@openrig/cli 0.5.15 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/seat-lifecycle-service.js

@@ -1,864 +0,0 @@
-import { deriveCanonicalFromEntry, getNodeInventory } from "./node-inventory.js";
-import { deriveSessionName, parseSessionName } from "./session-name.js";
-import { resolveStartupProof } from "./startup-resolver.js";
-import { rebindAndVerifyPaneIdentity } from "./seat-attention-reconciler.js";
-import { observeSolePane } from "./pane-binding-observation.js";
-import { createHash } from "node:crypto";
-/**
- * S5 (OPR.0.5.4.7) — the seat-lifecycle verb surface: set-model, single-seat stop,
- * dead-session clean. One coherent design (KI-5.3-9):
- *
- *   - ONE seat-resolution path shared by all three verbs (the SeatStatusService
- *     findMatches semantics: parseSessionName greedy first-@ rig; canonical-name or
- *     logical-id match; ambiguity returns the match list) — never a per-verb resolver.
- *   - Every mutation is transactional and persists its audit event in the SAME
- *     transaction (node.model_changed / session.stopped / session.cleaned).
- *   - Every refusal names what was actually checked; an indeterminate tmux probe is
- *     a refusal, never a guess (the S1 error bar applied at birth).
- */
-const SEAT_LOOKUP_GUIDANCE = "List seats with: rig ps --nodes";
-/** Terminal session statuses — rows the clean verb must NOT touch (they already
- *  record an ended tenancy; the vocabulary is shared with seat-handover-service
- *  and the watchdog's TERMINAL_SESSION_STATUSES). */
-const TERMINAL_SESSION_STATUSES = new Set(["superseded", "detached", "exited"]);
-export class SeatLifecycleService {
-    db;
-    rigRepo;
-    sessionRegistry;
-    eventBus;
-    tmuxAdapter;
-    listProcesses;
-    nodeLauncher;
-    startupOrchestrator;
-    runtimeAdapters;
-    occupantInvalidator;
-    activityOracle;
-    constructor(deps) {
-        if (deps.db !== deps.rigRepo.db)
-            throw new Error("SeatLifecycleService: rigRepo must share the same db handle");
-        if (deps.db !== deps.sessionRegistry.db)
-            throw new Error("SeatLifecycleService: sessionRegistry must share the same db handle");
-        if (deps.db !== deps.eventBus.db)
-            throw new Error("SeatLifecycleService: eventBus must share the same db handle");
-        this.db = deps.db;
-        this.rigRepo = deps.rigRepo;
-        this.sessionRegistry = deps.sessionRegistry;
-        this.eventBus = deps.eventBus;
-        this.tmuxAdapter = deps.tmuxAdapter;
-        this.listProcesses = deps.listProcesses;
-        this.nodeLauncher = deps.nodeLauncher ?? null;
-        this.startupOrchestrator = deps.startupOrchestrator ?? null;
-        this.runtimeAdapters = deps.runtimeAdapters ?? {};
-        this.occupantInvalidator = deps.occupantInvalidator ?? null;
-        this.activityOracle = deps.activityOracle ?? null;
-    }
-    async setModel(input) {
-        const required = this.requireReason(input.reason);
-        if (required)
-            return required;
-        if (!input.model?.trim()) {
-            return { ok: false, code: "missing_model", message: "A target model id is required (--model)." };
-        }
-        const resolved = this.resolveSeat(input.seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const model = input.model.trim();
-        const seat = this.describe(resolved);
-        const from = resolved.entry.model ?? null;
-        if (from === model) {
-            // Honest no-op: the persisted value already IS the target; no event is minted.
-            return { ok: true, seat, from, to: model, changed: false };
-        }
-        let persisted = null;
-        const tx = this.db.transaction(() => {
-            this.rigRepo.setNodeModel(resolved.nodeId, model);
-            persisted = this.eventBus.persistWithinTransaction({
-                type: "node.model_changed",
-                rigId: seat.rigId,
-                nodeId: seat.nodeId,
-                logicalId: seat.logicalId,
-                from,
-                to: model,
-                reason: input.reason.trim(),
-                operator: input.operator ?? null,
-            });
-        });
-        tx();
-        if (persisted)
-            this.eventBus.notifySubscribers(persisted);
-        return { ok: true, seat, from, to: model, changed: true };
-    }
-    async stopSeat(input) {
-        const required = this.requireReason(input.reason);
-        if (required)
-            return required;
-        const resolved = this.resolveSeat(input.seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const seat = this.describe(resolved);
-        const session = this.latestSession(resolved.nodeId);
-        if (!session) {
-            return { ok: false, code: "no_session", message: `Seat "${input.seatRef}" has no session to stop (checked: latest sessions row for node ${seat.logicalId}).` };
-        }
-        if (session.origin === "claimed") {
-            return {
-                ok: false,
-                code: "claimed_session",
-                message: `Session "${session.session_name}" was adopted (origin=claimed), not launched by OpenRig — stop refuses to kill it.`,
-                guidance: "Release an adopted session with: rig unclaim",
-            };
-        }
-        // Wave-2 fix round 1 (r1 row 9baac99f): consume the CLASSIFIED probe, never the
-        // collapsed hasSession view — a transport blip is INDETERMINATE, not absence
-        // (KI-5.3-8 fabricated-absence class, destructive direction).
