@openrig/cli 0.5.2 → 0.5.4

package/node_modules/@openrig/daemon/dist/daemon-db-path.js

@@ -1,4 +1,45 @@
-import { join } from "node:path";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+/** Resolve existing path components, including a dangling final symlink, while
+ * preserving a not-yet-created tail. SQLite paths commonly do not exist yet at
+ * first boot, so realpathSync alone cannot answer the containment question. */
+function resolveForContainment(path, seen = new Set()) {
+    const absolute = resolve(path);
+    if (seen.has(absolute))
+        throw new Error(`symlink cycle while resolving ${path}`);
+    seen.add(absolute);
+    try {
+        return realpathSync(absolute);
+    }
+    catch (realpathError) {
+        let stat;
+        try {
+            stat = lstatSync(absolute);
+        }
+        catch (lstatError) {
+            if (realpathError.code !== "ENOENT" ||
+                lstatError.code !== "ENOENT") {
+                throw realpathError;
+            }
+            const parent = dirname(absolute);
+            return parent === absolute
+                ? absolute
+                : join(resolveForContainment(parent, seen), basename(absolute));
+        }
+        if (stat.isSymbolicLink()) {
+            const target = readlinkSync(absolute);
+            return resolveForContainment(resolve(dirname(absolute), target), seen);
+        }
+        // The path exists but realpath could not establish its identity (for
+        // example EACCES or ENOTDIR). Treating that as an absent tail would turn
+        // an unverified path into authority.
+        throw realpathError;
+    }
+}
+function isWithin(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+}
 /**
  * D15 — resolve the daemon's SQLite path. An explicit OPENRIG_DB / RIGGED_DB wins
  * (the operator takes responsibility for that path); otherwise the db is anchored
@@ -14,6 +55,13 @@ export function resolveDaemonDbPath(explicitDb, openrigHome) {
     if (explicitDb && explicitDb.length > 0) {
         return explicitDb;
     }
-    return join(openrigHome, "openrig.sqlite");
+    const dbPath = join(openrigHome, "openrig.sqlite");
+    const resolvedHome = resolveForContainment(openrigHome);
+    const resolvedDb = resolveForContainment(dbPath);
+    if (!isWithin(resolvedHome, resolvedDb)) {
+        throw new Error(`Refusing implicit database outside resolved OPENRIG_HOME: ${dbPath} resolves to ${resolvedDb}, ` +
+            `outside ${resolvedHome}. Set OPENRIG_DB explicitly to authorize a deliberate split-path configuration.`);
+    }
+    return dbPath;
 }
 //# sourceMappingURL=daemon-db-path.js.map

package/node_modules/@openrig/daemon/dist/daemon-db-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-db-path.js","sourceRoot":"","sources":["../src/daemon-db-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAqC,EAAE,WAAmB;IAC5F,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"daemon-db-path.js","sourceRoot":"","sources":["../src/daemon-db-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF;;+EAE+E;AAC/E,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAO,IAAI,GAAG,EAAU;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,aAAa,EAAE,CAAC;QACvB,IAAI,IAAkC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAK,aAAuC,CAAC,IAAI,KAAK,QAAQ;gBACzD,UAAoC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,aAAa,CAAC;YACtB,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,MAAM,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,qEAAqE;QACrE,yEAAyE;QACzE,qCAAqC;QACrC,MAAM,aAAa,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAqC,EAAE,WAAmB;IAC5F,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,gBAAgB,UAAU,IAAI;YACjG,WAAW,YAAY,iFAAiF,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/codex-thread-id.d.ts

@@ -4,4 +4,99 @@
 export type ResolveHomeDirByPid = (pid: number) => Promise<string | undefined> | string | undefined;
 export declare function defaultResolveHomeDirByPid(pid: number): Promise<string | undefined>;
 export declare function readCodexThreadIdFromCandidateHomes(pid: number, candidateHomes: Array<string | undefined>, exists?: (path: string) => boolean): string | undefined;
+/**
+ * OPR.0.5.3.10 (addendum) — thread-id resolution WITHOUT the per-call PID-home
+ * subprocess. The measured amplifier: 298 `codex_thread_id.resolve_home` spans
+ * in the last 500 slow spans (mean 8.24s, max 36.72s) — a `ps eww` per pid,
+ * per attempt, per tick, when nearly every codex seat's logs live under the
+ * DEFAULT home.
