@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/senses/pipeline.js

@@ -4,79 +4,675 @@
 //   resolve friend -> trust gate -> load session -> drain pending -> runAgent -> postTurn -> token accumulation.
 //
 // Transport-level concerns (BB API calls, Teams cards, readline) stay in sense adapters.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitObligationTransitionEpisodes = emitObligationTransitionEpisodes;
+exports.selectCheckpointCurrentAsk = selectCheckpointCurrentAsk;
 exports.handleInboundTurn = handleInboundTurn;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const runtime_1 = require("../nerves/runtime");
+const commands_1 = require("./commands");
 const continuity_1 = require("./continuity");
 const manager_1 = require("../heart/bridges/manager");
 const identity_1 = require("../heart/identity");
-const tasks_1 = require("../repertoire/tasks");
-const session_activity_1 = require("../heart/session-activity");
+const auth_flow_1 = require("../heart/auth/auth-flow");
 const active_work_1 = require("../heart/active-work");
 const delegation_1 = require("../heart/delegation");
-const target_resolution_1 = require("../heart/target-resolution");
-const thoughts_1 = require("../heart/daemon/thoughts");
-const pending_1 = require("../mind/pending");
-const obligations_1 = require("../heart/obligations");
-function emptyTaskBoard() {
+const obligations_1 = require("../arc/obligations");
+const packets_1 = require("../arc/packets");
+const evolution_1 = require("../arc/evolution");
+const provider_failover_1 = require("../heart/provider-failover");
+const openai_codex_token_1 = require("../heart/providers/openai-codex-token");
+const run_ledger_1 = require("../heart/run-ledger");
+const tempo_1 = require("../heart/tempo");
+const temporal_view_1 = require("../heart/temporal-view");
+const start_of_turn_packet_1 = require("../heart/start-of-turn-packet");
+const bundle_state_1 = require("../heart/bundle-state");
+const sync_1 = require("../heart/sync");
+const agent_discovery_1 = require("../heart/daemon/agent-discovery");
+const sync_health_1 = require("../heart/sync-health");
+const config_1 = require("../heart/config");
+const session_events_1 = require("../heart/session-events");
+const session_activity_1 = require("../heart/session-activity");
+const presence_1 = require("../arc/presence");
+const episodes_1 = require("../arc/episodes");
+const turn_context_1 = require("../heart/turn-context");
+const provider_visibility_1 = require("../heart/provider-visibility");
+const orientation_frame_1 = require("../heart/orientation-frame");
+const flight_recorder_1 = require("../arc/flight-recorder");
+const context_loss_sentinel_1 = require("../heart/context-loss-sentinel");
+const cares_1 = require("../arc/cares");
+const turn_execution_lease_1 = require("../heart/turn-execution-lease");
+const friend_link_codes_1 = require("../mind/friend-link-codes");
+const VOICE_PENDING_MAX_AGE_MS = 15 * 60 * 1_000;
+const TELEGRAM_GENERIC_OUTREACH_PENDING_MAX_AGE_MS = 15 * 60 * 1_000;
+function pendingExpirationReason(channel, message, now, agentName) {
+    /* v8 ignore start -- pending expiry edge permutations are covered by the stale voice queue tests; this helper keeps defensive non-voice fallbacks @preserve */
+    if (Number.isFinite(message.expiresAt) && Number(message.expiresAt) <= now)
+        return "explicit_expiry";
+    if (channel === "telegram"
+        && agentName
+        && message.from === agentName
+        && !message.delegatedFrom
+        && !message.obligationId
+        && !message.requestId
+        && Number.isFinite(message.timestamp)
+        && now - message.timestamp > TELEGRAM_GENERIC_OUTREACH_PENDING_MAX_AGE_MS) {
+        return "telegram_generic_outreach_freshness_window";
+    }
+    if (channel !== "voice")
+        return null;
+    if (!Number.isFinite(message.timestamp))
+        return null;
+    return now - message.timestamp > VOICE_PENDING_MAX_AGE_MS ? "voice_freshness_window" : null;
+    /* v8 ignore stop */
+}
+function archiveExpiredPendingMessages(input) {
+    /* v8 ignore start -- archive path edge cases are defensive filesystem hygiene; stale voice expiry tests cover the normal archive path @preserve */
+    if (input.expired.length === 0)
+        return;
+    const pendingRoot = path.join(input.agentRoot, "state", "pending");
+    const relativePendingDir = path.relative(pendingRoot, input.pendingDir);
+    const archiveDir = relativePendingDir && !relativePendingDir.startsWith("..") && !path.isAbsolute(relativePendingDir)
+        ? path.join(input.agentRoot, "state", "pending-expired", relativePendingDir)
+        : path.join(input.agentRoot, "state", "pending-expired", input.channel);
+    try {
+        fs.mkdirSync(archiveDir, { recursive: true });
+        input.expired.forEach(({ message, reason }, index) => {
+            const stamp = Number.isFinite(message.timestamp) ? message.timestamp : input.now;
