;
+export type NotifyToken = PersistedEvent & {
+    readonly [notifyTokenBrand]: true;
+};
+export type NotifyRegister = (token: PersistedEvent) => void;
+export interface NotifyDrainStatus {
+    state: "healthy" | "unparseable";
+    watermark: number;
+    lastPoison: {
+        seq: number;
+        error: string;
+        payloadSha: string;
+    } | null;
+}
+export declare class NotifyEnvelopeError extends Error {
+    readonly code: "notify_registration_mismatch" | "nested_notify_envelope";
+    constructor(code: NotifyEnvelopeError["code"], message: string);
+}
 export declare class EventBus {
     private subscribers;
+    private activeEnvelope;
+    private drainingNotifyRows;
+    private notifyEnvelopeRuns;
+    private notifyDrainStatus;
     readonly db: Database.Database;
     get subscriberCount(): number;
     constructor(db: Database.Database);
@@ -15,9 +37,19 @@ export declare class EventBus {
      * Insert an event row into the events table and return a PersistedEvent.
      * Call this inside a caller-managed db.transaction() so the event insert
      * is atomic with other writes (e.g., session + binding + event in one txn).
-     * Does NOT notify subscribers — call notifySubscribers() after commit.
+     * Does NOT notify subscribers. A notify envelope drains after commit;
+     * legacy single-event callers retain their explicit post-commit notify.
+     */
+    persistWithinTransaction(event: RigEvent): NotifyToken;
+    /**
+     * Run one caller-owned synchronous transaction under the W2b notification
+     * envelope. Every token persisted through EventBus during the callback must
+     * be registered before it returns. The exact object-identity sets are
+     * compared before commit; committed rows are then delivered from the log.
      */
-    persistWithinTransaction(event: RigEvent): PersistedEvent;
+    withNotifyEnvelope<T>(callback: (register: NotifyRegister) => T): T;
+    getNotifyDrainStatus(): NotifyDrainStatus;
+    assertNotifyEnvelopeExercised(): void;
     /**
      * Fan out a persisted event to in-memory subscribers.
      * Does NOT insert into DB. Subscriber errors are isolated.
@@ -26,6 +58,9 @@ export declare class EventBus {
     subscribe(cb: Subscriber): () => void;
     replaySince(seq: number, rigId: string): PersistedEvent[];
     replayAll(seq: number): PersistedEvent[];
+    private drainNotifyRowsToQuiescence;
+    private maxSeq;
+    private rowsAfter;
     private rowToPersistedEvent;
 }
 export {};

package/daemon/dist/domain/event-bus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-bus.d.ts","sourceRoot":"","sources":["../../src/domain/event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3D,KAAK,UAAU,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;AAElD,qBAAa,QAAQ;IACnB,OAAO,CAAC,WAAW,CAAyB;IAC5C,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAE/B,IAAI,eAAe,IAAI,MAAM,CAE5B;gBAEW,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIjC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc;IAMrC;;;;;OAKG;IACH,wBAAwB,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc;IAuBzD;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAU9C,SAAS,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,IAAI;IAOrC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IAUzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE;IAUxC,OAAO,CAAC,mBAAmB;CAQ5B"}
+{"version":3,"file":"event-bus.d.ts","sourceRoot":"","sources":["../../src/domain/event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3D,KAAK,UAAU,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;AAElD,OAAO,CAAC,MAAM,gBAAgB,EAAE,OAAO,MAAM,CAAC;AAC9C,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,GAAG,aAAa,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,8BAA8B,GAAG,wBAAwB,CAAC;gBAE7D,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAI/D;AAMD,qBAAa,QAAQ;IACnB,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAE/B,IAAI,eAAe,IAAI,MAAM,CAE5B;gBAEW,EAAE,EAAE,QAAQ,CAAC,QAAQ;IASjC;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc;IAMrC;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW;IAyBtD;;;;;OAKG;IACH,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,CAAC,GAAG,CAAC;IAoCnE,oBAAoB,IAAI,iBAAiB;IASzC,6BAA6B,IAAI,IAAI;IAMrC;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAe9C,SAAS,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,IAAI;IAOrC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IAUzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE;IAMxC,OAAO,CAAC,2BAA2B;IAwCnC,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,mBAAmB;CAkB5B"}