+ *
+ * Order of costs:
+ *   1. DEFAULT home first — a pure file/sqlite read, ZERO subprocess. Hit = done.
+ *   2. Bounded PID-keyed cache of previously RESOLVED non-default homes — a
+ *      pid's HOME does not change for the life of the process. Hit = file read.
+ *   3. Only then the subprocess resolver — and its SUCCESS is cached (bounded,
+ *      FIFO eviction). A FAILED resolution is never cached: the next call may
+ *      retry (a dying `ps` under load must not poison the pid).
+ */
+export declare class CodexThreadIdResolver {
+    private readonly opts;
+    /** Bounded (pid,identity)→home cache of SUCCESSFUL resolutions — INCLUDING
+     *  the default home (a stable default-home pid with no thread log must not
+     *  re-run `ps eww` every poll). KEYED BY IDENTITY (r2 round-3): a reused
+     *  pid carries a different startedAt, so it structurally MISSES the retired
+     *  occupant's entry — no read-time mismatch check to get wrong, and a late
+     *  stale-probe completion writes only its own key, never clobbering the
+     *  newer occupant's.
+     *
+     *  SETTLED entries never time-expire (e91d7a94 — the expiry-herd fix): a
+     *  probe that STARTED strictly after the identity's lstart second closed
+     *  observed the FINAL occupant of this (pid, lstart) key — same-pid
+     *  same-second reuse is impossible once the second passes, and a live
+     *  process's HOME cannot change — so the answer is valid for the key's
+     *  lifetime and is removed only by identity mismatch (a new key) or FIFO
+     *  size eviction. Probe START time is the predicate, NOT completion time
+     *  (orch-lead 22:39Z): a probe started inside the second can observe the
+     *  retired occupant and complete after it. UNSETTLED entries — probe
+     *  started inside the ambiguous second, unparseable identity, or
+     *  identity-less callers — expire after homeTtlMs (r2-B1/W-5.3-1): the
+     *  TTL is their staleness bound and the finite recovery path for the
+     *  same-second collision. */
+    private readonly homeByKey;
+    /** In-flight home resolution, keyed by pid+IDENTITY (r2 round-3): a known
+     *  identity must never join a probe belonging to a different or
+     *  identity-less occupant — under the measured 8-36s probes a pid can be
+     *  reused MID-PROBE, and pid-only coalescing handed the new occupant the
+     *  retired occupant's answer before the completed-cache check could run.
+     *  Same (pid, identity) still coalesces onto ONE subprocess; a failure
+     *  rejects all waiters of that key and caches nothing. */
+    private readonly inFlightByKey;
+    constructor(opts?: {
+        defaultHome?: string;
+        resolveHomeDirByPid?: ResolveHomeDirByPid;
+        readFromLogs?: (pid: number, homeDir: string) => string | undefined;
+        /** Bounded cache size; oldest-inserted evicts first. Default 256. */
+        maxCachedPids?: number;
+        /** Freshness bound for UNSETTLED cache entries — identity-less
+         *  callers, unparseable identities, and probes that started inside
+         *  the identity's ambiguous lstart second. Past it the pid re-probes;
+         *  this is the finite recovery path for the same-second collision
+         *  (W-5.3-1). Settled entries never consult it. Default 60s.
+         *  (The former identityHomeTtlMs tier is gone — e91d7a94: ANY
+         *  periodic expiry of settled entries synchronizes an unnecessary
+         *  probe herd, measured live as resolve_home +20 in 1.5s.) */
+        homeTtlMs?: number;
+        /** Injectable clock (tests). */
+        now?: () => number;
+    });
+    /**
+     * Resolve a codex thread id for `pid`. IDENTITY IS REQUIRED (S10 follow-on, r1 owed item 3): the
+     * identity's start time gates every log read, so a retired occupant's rows never resolve for a
+     * reused pid. The ungated read — the pre-round-4 class S10 eliminated, safe today only by
+     * call-graph discipline — is reachable ONLY via resolveUngatedLegacy, so a NEW identity-less
+     * call site is a COMPILE error (the review-visible pin; see the codex-thread-id test).