+            const filePath = path.join(archiveDir, `${stamp}-${index}.json`);
+            fs.writeFileSync(filePath, `${JSON.stringify({
+                ...message,
+                expiredAt: input.now,
+                expirationReason: reason,
+                originalPendingDir: input.pendingDir,
+            }, null, 2)}\n`, "utf-8");
+        });
+        /* v8 ignore stop */
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.pending_expired",
+            message: "expired stale pending sense messages before model injection",
+            meta: {
+                channel: input.channel,
+                pendingDir: input.pendingDir,
+                archiveDir,
+                count: String(input.expired.length),
+            },
+        });
+    }
+    catch (error) {
+        /* v8 ignore next -- filesystem archive failures are defensive; stale voice expiry success path is covered @preserve */
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.pending_expire_archive_error",
+            message: "failed to archive expired pending sense messages",
+            meta: {
+                channel: input.channel,
+                pendingDir: input.pendingDir,
+                count: String(input.expired.length),
+                error: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+}
+function filterDeliverablePendingMessages(input) {
+    if (input.messages.length === 0)
+        return input.messages;
+    const now = input.now ?? Date.now();
+    const agentName = (() => {
+        try {
+            return (0, identity_1.getAgentName)();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const deliverable = [];
+    const expired = [];
+    for (const message of input.messages) {
+        const reason = pendingExpirationReason(input.channel, message, now, agentName);
+        if (reason) {
+            expired.push({ message, reason });
+        }
+        else {
+            deliverable.push(message);
+        }
+    }
+    if (expired.length > 0) {
+        try {
+            archiveExpiredPendingMessages({ ...input, agentRoot: (0, identity_1.getAgentRoot)(), expired, now });
+        }
+        catch (error) {
+            /* v8 ignore next -- getAgentRoot failure is only reachable under broken runtime identity state @preserve */
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "senses",
+                event: "senses.pending_expire_archive_error",
+                message: "failed to resolve agent root for expired pending sense message archive",
+                meta: {
+                    channel: input.channel,
+                    pendingDir: input.pendingDir,
+                    count: String(expired.length),
+                    error: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+    }
+    return deliverable;
+}
+/**
+ * Emit episodes for obligation state transitions detected during a turn.
+ * Exported for direct testability (avoids v8 coverage merge issues in multi-file test suites).
+ */
+function emitObligationTransitionEpisodes(agentRoot, preTurnObligationIds, postTurnObligations, preTurnObligations) {
+    const postTurnObligationIds = new Set(postTurnObligations.map((ob) => `${ob.id}:${ob.status}`));
+    for (const key of preTurnObligationIds) {
+        if (!postTurnObligationIds.has(key)) {
+            const [obId] = key.split(":");
+            const matchedOb = postTurnObligations.find((ob) => ob.id === obId) ?? preTurnObligations.find((ob) => ob.id === obId);
+            (0, episodes_1.emitEpisode)(agentRoot, {
+                kind: "obligation_shift",
+                summary: `obligation "${matchedOb?.content ?? obId}" status changed`,
+                whyItMattered: "obligation state transition detected during turn",
+                relatedEntities: [`obligation:${obId}`],
+                salience: "medium",
+            });
+        }
+    }
+}
+function providerLaneForChannel(channel) {
+    return channel === "inner" ? "inner" : "outward";
+}
+function latestUserAuthoredText(messages, continuityIngressTexts) {
+    const ingress = continuityIngressTexts?.map((entry) => entry.trim()).filter(Boolean);
+    if (ingress?.length)
+        return ingress[ingress.length - 1];
+    const userMessages = messages
+        .filter((message) => message.role === "user")
+        .map((message) => typeof message.content === "string" ? message.content.trim() : "")
+        .filter(Boolean);
+    return userMessages[userMessages.length - 1];
+}
+function selectCheckpointCurrentAsk(input) {
+    const frameSpeech = input.orientationFrame?.currentUserSpeech
+        .map((speech) => speech.trim())
+        .filter(Boolean)
+        .at(-1) ?? null;
+    if (input.orientationFrame?.speechKind === "reaction")
+        return frameSpeech;
+    const currentUtterance = input.currentUserMessage?.trim();
+    return currentUtterance || frameSpeech;
+}
+function sessionRefForFlightRecorder(session) {