-        const probed = await this.probeLiveness(session.session_name, "stop refuses rather than kill blind");
-        if ("code" in probed)
-            return probed;
-        if (probed.state === "absent") {
-            return {
-                ok: false,
-                code: "session_not_live",
-                message: `Session "${session.session_name}" is absent in tmux (checked: tmux has-session, POSITIVE absence evidence) — there is nothing to stop.`,
-                guidance: "A dead seat with stale records is returned to launchable with: rig seat clean",
-            };
-        }
-        return this.stopManagedTmuxSeat(resolved, session, input.reason, input.operator);
-    }
-    async cleanSeat(input) {
-        const required = this.requireReason(input.reason);
-        if (required)
-            return required;
-        const resolved = this.resolveSeat(input.seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const seat = this.describe(resolved);
-        const binding = this.sessionRegistry.getBindingForNode(resolved.nodeId);
-        const nonTerminal = this.db.prepare("SELECT id, session_name, status, origin FROM sessions WHERE node_id = ? ORDER BY id").all(resolved.nodeId)
-            .filter((s) => !TERMINAL_SESSION_STATUSES.has(s.status));
-        // Fix r2-F3 (row 30045f39): clean MUTATES every non-terminal session row, so
-        // its safety checks must cover exactly that set — probing only the newest row
-        // fabricates safety for the others (older-live/newer-dead under canonical-name
-        // churn). Every row that would be touched is checked for adopted origin and
-        // probed for POSITIVE absence (r1 discipline); the binding's own tmux session
-        // is probed too when it names a session no row carries.
-        const mutationTargets = nonTerminal;
-        for (const row of mutationTargets) {
-            if (row.origin === "claimed") {
-                return {
-                    ok: false,
-                    code: "claimed_session",
-                    message: `Session "${row.session_name}" was adopted (origin=claimed) — clean refuses to touch adopted state.`,
-                    guidance: "Release an adopted session with: rig unclaim",
-                };
-            }
-        }
-        const probeNames = [...new Set([
-                ...mutationTargets.map((s) => s.session_name),
-                ...(binding?.tmuxSession ? [binding.tmuxSession] : []),
-            ])];
-        for (const name of probeNames) {
-            const probed = await this.probeLiveness(name, "clean refuses rather than clear state under a possibly-live seat");
-            if ("code" in probed)
-                return probed;
-            if (probed.state === "present") {
-                return {
-                    ok: false,
-                    code: "session_live",
-                    message: `Session "${name}" is alive in tmux (checked: tmux has-session, against EVERY session row clean would mutate) — clean only operates on dead seats.`,
-                    guidance: "Stop a live seat first with: rig seat stop",
-                };
-            }
-        }
-        const session = this.latestSession(resolved.nodeId);
-        if (!binding && nonTerminal.length === 0) {
-            return {
-                ok: false,
-                code: "nothing_to_clean",
-                message: `Seat "${input.seatRef}" is already clean (checked: no binding row for the node, and no session rows outside terminal statuses ${[...TERMINAL_SESSION_STATUSES].join("/")}).`,
-            };
-        }
-        const sessionsExited = [];
-        let persisted = null;
-        const tx = this.db.transaction(() => {
-            for (const row of nonTerminal) {
-                this.sessionRegistry.updateStatus(row.id, "exited");
-                sessionsExited.push(row.session_name);
-            }
-            this.sessionRegistry.clearBinding(resolved.nodeId);
-            persisted = this.eventBus.persistWithinTransaction({
-                type: "session.cleaned",
-                rigId: seat.rigId,
-                nodeId: seat.nodeId,
-                sessionName: session?.session_name ?? null,
-                reason: input.reason.trim(),
-                operator: input.operator ?? null,
-                actions: { sessionsExited, bindingCleared: binding !== null },
-            });
-        });
-        tx();
-        if (persisted)
-            this.eventBus.notifySubscribers(persisted);
-        return { ok: true, seat, actions: { sessionsExited, bindingCleared: binding !== null } };
-    }
-    /** Finish context delivery to the same fresh occupant after its native gate.
-     * This never launches a process or replays an uncertain/finished delivery.