+     */
+    resolve(pid: number, identity: string): Promise<string | undefined>;
+    /**
+     * EXPLICIT ungated escape hatch — reads WITHOUT the identity start-time gate (a reused pid can
+     * match a retired occupant's rows). Use ONLY for genuinely identity-less callers (tests, adoption
+     * paths that carry no census identity). Every new identity-less read must NAME this method; do
+     * not re-open resolve() to an optional identity. By construction its cache entries can never be
+     * SETTLED: it delegates with identity=undefined, so minTs is undefined, the settled predicate is
+     * false, and every entry it writes stays bounded by homeTtlMs (60s) — see the settled-permanence
+     * rule (e91d7a94) on the cache above.
+     */
+    resolveUngatedLegacy(pid: number): Promise<string | undefined>;
+    private resolveInternal;
+    private cacheHome;
+}
+/** Parse `ps lstart` ("Sun Aug 23 19:30:00 2026", local time) to epoch
+ *  SECONDS. The reader gates STRICTLY (`ts > startTs`, r2 round-6): lstart
+ *  carries no subsecond component, so ownership of a row INSIDE the start
+ *  second is undecidable — retired A can log at ts == B.startTs in the same
+ *  second B reuses the pid. The ambiguous second fails CLOSED (honest
+ *  INDETERMINATE; a genuinely-current same-second row resolves one poll
+ *  later), rows after it resolve. Unparseable → undefined (the caller falls
+ *  back to the ungated read rather than inventing a gate). */
+export declare function lstartToMinTs(identity: string | undefined): number | undefined;
 //# sourceMappingURL=codex-thread-id.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/codex-thread-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-thread-id.d.ts","sourceRoot":"","sources":["../../src/domain/codex-thread-id.ts"],"names":[],"mappings":"AAUA;;oGAEoG;AACpG,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpG,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAczF;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,EACzC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACjC,MAAM,GAAG,SAAS,CAMpB"}
+{"version":3,"file":"codex-thread-id.d.ts","sourceRoot":"","sources":["../../src/domain/codex-thread-id.ts"],"names":[],"mappings":"AAUA;;oGAEoG;AACpG,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpG,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAczF;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,EACzC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACjC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qBAAqB;IAiC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhCvB;;;;;;;;;;;;;;;;;;;;iCAoB6B;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqE;IAC/F;;;;;;8DAM0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkD;gBAG7D,IAAI,GAAE;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAC1C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QACpE,qEAAqE;QACrE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;sEAO8D;QAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gCAAgC;QAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACf;IAGR;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIzE;;;;;;;;OAQG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;YAItD,eAAe;IAgE7B,OAAO,CAAC,SAAS;CAQlB;AAkED;;;;;;;8DAO8D;AAC9D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO9E"}

package/node_modules/@openrig/daemon/dist/domain/codex-thread-id.js

@@ -31,6 +31,150 @@ export function readCodexThreadIdFromCandidateHomes(pid, candidateHomes, exists)
     }
     return undefined;
 }
+/**
+ * OPR.0.5.3.10 (addendum) — thread-id resolution WITHOUT the per-call PID-home
+ * subprocess. The measured amplifier: 298 `codex_thread_id.resolve_home` spans
+ * in the last 500 slow spans (mean 8.24s, max 36.72s) — a `ps eww` per pid,
+ * per attempt, per tick, when nearly every codex seat's logs live under the
+ * DEFAULT home.
+ *
+ * Order of costs:
+ *   1. DEFAULT home first — a pure file/sqlite read, ZERO subprocess. Hit = done.
+ *   2. Bounded PID-keyed cache of previously RESOLVED non-default homes — a
+ *      pid's HOME does not change for the life of the process. Hit = file read.
+ *   3. Only then the subprocess resolver — and its SUCCESS is cached (bounded,
+ *      FIFO eviction). A FAILED resolution is never cached: the next call may
+ *      retry (a dying `ps` under load must not poison the pid).
