@openrig/cli 0.5.7 → 0.5.9

package/node_modules/@openrig/daemon/dist/domain/queue-repository.js

@@ -234,12 +234,24 @@ export function destinationRigTeaching(session) {
  * gateway resolver (how to register + "not an agent seat"). Loads the registry only for
  * the (rare) @external refusal path. Undefined for non-@external / registered / scheme.
  */
-export function externalAdmissionTeaching(session) {
+export function externalAdmissionTeaching(session, loadRegistry = loadHumanRegistry) {
     const parsed = parseSessionName(session);
     if (parsed.kind !== "external")
         return undefined;
-    const reg = loadHumanRegistry();
-    const entities = reg.ok ? reg.entities.map((e) => ({ entityId: e.entityId, address: e.address })) : [];
+    if (resolveExternal(parsed.local, []).kind === "scheme")
+        return undefined;
+    const reg = loadRegistry();
+    if (!reg.ok) {
+        return {
+            externalDomain: parsed.domain,
+            registryLoadError: true,
+            registryError: reg.error,
+            ...(/projection/i.test(reg.error) ? { registryProjectionError: true } : {}),
+            hint: `human registry admission is unavailable because the registry/projection failed to load: ${reg.error}. ` +
+                "Repair the existing registry projection from its fragments; do not re-add the human or downgrade the destination to an agent seat.",
+        };
+    }
+    const entities = reg.entities.map((e) => ({ entityId: e.entityId, address: e.address }));
     const res = resolveExternal(parsed.local, entities);
     if (res.kind !== "unregistered")
         return undefined; // registered/scheme were admitted upstream
@@ -247,8 +259,15 @@ export function externalAdmissionTeaching(session) {
 }
 /** The refusal teaching for ANY rejected destination: the @external entity teaching
  *  (A4b) OR the host-suffix teaching (4b). One helper, all four refusal sites. */
-export function destinationRefusalTeaching(session) {
-    return externalAdmissionTeaching(session) ?? destinationRigTeaching(session);
+export function destinationRefusalTeaching(session, loadRegistry = loadHumanRegistry) {
+    return externalAdmissionTeaching(session, loadRegistry) ?? destinationRigTeaching(session);
+}
+function destinationValidationError(field, session, loadRegistry) {
+    const teaching = destinationRefusalTeaching(session, loadRegistry);
+    if (teaching?.registryLoadError === true) {
+        return new QueueRepositoryError("human_registry_unavailable", `${field} ${session} cannot be admitted because the human registry failed to load: ${String(teaching.registryError)}`, teaching);
+    }
+    return new QueueRepositoryError("unknown_destination_rig", `${field} ${session} references an unknown rig`, teaching);
 }
 /**
  * MF6: does a transport error/reason string denote a TIMEOUT (ambiguous — the
@@ -808,7 +827,7 @@ export class QueueRepository {
         // (routes/queue.ts stamp-at-FORWARD), and a genuine origin triple arriving from a
         // forward is stored verbatim (never re-stamped, never stripped).
         if (!this.validateRig(input.destinationSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
+            throw destinationValidationError("destination_session", input.destinationSession, this.loadHumanRegistryFn);
         }
         const txn = this.db.transaction(() => this.createInTransactionalContext(input));
         let id;
@@ -870,7 +889,7 @@ export class QueueRepository {
      */
     createWithinTransaction(input) {
         if (!this.validateRig(input.destinationSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
+            throw destinationValidationError("destination_session", input.destinationSession, this.loadHumanRegistryFn);
         }
         const result = this.createInTransactionalContext(input);
         return {
@@ -969,7 +988,7 @@ export class QueueRepository {
             throw new QueueRepositoryError("qitem_already_terminal", `qitem ${input.qitemId} is already in terminal state ${source.state}`);
         }
         if (!this.validateRig(input.toSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`, destinationRefusalTeaching(input.toSession));
+            throw destinationValidationError("to_session", input.toSession, this.loadHumanRegistryFn);
         }
         const newId = newQitemId();
         const ts = new Date().toISOString();
@@ -1013,6 +1032,10 @@ export class QueueRepository {
                 closureTarget: input.toSession,
                 identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
+            // OPR.0.5.8.1 S1b — THE ROUTE THE FOUNDING SPECIMEN TOOK. Row b7a70333 went
+            // handed-off at 10:02:03Z and its timer still fired at 10:18:07Z, because
+            // handoff() is its own transaction and never passes through update().