-     */
-    async continueFreshStartup(seatRef) {
-        const resolved = this.resolveSeat(seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const seat = this.describe(resolved);
-        const node = this.rigRepo.getRig(seat.rigId)?.nodes.find((n) => n.id === seat.nodeId);
-        const session = this.latestSession(seat.nodeId);
-        const binding = this.sessionRegistry.getBindingForNode(seat.nodeId);
-        if (!node || !session || !binding?.tmuxSession || !this.startupOrchestrator
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id)) {
-            return { ok: false, code: "continuation_unavailable", message: "No verified pending fresh-context delivery exists for this occupant. Refresh to inspect its actual state." };
-        }
-        const pane = await observeSolePane(this.tmuxAdapter, binding.tmuxSession);
-        if (!pane.ok || pane.pane !== binding.tmuxPane)
-            return { ok: false, code: "binding_changed", message: "The managed terminal binding changed; context was not delivered." };
-        const adapter = node.runtime ? this.runtimeAdapters[node.runtime] : undefined;
-        if (!adapter)
-            return { ok: false, code: "runtime_adapter_missing", message: "The configured runtime adapter is unavailable." };
-        const ready = await adapter.checkReady({ ...binding, cwd: node.cwd ?? "." });
-        if (!ready.ready)
-            return { ok: false, code: "attention_required", message: ready.reason ?? "Resolve the native prerequisite first." };
-        const startup = this.readStartupContext(node.id, node.cwd ?? ".");
-        if (!startup.ok)
-            return startup.refusal;
-        if (startup.context.runtime !== node.runtime)
-            return { ok: false, code: "startup_context_runtime_mismatch", message: "The saved startup context belongs to a different runtime." };
-        // Recheck after the asynchronous native observation; startNode immediately
-        // records pending before its first await, consuming the retained permission.
-        if (this.latestSession(node.id)?.id !== session.id || this.sessionRegistry.getBindingForNode(node.id)?.tmuxPane !== pane.pane
-            || !this.startupOrchestrator.canContinueFresh(node.id, session.id))
-            return { ok: false, code: "continuation_unavailable", message: "Startup changed during the readiness check. Refresh." };
-        const result = await this.startupOrchestrator.startNode({
-            rigId: seat.rigId, nodeId: node.id, sessionId: session.id,
-            binding: { ...binding, cwd: node.cwd ?? ".", model: node.model ?? undefined, codexConfigProfile: node.codexConfigProfile ?? undefined },
-            adapter, plan: startup.context.plan, resolvedStartupFiles: startup.context.resolvedStartupFiles,
-            startupActions: startup.context.startupActions, isRestore: false,
-            sessionName: session.session_name, skipHarnessLaunch: true, continueFreshStartup: true, includeDurableObligations: true, allowFreshFallback: false,
-        });
-        return { ...result, message: result.ok ? "Configured context delivered to the existing fresh conversation." : result.errors.join("; ") };
-    }
-    /** Deliberately replace exactly one managed seat with a blank native occupant. */
-    async launchFresh(input) {
-        const required = this.requireReason(input.reason);
-        if (required)
-            return required;
-        if (input.fresh !== true) {
-            return {
-                ok: false,
-                code: "fresh_required",
-                message: "Explicit fresh launch requires fresh=true (--fresh); no continuity mode is inferred.",
-            };
-        }
-        const resolved = this.resolveSeat(input.seatRef);
-        if ("code" in resolved)
-            return resolved;
-        const seat = this.describe(resolved);
-        const rig = this.rigRepo.getRig(seat.rigId);
-        const node = rig?.nodes.find((candidate) => candidate.id === seat.nodeId);
-        if (!rig || !node) {
-            return { ok: false, code: "seat_not_found", message: `Seat "${input.seatRef}" no longer exists.`, guidance: SEAT_LOOKUP_GUIDANCE };
-        }
-        if (!this.nodeLauncher || !this.startupOrchestrator) {
-            return { ok: false, code: "launch_unavailable", message: "Fresh-launch services are unavailable in this daemon." };
-        }
-        const startup = this.readStartupContext(node.id, node.cwd ?? ".");
-        if (!startup.ok)
-            return startup.refusal;
-        if (!node.runtime || startup.context.runtime !== node.runtime) {
-            return {
-                ok: false,
-                code: "startup_context_runtime_mismatch",
-                message: `Persisted startup context runtime '${startup.context.runtime}' does not match current node runtime '${node.runtime ?? "missing"}'.`,
-            };
-        }
-        const adapter = this.runtimeAdapters[node.runtime];
-        if (!adapter) {
-            return {
-                ok: false,
-                code: "runtime_adapter_missing",
-                message: `No runtime adapter is available for '${node.runtime}'.`,
-            };
-        }
-        const canonicalSessionName = deriveCanonicalFromEntry(resolved.entry)
-            ?? deriveSessionName(seat.rigName, seat.logicalId);
-        const retiringRows = this.nonTerminalSessions(node.id);
-        if (retiringRows.some((row) => row.origin === "claimed")) {
-            return {
-                ok: false,
-                code: "claimed_session",
-                message: `Seat "${input.seatRef}" has an adopted/operator-owned occupant; fresh launch refuses even with --stop.`,
-                guidance: "Stop the adopted process yourself, then run rig seat clean before launching fresh.",
-            };
-        }
-        // Detached is terminal for process cleanup, but remains a reboot candidate.
-        // A deliberate fresh launch must retire that prior history as well.