+ */
+export class CodexThreadIdResolver {
+    opts;
+    /** Bounded (pid,identity)→home cache of SUCCESSFUL resolutions — INCLUDING
+     *  the default home (a stable default-home pid with no thread log must not
+     *  re-run `ps eww` every poll). KEYED BY IDENTITY (r2 round-3): a reused
+     *  pid carries a different startedAt, so it structurally MISSES the retired
+     *  occupant's entry — no read-time mismatch check to get wrong, and a late
+     *  stale-probe completion writes only its own key, never clobbering the
+     *  newer occupant's.
+     *
+     *  SETTLED entries never time-expire (e91d7a94 — the expiry-herd fix): a
+     *  probe that STARTED strictly after the identity's lstart second closed
+     *  observed the FINAL occupant of this (pid, lstart) key — same-pid
+     *  same-second reuse is impossible once the second passes, and a live
+     *  process's HOME cannot change — so the answer is valid for the key's
+     *  lifetime and is removed only by identity mismatch (a new key) or FIFO
+     *  size eviction. Probe START time is the predicate, NOT completion time
+     *  (orch-lead 22:39Z): a probe started inside the second can observe the
+     *  retired occupant and complete after it. UNSETTLED entries — probe
+     *  started inside the ambiguous second, unparseable identity, or
+     *  identity-less callers — expire after homeTtlMs (r2-B1/W-5.3-1): the
+     *  TTL is their staleness bound and the finite recovery path for the
+     *  same-second collision. */
+    homeByKey = new Map();
+    /** In-flight home resolution, keyed by pid+IDENTITY (r2 round-3): a known
+     *  identity must never join a probe belonging to a different or
+     *  identity-less occupant — under the measured 8-36s probes a pid can be
+     *  reused MID-PROBE, and pid-only coalescing handed the new occupant the
+     *  retired occupant's answer before the completed-cache check could run.
+     *  Same (pid, identity) still coalesces onto ONE subprocess; a failure
+     *  rejects all waiters of that key and caches nothing. */
+    inFlightByKey = new Map();
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    /**
+     * Resolve a codex thread id for `pid`. IDENTITY IS REQUIRED (S10 follow-on, r1 owed item 3): the
+     * identity's start time gates every log read, so a retired occupant's rows never resolve for a
+     * reused pid. The ungated read — the pre-round-4 class S10 eliminated, safe today only by
+     * call-graph discipline — is reachable ONLY via resolveUngatedLegacy, so a NEW identity-less
+     * call site is a COMPILE error (the review-visible pin; see the codex-thread-id test).
+     */
+    async resolve(pid, identity) {
+        return this.resolveInternal(pid, identity);
+    }
+    /**
+     * EXPLICIT ungated escape hatch — reads WITHOUT the identity start-time gate (a reused pid can
+     * match a retired occupant's rows). Use ONLY for genuinely identity-less callers (tests, adoption
+     * paths that carry no census identity). Every new identity-less read must NAME this method; do
+     * not re-open resolve() to an optional identity. By construction its cache entries can never be
+     * SETTLED: it delegates with identity=undefined, so minTs is undefined, the settled predicate is
+     * false, and every entry it writes stays bounded by homeTtlMs (60s) — see the settled-permanence
+     * rule (e91d7a94) on the cache above.
+     */
+    async resolveUngatedLegacy(pid) {
+        return this.resolveInternal(pid, undefined);
+    }
+    async resolveInternal(pid, identity) {
+        // r2 round-4: the identity's start time gates EVERY log read — a retired
+        // occupant's rows predate the current occupant's start and never match.
+        const minTs = lstartToMinTs(identity);
+        const readFromLogs = this.opts.readFromLogs
+            ?? ((p, home) => readCodexThreadIdFromLogs(p, home, undefined, minTs));
+        const defaultHome = this.opts.defaultHome ?? safeUserHomeDir() ?? os.homedir();
+        const now = this.opts.now ?? Date.now;
+        const ttl = this.opts.homeTtlMs ?? 60_000;
+        // 1. Default home: no subprocess.
+        const fromDefault = readFromLogs(pid, defaultHome);
+        if (fromDefault)
+            return fromDefault;
+        // 2. FRESH cached home for this (pid, identity): no subprocess. A reused
+        //    pid carries a new identity and structurally MISSES here (r1's
+        //    remedy); identity-less callers get their own TTL-bounded slot. A
+        //    cached DEFAULT means the subprocess already answered "default" once
+        //    — step 1 covered it.