+            this.retireParkGeneratedTimer(source.qitemId, "park_ended:handed-off");
             if (this.hasTargetRepoColumn) {
                 this.db
                     .prepare(`INSERT INTO queue_items (
@@ -1113,7 +1136,7 @@ export class QueueRepository {
             throw new QueueRepositoryError("qitem_already_terminal", `qitem ${input.qitemId} is already in terminal state ${source.state}`);
         }
         if (!this.validateRig(input.toSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`, destinationRefusalTeaching(input.toSession));
+            throw destinationValidationError("to_session", input.toSession, this.loadHumanRegistryFn);
         }
         const newId = newQitemId();
         const ts = new Date().toISOString();
@@ -1155,6 +1178,9 @@ export class QueueRepository {
                 closureTarget: input.toSession,
                 identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
+            // OPR.0.5.8.1 S1b — same structural bypass as handoff(): own transaction,
+            // never routes through update().
+            this.retireParkGeneratedTimer(source.qitemId, "park_ended:done");
             if (this.hasTargetRepoColumn) {
                 this.db
                     .prepare(`INSERT INTO queue_items (
@@ -1299,6 +1325,8 @@ export class QueueRepository {
                 closureReason: "handed_off_to",
                 closureTarget: input.closureTarget,
             });
+            // OPR.0.5.8.1 S1b — third member of the handoff family, same bypass.
+            this.retireParkGeneratedTimer(input.qitemId, `park_ended:${input.terminalState}`);
             const handoffEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.handed_off",
                 qitemId: input.qitemId,
@@ -1366,6 +1394,21 @@ export class QueueRepository {
             asSource: { total: sourceTotalRow.n },
         };
     }
+    /**
+     * Every in-progress row destined for `session`, UNBOUNDED and single-state.
+     *
+     * `whoami`'s `recent` is a display projection: it is capped (default 25, max 200) and
+     * mixes pending/in-progress/blocked. Anything that must reason about how many batons a
+     * seat truly holds — in particular a refusal that fires on ambiguity — cannot read it,
+     * because a second in-progress row sitting past the cap is invisible and the refusal
+     * silently degrades into a confident answer. This is that authoritative input.
+     */
+    listInProgressForDestination(session) {
+        const rows = this.db
+            .prepare(`SELECT * FROM queue_items WHERE destination_session = ? AND state = 'in-progress'`)
+            .all(session);
+        return rows.map((r) => this.rowToItem(r));
+    }
     /**
      * Mark a qitem `in-progress` (claim). Computes closure_required_at from tier.
      */
@@ -1411,6 +1454,13 @@ export class QueueRepository {
                 transitionNote: "claimed",
                 identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
+            // OPR.0.5.8.1 S1b — CLAIM-RESUME. A blocked row is claimable ("only
+            // pending/blocked are claimable"), so claiming is a real exit from a park
+            // and it writes state directly rather than through update(). This is the
+            // very transition the story contract named, and my first repair pinned it
+            // through `update()` — a different spelling of the same outcome, which is
+            // why it looked covered.
+            this.retireParkGeneratedTimer(input.qitemId, "park_ended:claimed");
             return this.eventBus.persistWithinTransaction({
                 type: "queue.claimed",
                 qitemId: input.qitemId,
@@ -1728,12 +1778,20 @@ export class QueueRepository {
                 intervalSeconds: input.wakeAfterSeconds,
                 registeredBySession: input.actorSession,
             });
-            // S16 only: ordinary periodic reminders intentionally evaluate immediately.
-            // A provider-limit timer instead starts its interval at registration so the
-            // existing scheduler's due boundary is registeredAt + intervalSeconds.
-            if (qitem.tags?.includes(USAGE_LIMIT_BLOCKER_TAG)) {
-                jobsRepo.recordEvaluation(job.jobId, job.registeredAt, false);
-            }
+            // OPR.0.5.8.1 S1 — start the interval at registration for EVERY explicit
+            // `--wake-after` timer, not only provider-limit ones.
+            //
+            // `isDue` treats a job with no `last_evaluation_at` as due immediately, so
+            // an unseeded timer fires on the scheduler's very first pass regardless of
+            // its interval: measured at 0.69s for a requested 20m and 0.77s for a
+            // requested 2h. The duration was never lost — `interval_seconds` held 1200
+            // and 7200 correctly — it simply was not the thing being measured against.
+            //
+            // S16 introduced this seeding for provider-limit parks only and recorded
+            // the narrow scope as deliberate. Widening it is the whole repair: the
+            // mechanism is unchanged and already proven by the provider-limit path, so
+            // this adds no scheduler and no per-wake bookkeeping.