-        const supersededSessionIds = this.db.prepare("SELECT id FROM sessions WHERE node_id = ? AND status NOT IN ('superseded', 'exited')").all(node.id).map((row) => row.id);
-        const retiringGeneration = this.sessionRegistry.currentOccupantTenure(node.id)?.generationUuid ?? null;
-        const canonicalProbe = await this.probeLiveness(canonicalSessionName, "fresh launch refuses rather than overwrite a possibly-live canonical session");
-        if ("code" in canonicalProbe)
-            return canonicalProbe;
-        if (canonicalProbe.state === "present") {
-            const currentSession = this.latestSession(node.id);
-            const currentBinding = this.sessionRegistry.getBindingForNode(node.id);
-            const currentManaged = currentSession !== null
-                && !TERMINAL_SESSION_STATUSES.has(currentSession.status)
-                && currentSession.origin !== "claimed"
-                && currentSession.session_name === canonicalSessionName
-                && currentBinding?.tmuxSession === canonicalSessionName;
-            if (!currentManaged) {
-                return {
-                    ok: false,
-                    code: "unmanaged_session_collision",
-                    message: `Canonical tmux session "${canonicalSessionName}" exists but is not owned by this seat's current managed rows; refusing to overwrite it.`,
-                };
-            }
-            if (!input.stop) {
-                return {
-                    ok: false,
-                    code: "session_live",
-                    message: `Seat "${input.seatRef}" is live; fresh launch refuses without --stop.`,
-                    guidance: "Re-run with --stop to end exactly this managed occupant, or use rig handover to carry context.",
-                };
-            }
-            const observedPane = await observeSolePane(this.tmuxAdapter, canonicalSessionName);
-            if (!observedPane.ok && observedPane.code === "tmux_unavailable") {
-                return {
-                    ok: false,
-                    code: "tmux_probe_failed",
-                    message: `${observedPane.detail}; fresh launch refuses rather than kill without live occupant identity.`,
-                };
-            }
-            if (!observedPane.ok || observedPane.pane !== currentBinding?.tmuxPane) {
-                return {
-                    ok: false,
-                    code: "unmanaged_session_collision",
-                    message: `Canonical tmux session "${canonicalSessionName}" is live, but its pane does not match this seat's current managed binding; refusing to stop it.`,
-                };
-            }
-            const stopped = await this.stopManagedTmuxSeat(resolved, currentSession, input.reason, input.operator);
-            if (!stopped.ok)
-                return stopped;
-        }
-        // Reuse clean's exhaustive, positive-absence gate for stale/history rows.
-        const remaining = this.nonTerminalSessions(node.id);
-        const binding = this.sessionRegistry.getBindingForNode(node.id);
-        if (remaining.length > 0 || binding !== null) {
-            const cleaned = await this.cleanSeat({
-                seatRef: canonicalSessionName,
-                reason: input.reason,
-                operator: input.operator,
-            });
-            if (!cleaned.ok)
-                return cleaned;
-        }
-        // The stop/clean composition may have taken time; buy absence again at the
-        // mutation boundary. NodeLauncher also refuses duplicate_session and never kills it.
-        const finalProbe = await this.probeLiveness(canonicalSessionName, "fresh launch refuses rather than race a canonical-session collision");
-        if ("code" in finalProbe)
-            return finalProbe;
-        if (finalProbe.state === "present") {
-            return {
-                ok: false,
-                code: "unmanaged_session_collision",
-                message: `Canonical tmux session "${canonicalSessionName}" appeared before launch; refusing to overwrite it.`,
-            };
-        }
-        // Historical rows remain append-only but no longer look current.
-        for (const sessionId of supersededSessionIds)
-            this.sessionRegistry.markSuperseded(sessionId);
-        this.occupantInvalidator?.invalidateRetiringOccupant({
-            retiringSessionName: canonicalSessionName,
-            successorSessionName: canonicalSessionName,
-            ...(retiringGeneration ? { retiringGeneration } : {}),
-        });
-        const launch = await this.nodeLauncher.launchNode(seat.rigId, seat.logicalId, {
-            sessionName: canonicalSessionName,
-            cwd: node.cwd ?? undefined,
-            occupantKind: "fresh",
-        });
-        if (!launch.ok) {
-            return { ok: false, code: "launch_failed", message: launch.message };
-        }
-        const observedGeneration = this.sessionRegistry.currentOccupantTenure(node.id)?.generationUuid ?? null;
-        const generation = observedGeneration && observedGeneration !== retiringGeneration
-            ? observedGeneration
-            : null;
-        if (!generation) {
-            const compensation = await this.compensateFailedFreshLaunch({