+        const key = `${pid}|${identity ?? ""}`;
+        const cached = this.homeByKey.get(key);
+        if (cached) {
+            if (cached.settled || now() - cached.at <= ttl) {
+                return cached.home === defaultHome ? undefined : readFromLogs(pid, cached.home);
+            }
+            this.homeByKey.delete(key);
+        }
+        // 3. Subprocess resolution, coalesced by the SAME (pid, identity) key:
+        //    only callers holding the same identity share a probe (r2 round-3 —
+        //    under the measured 8-36s probes a pid can be reused MID-PROBE, and
+        //    pid-only coalescing handed the new occupant the retired occupant's
+        //    answer). A completion writes only its own key, so a late stale
+        //    probe never clobbers the newer occupant's entry.
+        const inFlight = this.inFlightByKey.get(key);
+        const homePromise = inFlight ?? (() => {
+            const resolver = this.opts.resolveHomeDirByPid ?? defaultResolveHomeDirByPid;
+            // Settledness is decided by the probe's START time (orch-lead 22:39Z):
+            // only a probe started strictly AFTER the identity's lstart second
+            // closed is guaranteed to observe the final occupant of this key. A
+            // deferred probe that started inside the second may describe the
+            // retired occupant even if it completes later, so its entry keeps the
+            // short TTL. Coalesced waiters inherit the ORIGINAL probe's verdict.
+            const settled = minTs !== undefined && now() >= (minTs + 1) * 1000;
+            const p = Promise.resolve(resolver(pid)).then((home) => {
+                this.inFlightByKey.delete(key);
+                if (home)
+                    this.cacheHome(key, home, settled);
+                return home;
+            }, (err) => {
+                // Honest failure: nothing cached, next call retries.
+                this.inFlightByKey.delete(key);
+                throw err;
+            });
+            this.inFlightByKey.set(key, p);
+            return p;
+        })();
+        const home = await homePromise;
+        if (!home || home === defaultHome)
+            return undefined;
+        return readFromLogs(pid, home);
+    }
+    cacheHome(key, home, settled) {
+        const max = this.opts.maxCachedPids ?? 256;
+        if (!this.homeByKey.has(key) && this.homeByKey.size >= max) {
+            const oldest = this.homeByKey.keys().next().value;
+            if (oldest !== undefined)
+                this.homeByKey.delete(oldest);
+        }
+        this.homeByKey.set(key, { home, at: (this.opts.now ?? Date.now)(), settled });
+    }
+}
+const _resolveRequiresIdentityPin = true;
+void _resolveRequiresIdentityPin;
 function uniqueHomes(candidateHomes) {
     const homes = candidateHomes.filter((home) => Boolean(home));
     const userHome = safeUserHomeDir();
@@ -46,7 +190,12 @@ function safeUserHomeDir() {
         return undefined;
     }
 }
-function readCodexThreadIdFromLogs(pid, homeDir, exists) {
+function readCodexThreadIdFromLogs(pid, homeDir, exists, minTs) {
+    // OPR.0.5.3.10 r2 round-4 — the logs key is pid:<pid>:<opaque-uuid>, so a
+    // pid-only read can return a RETIRED occupant's row to a reused pid. When
+    // the caller knows the current occupant's start time (minTs, epoch
+    // seconds), only rows written strictly AFTER its start second are provably that occupant's. Identity-less
+    // callers keep the legacy unbounded read.
     for (const dbPath of resolveCodexLogDbPaths(homeDir, exists)) {
         try {
             const db = new Database(dbPath, { readonly: true });
@@ -55,8 +204,9 @@ function readCodexThreadIdFromLogs(pid, homeDir, exists) {
            FROM logs
            WHERE process_uuid LIKE ?
              AND thread_id IS NOT NULL
+             AND ts > ?