+            jobsRepo.recordEvaluation(job.jobId, job.registeredAt, false);
             parkWake = { kind: "timer", ref: job.jobId };
         }
         else if (input.state === "blocked" && effectiveBlockedOn?.startsWith("qitem-")) {
@@ -1785,6 +1843,22 @@ export class QueueRepository {
             ownerNotificationLevel: notification?.level,
         });
         if (parkWake) {
+            // OPR.0.5.8.1 S1b addendum — A NEW PARK EPISODE SUPERSEDES THE OLD.
+            // Re-parking (blocked -> blocked with a fresh --wake-after) used to arm a
+            // second job while the first stayed active, leaving two live timers on one
+            // row: the third repeat-fire route, alongside the never-stopped fire and
+            // the row-outliving timer.
+            //
+            // Read BEFORE recording the new armed row: getStatus returns the most
+            // recent armed wake, so after the record below it would return the one we
+            // are arming now rather than the one being superseded.
+            //
+            // Deliberately not gated on the previous state. The live+timer test is the
+            // real safety, and leaving it ungated also cleans up a stale park-generated
+            // timer left by any path that did not unpark cleanly. It cannot over-reach:
+            // a job already terminal fails `live`, and an operator's attached watchdog
+            // fails the kind test.
+            this.retireParkGeneratedTimer(input.qitemId, "park_superseded");
             this.wakeRepo.record({
                 transitionId: transition.transitionId,
                 qitemId: input.qitemId,
@@ -1794,6 +1868,25 @@ export class QueueRepository {
                 deliveryStatus: null,
             });
         }
+        else if (fromState === "blocked" && input.state !== "blocked") {
+            // OPR.0.5.8.1 S1b — a park-generated timer is bound to the PARK EPISODE.
+            // Leaving `blocked` ends it, so a wake can never arrive telling a seat to
+            // resume a row that is no longer parked. Specimen: job
+            // 01M1E6F3QG41N76Y1CDX48P766 fired at 10:18:07Z for a row that went
+            // handed-off at 10:02:03Z — sixteen minutes terminal, and the wake still
+            // said "resume the recorded continuation".
+            //
+            // Stopping AT THE TRANSITION rather than checking row state at fire time,
+            // because the fire path delivers before it consults the queue at all:
+            // `recordWatchdogWakeAttempt` runs after delivery and merely returns early
+            // when the row is gone, so a check there would audit a wake that had
+            // already been sent.
+            //
+            // ONLY kind === "timer" is stopped. Those jobs are generated by this park
+            // and owned by it. A watchdog the operator attached with --wake-watchdog
+            // (kind "watchdog") is theirs, may target other rows, and must survive.
+            this.retireParkGeneratedTimer(input.qitemId, `park_ended:${input.state}`);
+        }
         // 0.5.1-53 Atom 1b(iii) — propagate-completion. blocked_on PROMISES "A waits until B completes";
         // that promise never fired on this runtime (rows sat blocked on done/canceled blockers for days).
         // When THIS qitem reaches a terminal state, auto-unpark every row parked on it (blocked_on = this,
@@ -1828,6 +1921,30 @@ export class QueueRepository {
      *  call it inside their own transactions. The class this unifies away was
      *  per-code-path: the handoff verbs wrote terminal states via direct SQL and the
      *  promise never fired for them. Never a second copy of this logic. */
+    /**
+     * OPR.0.5.8.1 S1b — retire the timer a park generated for this row.
+     *
+     * THE SINGLE PLACE THIS DECISION IS MADE. `queue_items.state` is written by
+     * SIX methods, not one, and the first version of this repair only hooked the
+     * generic `updateInTransactionalContext`. Every other writer silently kept the
+     * timer alive — including `handoff()`, which is the exact route that produced
+     * the motivating specimen (review50-r2 found that one; enumerating the rest
+     * found `claim()` and `propagateBlockerCompletion()` too, and `claim()` is the
+     * "claim-resume" the story contract named explicitly).
+     *
+     * Callers must invoke this inside their own state-transition transaction, so a
+     * row can never be observed out of its park with a live park timer.
+     *
+     * Only park-GENERATED timers are retired. A watchdog the operator attached with
+     * `--wake-watchdog` is theirs, may target other rows, and always survives.
+     * Non-live jobs are left alone, so calling this twice is harmless.