-                seat,
-                launch,
-                supersededSessionIds,
-                retiringGeneration,
-                newGeneration: null,
-                startupPolicyHash: startup.context.hash,
-                model: node.model,
-                reason: input.reason,
-                operator: input.operator,
-                errors: ["new occupant generation was not persisted"],
-            });
-            return compensation === "zero"
-                ? { ok: false, code: "startup_failed", status: "failed", message: "Fresh launch could not persist a new occupant generation; the new session was rolled back." }
-                : { ok: false, code: "attention_required", status: "attention_required", message: "Fresh launch could not persist a new occupant generation and the new process could not be confirmed stopped; the seat requires attention.", sessionName: canonicalSessionName, sessionId: launch.session.id };
-        }
-        this.activityOracle?.declareOccupantSwap(node.id, generation);
-        const launchPosture = this.rigRepo.getNodePolicyProvenance(node.id)?.launchPosture
-            ?? this.rigRepo.getRigPolicyProvenance(seat.rigId)?.launchPosture
-            ?? "floor";
-        const startupResult = await this.startupOrchestrator.startNode({
-            rigId: seat.rigId,
-            nodeId: node.id,
-            sessionId: launch.session.id,
-            binding: {
-                ...launch.binding,
-                cwd: node.cwd ?? ".",
-                model: node.model ?? undefined,
-                codexConfigProfile: node.codexConfigProfile ?? undefined,
-                launchPosture,
-            },
-            adapter,
-            plan: startup.context.plan,
-            resolvedStartupFiles: startup.context.resolvedStartupFiles,
-            startupActions: startup.context.startupActions,
-            isRestore: false,
-            includeDurableObligations: true,
-            sessionName: canonicalSessionName,
-            allowFreshFallback: false,
-        });
-        if (!startupResult.ok && startupResult.startupStatus === "failed") {
-            const compensation = await this.compensateFailedFreshLaunch({
-                seat,
-                launch,
-                supersededSessionIds,
-                retiringGeneration,
-                newGeneration: generation,
-                startupPolicyHash: startup.context.hash,
-                model: node.model,
-                reason: input.reason,
-                operator: input.operator,
-                errors: startupResult.errors,
-            });
-            return compensation === "zero"
-                ? {
-                    ok: false,
-                    code: "startup_failed",
-                    status: "failed",
-                    message: `Fresh startup failed and was rolled back to zero live session/binding: ${startupResult.errors.join("; ")}`,
-                }
-                : {
-                    ok: false,
-                    code: "attention_required",
-                    status: "attention_required",
-                    message: `Fresh startup failed and the new process could not be confirmed stopped; the seat requires attention: ${startupResult.errors.join("; ")}`,
-                    sessionName: canonicalSessionName,
-                    sessionId: launch.session.id,
-                    generation,
-                };
-        }
-        const identity = await rebindAndVerifyPaneIdentity({
-            db: this.db,
-            sessionRegistry: this.sessionRegistry,
-            tmux: this.tmuxAdapter,
-            nodeId: node.id,
-            sessionName: canonicalSessionName,
-            runtime: node.runtime,
-            expectedResumeToken: this.sessionResumeToken(launch.session.id),
-            listProcesses: this.listProcesses,
-        });
-        const attentionRequired = !startupResult.ok || !identity.ok;
-        if (!identity.ok)
-            this.sessionRegistry.updateStartupStatus(launch.session.id, "attention_required");
-        let persisted = null;
-        const tx = this.db.transaction(() => {
-            this.db.prepare(`
-        UPDATE nodes SET
-          occupant_lifecycle = 'active',
-          continuity_outcome = 'fresh',
-          handover_result = NULL,
-          previous_occupant = ?,
-          handover_at = ?
-        WHERE id = ?
-      `).run(retiringRows.at(-1)?.session_name ?? null, new Date().toISOString(), node.id);
-            const nativeSessionId = this.sessionResumeToken(launch.session.id);
-            persisted = this.eventBus.persistWithinTransaction({
-                type: "seat.fresh_launched",
-                rigId: seat.rigId,
-                nodeId: node.id,
-                logicalId: seat.logicalId,
-                sessionName: canonicalSessionName,
-                sessionId: launch.session.id,
-                supersededSessionIds,
-                retiringGeneration,
-                newGeneration: generation,
-                nativeSessionId,
-                ...(nativeSessionId ? {} : { nativeSessionIdReason: "scrape_miss" }),
-                model: node.model,
-                startupPolicyHash: startup.context.hash,