            ORDER BY ts DESC, ts_nanos DESC, id DESC
-           LIMIT 1`).get(`pid:${pid}:%`);
+           LIMIT 1`).get(`pid:${pid}:%`, minTs ?? 0);
                 if (row?.thread_id) {
                     return row.thread_id;
                 }
@@ -71,6 +221,25 @@ function readCodexThreadIdFromLogs(pid, homeDir, exists) {
     }
     return undefined;
 }
+/** Parse `ps lstart` ("Sun Aug 23 19:30:00 2026", local time) to epoch
+ *  SECONDS. The reader gates STRICTLY (`ts > startTs`, r2 round-6): lstart
+ *  carries no subsecond component, so ownership of a row INSIDE the start
+ *  second is undecidable — retired A can log at ts == B.startTs in the same
+ *  second B reuses the pid. The ambiguous second fails CLOSED (honest
+ *  INDETERMINATE; a genuinely-current same-second row resolves one poll
+ *  later), rows after it resolve. Unparseable → undefined (the caller falls
+ *  back to the ungated read rather than inventing a gate). */
+export function lstartToMinTs(identity) {
+    if (!identity)
+        return undefined;
+    const m = identity.match(/^\w{3}\s+(\w{3})\s+(\d+)\s+(\d{2}:\d{2}:\d{2})\s+(\d{4})$/);
+    if (!m)
+        return undefined;
+    const parsed = Date.parse(`${m[1]} ${m[2]}, ${m[4]} ${m[3]}`);
+    if (Number.isNaN(parsed))
+        return undefined;
+    return Math.floor(parsed / 1000);
+}
 function resolveCodexLogDbPaths(homeDir, exists) {
     const codexDir = nodePath.join(homeDir, ".codex");
     const discovered = [];

package/node_modules/@openrig/daemon/dist/domain/codex-thread-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-thread-id.js","sourceRoot":"","sources":["../../src/domain/codex-thread-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAW;IAC1D,IAAI,CAAC;QACH,wEAAwE;QACxE,gFAAgF;QAChF,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAClH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,GAAW,EACX,cAAyC,EACzC,MAAkC;IAElC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,cAAyC;IAC5D,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAW,EACX,OAAe,EACf,MAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;;;;;mBAKS,CACV,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAuC,CAAC;gBAC5D,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;oBACnB,OAAO,GAAG,CAAC,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,MAAkC;IACjF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,UAAU,GAA6C,EAAE,CAAC;IAEhE,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,UAAU;SACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;SACrC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;SAC7D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"codex-thread-id.js","sourceRoot":"","sources":["../../src/domain/codex-thread-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAW;IAC1D,IAAI,CAAC;QACH,wEAAwE;QACxE,gFAAgF;QAChF,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAClH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,GAAW,EACX,cAAyC,EACzC,MAAkC;IAElC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qBAAqB;IAiCb;IAhCnB;;;;;;;;;;;;;;;;;;;;iCAoB6B;IACZ,SAAS,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC/F;;;;;;8DAM0D;IACzC,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEhF,YACmB,OAiBb,EAAE;QAjBW,SAAI,GAAJ,IAAI,CAiBf;IACL,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,QAAgB;QACzC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,QAA4B;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;eACtC,CAAC,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,eAAe,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAE1C,kCAAkC;QAClC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,yEAAyE;QACzE,mEAAmE;QACnE,sEAAsE;QACtE,yEAAyE;QACzE,0BAA0B;QAC1B,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;gBAC/C,OAAO,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;YAC7E,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC3C,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,IAAI;oBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,qDAAqD;gBACrD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;YACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,OAAgB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;CACF;AAWD,MAAM,2BAA2B,GAA4B,IAAI,CAAC;AAClE,KAAK,2BAA2B,CAAC;AAEjC,SAAS,WAAW,CAAC,cAAyC;IAC5D,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAW,EACX,OAAe,EACf,MAAkC,EAClC,KAAc;IAEd,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,0GAA0G;IAC1G,0CAA0C;IAC1C,KAAK,MAAM,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;;;;;;mBAMS,CACV,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAuC,CAAC;gBACxE,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;oBACnB,OAAO,GAAG,CAAC,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;8DAO8D;AAC9D,MAAM,UAAU,aAAa,CAAC,QAA4B;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,MAAkC;IACjF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,UAAU,GAA6C,EAAE,CAAC;IAEhE,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,UAAU;SACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;SACrC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;SAC7D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/context-packs/context-pack-types.d.ts