+     */
+    retireParkGeneratedTimer(qitemId, reason) {
+        const armed = this.wakeRepo.getStatus(qitemId);
+        if (armed?.kind !== "timer" || !armed.live)
+            return;
+        (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(armed.ref, reason);
+    }
     propagateBlockerCompletion(input) {
         const dependentEvents = [];
         const blockedRows = this.db
@@ -1843,6 +1960,11 @@ export class QueueRepository {
                 actorSession: input.actorSession,
                 transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.terminalState}'`,
             });
+            // OPR.0.5.8.1 S1b — AUTO-UNPARK. A row parked with `--on X --wake-after 20m`
+            // carries BOTH a blocker and a timer; when X completes this unparks the row
+            // directly, so without this the blocker did its job and the timer still fired
+            // afterwards at a row that was no longer parked.
+            this.retireParkGeneratedTimer(r.qitem_id, "park_ended:auto-unparked");
             const wakeIntentId = this.stageAutoUnparkWakeIntent({
                 qitemId: r.qitem_id,
                 destinationSession: r.destination_session,
@@ -1871,12 +1993,38 @@ export class QueueRepository {
     getParkWakeStatus(qitemId) {
         return this.wakeRepo.getStatus(qitemId);
     }
+    /** Refuse a legacy park-generated timer only when every row bound to it is
+     *  terminal. Current exits retire these timers transactionally; this is the
+     *  delivery-seam backstop for residue persisted by an older daemon. A timer
+     *  still bound to any actionable row, and every operator-attached watchdog,
+     *  remains deliverable. */
+    resolveWatchdogPreDeliveryTerminalReason(jobId) {
+        const targets = this.wakeRepo.findQitemsByGeneratedTimer(jobId);
+        if (targets.length === 0 || targets.some(({ state }) => !isTerminalState(state)))
+            return null;
+        // Ownership, not just staleness. This backstop may retire a job only when
+        // the job is SOLELY a park-generated timer. `--wake-watchdog` can attach an
+        // operator row to the very job another row's `--wake-after` produced, and
+        // that is a supported path — so a shared job carries a second, watchdog-kind
+        // binding this reason has no authority over. The timer's rows being terminal
+        // says nothing about the attachment; claiming the job anyway terminals it
+        // before transport and the attachment can never wake.
+        if (this.wakeRepo.findQitemsByAttachedWatchdog(jobId).length > 0)
+            return null;
+        return "park_timer_target_terminal";
+    }
     listTransitions(qitemId) {
         return this.transitionLog.listForQitem(qitemId).map((transition) => {
             const wake = this.wakeRepo.getForTransition(transition.transitionId);
             return wake ? { ...transition, wake } : transition;
         });
     }
+    /** Read-only scope-aware RECENT projection. Normalization and its hard cap
+     * live with the append-only transition log; the repository owns the public
+     * queue-domain door. */
+    listRecentTransitions(scope, limit = 20) {
+        return this.transitionLog.listRecent(typeof scope === "string" ? { kind: "rig", rig: scope } : scope, limit);
+    }
     /** Called by the watchdog engine after the delivery attempt is durably
      *  audited. The queue transition records that attempt independently of
      *  whether the HELD row's owner consumed it. */
@@ -1911,10 +2059,23 @@ export class QueueRepository {
             });
         };
         const usageLimitBlockers = targets.filter(({ qitemId }) => this.getById(qitemId)?.tags?.includes(USAGE_LIMIT_BLOCKER_TAG));
+        // OPR.0.5.8.1 S1b — a park-generated timer is ONE-SHOT. `periodic-reminder`
+        // repeats every intervalSeconds forever, so an unstopped park timer wakes its
+        // owner again at +2 intervals, +3, indefinitely.
+        //
+        // The provider-limit path below already ends its job after firing; that
+        // behaviour is UNCHANGED by this repair and pinned as unchanged. This widens
+        // the same act to ordinary park timers, without their blocker resolution —
+        // resolving the blocker is a provider-limit outcome, not a timer one.
+        const parkGeneratedTimer = targets.some(({ kind }) => kind === "timer");
         const events = this.db.transaction(() => {
             const firedEvents = targets.map(recordFired);
-            if (usageLimitBlockers.length === 0)
+            if (usageLimitBlockers.length === 0) {
+                if (parkGeneratedTimer) {
+                    (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(jobId, "park_timer_fired_once");
+                }
                 return firedEvents;
+            }
             (this.watchdogJobsRepo ?? new WatchdogJobsRepository(this.db)).markTerminal(jobId, "usage_limit_expiry_fired");
             const resolutionEvents = usageLimitBlockers.flatMap(({ qitemId }) => this.updateInTransactionalContext({
                 qitemId,