-                reason: input.reason.trim(),
-                operator: input.operator ?? null,
-                status: attentionRequired ? "attention_required" : "ready",
-            });
-        });
-        tx();
-        if (persisted)
-            this.eventBus.notifySubscribers(persisted);
-        if (attentionRequired) {
-            return {
-                ok: false,
-                code: startupResult.ok ? "runtime_identity_unverified" : "attention_required",
-                status: "attention_required",
-                message: startupResult.ok
-                    ? `Fresh occupant started but runtime identity requires attention: ${identity.ok ? "unknown" : identity.detail}`
-                    : `Fresh occupant started but startup requires attention: ${startupResult.errors.join("; ")}`,
-                sessionName: canonicalSessionName,
-                sessionId: launch.session.id,
-                generation,
-            };
-        }
-        return {
-            ok: true,
-            seat,
-            status: "ready",
-            sessionName: canonicalSessionName,
-            sessionId: launch.session.id,
-            generation,
-            model: node.model,
-            startupPolicyHash: startup.context.hash,
-            supersededSessionIds,
-        };
-    }
-    // -- shared internals --
-    async stopManagedTmuxSeat(resolved, session, reason, operator) {
-        const seat = this.describe(resolved);
-        const kill = await this.tmuxAdapter.killSession(session.session_name);
-        if (kill && !kill.ok && kill.code !== "session_not_found") {
-            return {
-                ok: false,
-                code: "tmux_probe_failed",
-                message: `tmux kill-session for "${session.session_name}" failed: ${kill.message ?? kill.code}`,
-            };
-        }
-        let persisted = null;
-        const tx = this.db.transaction(() => {
-            this.sessionRegistry.updateStatus(session.id, "exited");
-            this.sessionRegistry.clearBinding(resolved.nodeId);
-            persisted = this.eventBus.persistWithinTransaction({
-                type: "session.stopped",
-                rigId: seat.rigId,
-                nodeId: seat.nodeId,
-                sessionName: session.session_name,
-                reason: reason.trim(),
-                operator: operator ?? null,
-            });
-        });
-        tx();
-        if (persisted)
-            this.eventBus.notifySubscribers(persisted);
-        return { ok: true, seat, sessionName: session.session_name, sessionId: session.id };
-    }
-    nonTerminalSessions(nodeId) {
-        return this.db.prepare("SELECT id, session_name, status, origin FROM sessions WHERE node_id = ? ORDER BY created_at, id").all(nodeId).filter((row) => !TERMINAL_SESSION_STATUSES.has(row.status));
-    }
-    sessionResumeToken(sessionId) {
-        const row = this.db.prepare("SELECT resume_token FROM sessions WHERE id = ?").get(sessionId);
-        return row?.resume_token?.trim() || null;
-    }
-    readStartupContext(nodeId, cwd) {
-        const row = this.db.prepare("SELECT projection_entries_json, resolved_files_json, startup_actions_json, runtime FROM node_startup_context WHERE node_id = ?").get(nodeId);
-        if (!row) {
-            return {
-                ok: false,
-                refusal: {
-                    ok: false,
-                    code: "startup_context_missing",
-                    message: `Persisted startup context is missing for node ${nodeId}; fresh launch refuses to invent an empty startup policy.`,
-                },
-            };
-        }
-        let rawEntries;
-        let rawFiles;
-        let rawActions;
-        try {
-            rawEntries = JSON.parse(row.projection_entries_json);
-            rawFiles = JSON.parse(row.resolved_files_json);
-            rawActions = JSON.parse(row.startup_actions_json);
-        }
-        catch (error) {
-            return this.malformedStartupContext(nodeId, `JSON parse failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!Array.isArray(rawEntries) || !Array.isArray(rawFiles) || !Array.isArray(rawActions) || !row.runtime?.trim()) {
-            return this.malformedStartupContext(nodeId, "projection entries, resolved files, and startup actions must be arrays and runtime must be non-empty");
-        }
-        const entries = [];
-        for (const raw of rawEntries) {
-            if (!isRecord(raw)
-                || !isProjectionCategory(raw["category"])
-                || !hasStrings(raw, ["effectiveId", "sourceSpec", "sourcePath", "resourcePath", "absolutePath"])
-                || !isOptionalString(raw["resourceType"])
-                || !isOptionalString(raw["target"])
-                || !isOptionalOneOf(raw["mergeStrategy"], ["managed_block", "append"])
-                || !isOptionalOneOf(raw["pluginType"], ["claude", "codex", "auto"])) {
-                return this.malformedStartupContext(nodeId, "projection_entries_json contains an invalid entry");
-            }
-            // S04 owns the live ambient skill set. Replaying the older catalog
-            // selection here could reinstall a skill that work-install removed.