@@ -7,6 +7,52 @@ export interface ContextPackManifestFile {
     /** One-line description rendered in the review pane and bundle frame. */
     summary?: string;
 }
+export declare const ATOM_TAXONOMIES: readonly ["world", "lore", "skills", "mission"];
+export declare const ATOM_REGIONS: readonly ["identity", "ontology", "terrain", "actors", "laws", "history", "state", "affordances"];
+export declare const ATOM_SITUATIONS: readonly ["fresh", "handover", "post-compaction"];
+export declare const ATOM_PURPOSES: readonly ["depth", "width"];
+export declare const ATOM_RUNTIMES: readonly ["claude", "codex", "any"];
+export declare const ATOM_PRIORITIES: readonly ["core", "recommended", "optional"];
+/** An install ATOM (OPR.0.5.3.5 mini-req 1): an ADDRESS plus composition
+ *  metadata, never a new file — fresh/handover/post-compaction all compose
+ *  addresses into the same bytes, so there is no second copy to drift
+ *  (mini-req 5 by construction). Token counts are DERIVED at compose time,
+ *  never stored here (volatility x consequence rule). */
+export interface ContextPackAtom {
+    /** Stable slug — the join key for order/requires/probes. */
+    id: string;
+    /** `file` or `file#H2-slug/H3-slug` (the Atom-1 grammar); the file must be
+     *  one of the manifest's declared files, and a header path requires a
+     *  markdown file. */
+    address: string;
+    taxonomy: (typeof ATOM_TAXONOMIES)[number];
+    /** World-anatomy tags — enables compose-by-region (the measured
+     *  post-compaction need was width: affordances + terrain). */
+    regions?: Array<(typeof ATOM_REGIONS)[number]>;
+    /** The composition algebra's selector; never empty. */
+    situations: Array<(typeof ATOM_SITUATIONS)[number]>;
+    purpose: (typeof ATOM_PURPOSES)[number];
+    /** Mini-req 3: never assume identical compaction loss. Default "any". */
+    runtime: (typeof ATOM_RUNTIMES)[number];
+    /** Position within the base walk — absorption depends on sequence. */
+    order: number;
+    /** Dependency edges; a subset profile must close over them. Declared ids
+     *  only, no self-reference, no cycles. */
+    requires?: string[];
+    /** What drops FIRST when a token budget binds (mini-req 9). */
+    priority: (typeof ATOM_PRIORITIES)[number];
+    /** Mini-req 2: acceptance is CHANGED BEHAVIOR — a natural prompt plus the
+     *  expected observable behavior. Q3 bridge: the shape reconciles with the
+     *  harness's EvalCase — optional compilable expectedPatterns (the
+     *  deterministic door leg) and a 1-5 rubric (the judged leg); `expect`
+     *  stays the required prose contract. Closed key set at ingest. */
+    probe?: {
+        prompt: string;
+        expect: string;
+        expectedPatterns?: string[];
+        rubric?: string;
+    };
+}
 export interface ContextPackManifest {
     name: string;
     version: string;
@@ -16,6 +62,8 @@ export interface ContextPackManifest {
      *  estimate is available); the library service computes a derived
      *  `derivedEstimatedTokens` from actual file sizes for display. */
     estimatedTokens?: number;
+    /** OPR.0.5.3.5 mini-req 1 — install atoms with composition metadata. */
+    atoms?: ContextPackAtom[];
 }
 export type ContextPackSourceType = "builtin" | "user_file" | "workspace";
 /** Library-shaped record emitted by ContextPackLibraryService. */

package/node_modules/@openrig/daemon/dist/domain/context-packs/context-pack-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-pack-types.d.ts","sourceRoot":"","sources":["../../../src/domain/context-packs/context-pack-types.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb;wEACoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC;;uEAEmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAE1E,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B;2CACuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,qBAAqB,CAAC;IAClC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;qEACiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;oEACgE;IAChE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;oDAEgD;IAChD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAChB,kBAAkB,GAClB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAGlB,YAAY,GAEZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GAInB,oBAAoB;aAER,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAtBjC,IAAI,EAChB,kBAAkB,GAClB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAGlB,YAAY,GAEZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GAInB,oBAAoB,EACxB,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD"}