-            if (raw["category"] === "skill")
-                continue;
-            entries.push({
-                category: raw["category"],
-                effectiveId: raw["effectiveId"],
-                sourceSpec: raw["sourceSpec"],
-                sourcePath: raw["sourcePath"],
-                resourcePath: raw["resourcePath"],
-                absolutePath: raw["absolutePath"],
-                classification: "safe_projection",
-                ...(typeof raw["resourceType"] === "string" ? { resourceType: raw["resourceType"] } : {}),
-                ...(typeof raw["mergeStrategy"] === "string" ? { mergeStrategy: raw["mergeStrategy"] } : {}),
-                ...(typeof raw["target"] === "string" ? { target: raw["target"] } : {}),
-                ...(typeof raw["pluginType"] === "string" ? { pluginType: raw["pluginType"] } : {}),
-            });
-        }
-        const resolvedStartupFiles = [];
-        for (const raw of rawFiles) {
-            if (!isRecord(raw)
-                || !hasStrings(raw, ["path", "absolutePath", "ownerRoot"])
-                || !isOneOf(raw["deliveryHint"], ["auto", "guidance_merge", "skill_install", "send_text"])
-                || typeof raw["required"] !== "boolean"
-                || !isStringArrayOf(raw["appliesOn"], ["fresh_start", "restore"])
-                || !isOptionalOneOf(raw["kind"], ["file"])) {
-                return this.malformedStartupContext(nodeId, "resolved_files_json contains an invalid entry");
-            }
-            resolvedStartupFiles.push({
-                path: raw["path"],
-                absolutePath: raw["absolutePath"],
-                ownerRoot: raw["ownerRoot"],
-                deliveryHint: raw["deliveryHint"],
-                required: raw["required"],
-                appliesOn: raw["appliesOn"],
-                ...(raw["kind"] === "file" ? { kind: "file" } : {}),
-            });
-        }
-        const startupActions = [];
-        for (const raw of rawActions) {
-            if (!isRecord(raw)
-                || !isOneOf(raw["type"], ["slash_command", "send_text", "startup_proof"])
-                || typeof raw["value"] !== "string"
-                || !isOneOf(raw["phase"], ["after_files", "after_ready"])
-                || !isStringArrayOf(raw["appliesOn"], ["fresh_start", "restore"])
-                || typeof raw["idempotent"] !== "boolean"
-                || !isOptionalOneOf(raw["builtin"], ["session_identity"])) {
-                return this.malformedStartupContext(nodeId, "startup_actions_json contains an invalid entry");
-            }
-            startupActions.push({
-                type: raw["type"],
-                value: raw["value"],
-                phase: raw["phase"],
-                appliesOn: raw["appliesOn"],
-                idempotent: raw["idempotent"],
-                ...(raw["builtin"] === "session_identity" ? { builtin: "session_identity" } : {}),
-            });
-        }
-        try {
-            resolveStartupProof(startupActions, "fresh_start");
-        }
-        catch (err) {
-            return this.malformedStartupContext(nodeId, err.message);
-        }
-        const startupFiles = resolvedStartupFiles.map((file) => ({
-            kind: file.kind,
-            path: file.path,
-            deliveryHint: file.deliveryHint,
-            required: file.required,
-            appliesOn: file.appliesOn,
-        }));
-        const plan = {
-            runtime: row.runtime,
-            cwd,
-            entries,
-            startup: { files: startupFiles, actions: startupActions },
-            conflicts: [],
-            noOps: [],
-            diagnostics: [],
-        };
-        const hash = createHash("sha256")
-            .update(JSON.stringify([row.projection_entries_json, row.resolved_files_json, row.startup_actions_json, row.runtime]))
-            .digest("hex");
-        return { ok: true, context: { plan, resolvedStartupFiles, startupActions, runtime: row.runtime, hash } };
-    }
-    malformedStartupContext(nodeId, detail) {
-        return {
-            ok: false,
-            refusal: {
-                ok: false,
-                code: "startup_context_malformed",
-                message: `Persisted startup context is malformed for node ${nodeId}: ${detail}.`,
-            },
-        };
-    }
-    async compensateFailedFreshLaunch(input) {
-        const kill = await this.tmuxAdapter.killSession(input.launch.sessionName);
-        const stopped = !kill || kill.ok || kill.code === "session_not_found";
-        const errors = stopped
-            ? input.errors
-            : [...input.errors, `tmux kill-session failed: ${kill.message ?? kill.code}`];
-        let persisted = null;
-        const tx = this.db.transaction(() => {
-            if (stopped) {
-                this.sessionRegistry.updateStatus(input.launch.session.id, "exited");
-                this.sessionRegistry.clearBinding(input.seat.nodeId);
-                this.db.prepare("UPDATE nodes SET occupant_lifecycle = 'unknown', continuity_outcome = 'failed' WHERE id = ?").run(input.seat.nodeId);
-            }
-            else {
-                this.sessionRegistry.updateStartupStatus(input.launch.session.id, "attention_required");
-                this.db.prepare("UPDATE nodes SET occupant_lifecycle = 'active', continuity_outcome = 'fresh' WHERE id = ?").run(input.seat.nodeId);
-            }
-            persisted = this.eventBus.persistWithinTransaction({
-                type: "seat.fresh_launch_failed",
-                rigId: input.seat.rigId,
-                nodeId: input.seat.nodeId,
-                logicalId: input.seat.logicalId,
-                sessionName: input.launch.sessionName,
-                sessionId: input.launch.session.id,
-                supersededSessionIds: input.supersededSessionIds,
-                retiringGeneration: input.retiringGeneration,
-                newGeneration: input.newGeneration,
-                model: input.model,
-                startupPolicyHash: input.startupPolicyHash,
-                reason: input.reason.trim(),
-                operator: input.operator ?? null,
-                errors,
-            });
-        });
-        tx();
-        if (persisted)
-            this.eventBus.notifySubscribers(persisted);
-        return stopped ? "zero" : "attention";
-    }
-    /**
-     * The ONE liveness read both mutating verbs share (fix r1, row 9baac99f):
-     * the CLASSIFIED probeSession, never the collapsed hasSession view.
-     *   present / absent        → returned for the verb to act on (absent is
-     *                             POSITIVE tmux evidence, per OPR.0.5.4.2).
-     *   transport_unavailable   → an INDETERMINATE refusal: session existence was
-     *                             NOT determined, so neither verb may act — and the
-     *                             refusal never routes the operator to a
-     *                             destructive verb.
-     *   unexpected probe throw  → the same indeterminate refusal (fail closed).
-     */
-    async probeLiveness(sessionName, refusalConsequence) {
-        let probe;
-        try {
-            probe = await this.tmuxAdapter.probeSession(sessionName);
-        }
-        catch (err) {
-            return {
-                ok: false,
-                code: "tmux_probe_failed",
-                message: `tmux liveness probe for "${sessionName}" failed (${err instanceof Error ? err.message : String(err)}) — liveness is INDETERMINATE, so ${refusalConsequence}.`,
-            };
-        }
-        if (probe.state === "transport_unavailable") {
-            return {
-                ok: false,
-                code: "tmux_probe_failed",
-                message: `tmux transport unavailable probing "${sessionName}" (${probe.cause}) — session existence was NOT determined (checked: classified tmux probe), so ${refusalConsequence}. Retry when the tmux transport is back.`,
-            };
-        }
-        return { state: probe.state };
-    }
-    requireReason(reason) {
-        if (!reason?.trim()) {
-            return { ok: false, code: "missing_reason", message: "An audit reason is required (--reason)." };
-        }
-        return null;
-    }
-    describe(resolved) {
-        return {
-            rigId: resolved.entry.rigId,
-            rigName: resolved.entry.rigName,
-            logicalId: resolved.entry.logicalId,
-            nodeId: resolved.nodeId,
-        };
-    }
-    latestSession(nodeId) {
-        const row = this.db.prepare("SELECT id, session_name, status, origin FROM sessions WHERE node_id = ? ORDER BY id DESC LIMIT 1").get(nodeId);
-        return row ?? null;
-    }
-    /** The ONE resolution path, mirroring SeatStatusService.findMatches semantics
-     *  (seat-status-service.ts) so every seat verb resolves identically: a canonical
-     *  `name@rig` ref scopes to that rig's inventory; a bare ref scans all rigs;
-     *  matches are by canonicalSessionName or logicalId; >1 match is a listed
-     *  ambiguity, never a pick. */
-    resolveSeat(seatRef) {
-        const ref = seatRef?.trim() ?? "";
-        if (!ref) {
-            return { ok: false, code: "seat_ref_required", message: "seat reference is required", guidance: SEAT_LOOKUP_GUIDANCE };
-        }
-        const matches = this.findMatches(ref);
-        if (matches.length === 0) {
-            return {
-                ok: false,
-                code: "seat_not_found",
-                message: `Seat "${ref}" not found (checked: canonical session names and logical ids across ${parseSessionName(ref).kind === "canonical" ? "the named rig" : "all rigs"}).`,
-                guidance: SEAT_LOOKUP_GUIDANCE,
-            };
-        }
-        if (matches.length > 1) {
-            return {
-                ok: false,
-                code: "seat_ambiguous",
-                message: `Seat "${ref}" matched multiple nodes`,
-                guidance: SEAT_LOOKUP_GUIDANCE,
-                matches: matches.map((entry) => ({
-                    rig_name: entry.rigName,
-                    logical_id: entry.logicalId,
-                    current_occupant: entry.canonicalSessionName,
-                })),
-            };
-        }
-        const entry = matches[0];
-        const nodeRow = this.db.prepare("SELECT id FROM nodes WHERE rig_id = ? AND logical_id = ?").get(entry.rigId, entry.logicalId);
-        if (!nodeRow) {
-            return { ok: false, code: "seat_not_found", message: `Seat "${ref}" resolved to a node that no longer exists.`, guidance: SEAT_LOOKUP_GUIDANCE };
-        }
-        return { entry, nodeId: nodeRow.id };
-    }
-    findMatches(ref) {
-        const parsed = parseSessionName(ref);
-        if (parsed.kind === "canonical") {
-            const localRef = parsed.member;
-            const rigs = this.rigRepo.findRigsByName(parsed.rig);
-            return rigs.flatMap((rig) => getNodeInventory(this.db, rig.id).filter((entry) => entry.canonicalSessionName === ref
-                || deriveCanonicalFromEntry(entry) === ref
-                || entry.logicalId === localRef));
-        }
-        return this.rigRepo.listRigs().flatMap((rig) => getNodeInventory(this.db, rig.id).filter((entry) => entry.canonicalSessionName === ref || entry.logicalId === ref));
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasStrings(value, keys) {
-    return keys.every((key) => typeof value[key] === "string" && value[key].trim().length > 0);
-}
-function isProjectionCategory(value) {
-    return isOneOf(value, ["skill", "guidance", "subagent", "plugin", "runtime_resource"]);
-}
-function isOptionalString(value) {
-    return value === undefined || typeof value === "string";
-}
-function isOneOf(value, allowed) {
-    return typeof value === "string" && allowed.includes(value);
-}
-function isOptionalOneOf(value, allowed) {
-    return value === undefined || isOneOf(value, allowed);
-}
-function isStringArrayOf(value, allowed) {
-    return Array.isArray(value) && value.every((entry) => isOneOf(entry, allowed));
-}
-//# sourceMappingURL=seat-lifecycle-service.js.map