+{"version":3,"file":"context-pack-types.d.ts","sourceRoot":"","sources":["../../../src/domain/context-packs/context-pack-types.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb;wEACoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,eAAO,MAAM,eAAe,iDAAkD,CAAC;AAC/E,eAAO,MAAM,YAAY,mGAAoG,CAAC;AAC9H,eAAO,MAAM,eAAe,mDAAoD,CAAC;AACjF,eAAO,MAAM,aAAa,6BAA8B,CAAC;AACzD,eAAO,MAAM,aAAa,qCAAsC,CAAC;AACjE,eAAO,MAAM,eAAe,8CAA+C,CAAC;AAE5E;;;;yDAIyD;AACzD,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX;;yBAEqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C;kEAC8D;IAC9D,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,uDAAuD;IACvD,UAAU,EAAE,KAAK,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,yEAAyE;IACzE,OAAO,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;8CAC0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;uEAImE;IACnE,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1F;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC;;uEAEmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;AAE1E,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B;2CACuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,qBAAqB,CAAC;IAClC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB;qEACiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;oEACgE;IAChE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;oDAEgD;IAChD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAChB,kBAAkB,GAClB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAGlB,YAAY,GAEZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GAInB,oBAAoB;aAER,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAtBjC,IAAI,EAChB,kBAAkB,GAClB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAGlB,YAAY,GAEZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GAInB,oBAAoB,EACxB,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD"}

package/node_modules/@openrig/daemon/dist/domain/context-packs/context-pack-types.js

@@ -9,6 +9,14 @@
 // ~/.openrig/context-packs/<name>/ (host) + workspace-local
 // .openrig/context-packs/<name>/. NO new SQLite tables; library cache
 // is in-memory at the daemon scope.
+// OPR.0.5.3.5 mini-req 1 — the founder taxonomy and world anatomy the atom
+// schema speaks (SPEC.md design context; intake DESIGN-INTAKE-ATOM-SCHEMA).
+export const ATOM_TAXONOMIES = ["world", "lore", "skills", "mission"];
+export const ATOM_REGIONS = ["identity", "ontology", "terrain", "actors", "laws", "history", "state", "affordances"];
+export const ATOM_SITUATIONS = ["fresh", "handover", "post-compaction"];
+export const ATOM_PURPOSES = ["depth", "width"];
+export const ATOM_RUNTIMES = ["claude", "codex", "any"];
+export const ATOM_PRIORITIES = ["core", "recommended", "optional"];
 export class ContextPackError extends Error {
     code;
     details;

package/node_modules/@openrig/daemon/dist/domain/context-packs/context-pack-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-pack-types.js","sourceRoot":"","sources":["../../../src/domain/context-packs/context-pack-types.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,2DAA2D;AAC3D,4DAA4D;AAC5D,sEAAsE;AACtE,oCAAoC;AAiEpC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEvB;IAsBA;IAvBlB,YACkB,IAoBQ,EACxB,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAxBC,SAAI,GAAJ,IAAI,CAoBI;QAER,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"context-pack-types.js","sourceRoot":"","sources":["../../../src/domain/context-packs/context-pack-types.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,2DAA2D;AAC3D,4DAA4D;AAC5D,sEAAsE;AACtE,oCAAoC;AAYpC,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAU,CAAC;AAC9H,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAU,CAAC;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AA6F5E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEvB;IAsBA;IAvBlB,YACkB,IAoBQ,EACxB,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAxBC,SAAI,GAAJ,IAAI,CAoBI;QAER,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/context-packs/manifest-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-parser.d.ts","sourceRoot":"","sources":["../../../src/domain/context-packs/manifest-parser.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoB,KAAK,mBAAmB,EAAgC,MAAM,yBAAyB,CAAC;AAKnH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,CA0HtF"}
+{"version":3,"file":"manifest-parser.d.ts","sourceRoot":"","sources":["../../../src/domain/context-packs/manifest-parser.ts"],"names":[],"mappings":"AAQA,OAAO,EASL,KAAK,mBAAmB,EAEzB,MAAM,yBAAyB,CAAC;AAYjC,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,CA6HtF"}