+    return `${session.friendId}/${session.channel}/${session.key}`;
+}
+function isTerminalWithoutContinuation(outcome, hasActiveContinuation) {
+    return !hasActiveContinuation && (outcome === "settled"
+        || outcome === "observed"
+        || outcome === "rested"
+        || outcome === "superseded");
+}
+function selectPostTurnContinuityState(input) {
+    const continuingState = {
+        ...(input.mustResolveBeforeHandoff ? { mustResolveBeforeHandoff: true } : {}),
+        ...(typeof input.lastFriendActivityAt === "string" ? { lastFriendActivityAt: input.lastFriendActivityAt } : {}),
+    };
+    const clearsMustResolveBeforeHandoff = input.outcome === "settled"
+        || input.outcome === "blocked"
+        || input.outcome === "superseded"
+        || input.outcome === "observed";
+    if (!clearsMustResolveBeforeHandoff) {
+        return Object.keys(continuingState).length > 0 ? continuingState : undefined;
+    }
+    return typeof input.lastFriendActivityAt === "string"
+        ? { lastFriendActivityAt: input.lastFriendActivityAt }
+        : undefined;
+}
+function readPostTurnFlightRecorderArcSnapshot(agentRoot) {
+    const latest = (0, flight_recorder_1.readFlightRecorderResume)(agentRoot);
     return {
-        compact: "",
-        full: "",
-        byStatus: {
-            drafting: [],
-            processing: [],
-            validating: [],
-            collaborating: [],
-            paused: [],
-            blocked: [],
-            done: [],
+        activeObligationIds: (0, obligations_1.readPendingObligations)(agentRoot).map((obligation) => obligation.id),
+        activeReturnObligationIds: (0, obligations_1.listActiveReturnObligationsForRoot)(agentRoot).map((obligation) => obligation.id),
+        activePacketIds: (0, packets_1.listActivePonderPackets)(agentRoot).map((packet) => packet.id),
+        openEvolutionCaseIds: (0, evolution_1.listOpenEvolutionCases)(agentRoot).map((evolutionCase) => evolutionCase.id),
+        recentClaimIds: latest.recentClaimIds,
+        unverifiedClaimIds: latest.unverifiedClaimIds,
+    };
+}
+function recordTurnFlightRecorderCheckpoint(input) {
+    const hasActiveContinuation = input.mustResolveBeforeHandoff
+        || input.activeObligationIds.length > 0
+        || input.activeReturnObligationIds.length > 0
+        || input.activePacketIds.length > 0
+        || input.openEvolutionCaseIds.length > 0;
+    const blockedBecause = [
+        ...(input.outcome === "blocked" ? ["agent reported a blocker in this turn"] : []),
+        ...(input.outcome === "errored" ? ["turn errored before a safe continuation was reached"] : []),
+        ...(input.outcome === "aborted" ? ["turn aborted before a safe continuation was reached"] : []),
+        ...(isTerminalWithoutContinuation(input.outcome, hasActiveContinuation) ? [`turn outcome ${input.outcome}; wait for new input before acting`] : []),
+    ];
+    const nextSafeAction = input.nextSafeAction
+        ?? (blockedBecause.length > 0
+            ? "inspect the latest session and wait for new input before acting"
+            : "continue the current held work and update Arc/Desk with the next checkpoint");
+    (0, flight_recorder_1.recordFlightRecorderEvent)(input.agentRoot, {
+        kind: input.sessionPersisted ? "post_turn_persisted" : "blocker_detected",
+        sessionRef: sessionRefForFlightRecorder(input.currentSession),
+        summary: input.sessionPersisted
+            ? `persisted ${input.currentSession.channel}/${input.currentSession.key} turn with outcome ${input.outcome}`
+            : `runAgent threw before session persistence for ${input.currentSession.channel}/${input.currentSession.key}`,
+        currentAsk: input.currentAsk,
+        nextSafeAction,
+        blockedBecause,
+        stopBefore: blockedBecause.length > 0 ? ["acting on stale context"] : [],
+        activeObligationIds: input.activeObligationIds,
+        activeReturnObligationIds: input.activeReturnObligationIds,
+        activePacketIds: input.activePacketIds,
+        openEvolutionCaseIds: input.openEvolutionCaseIds,
+        recentClaimIds: input.recentClaimIds,
+        unverifiedClaimIds: input.unverifiedClaimIds,
+        meta: {
+            outcome: input.outcome,
+            sessionPersisted: input.sessionPersisted,
+            mustResolveBeforeHandoff: input.mustResolveBeforeHandoff,
+            sessionPath: input.currentSession.sessionPath,
+        },
+    });
+}
+async function refreshContextLossSentinelNonFatal(input) {
+    try {
+        await (0, context_loss_sentinel_1.refreshContextLossSentinel)(input.agentName, input.agentRoot, { trigger: input.trigger });
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.context_loss_sentinel_refresh_error",
+            message: `failed to refresh context-loss Sentinel for ${input.trigger}`,
+            meta: {
+                agentName: input.agentName,
+                trigger: input.trigger,
+                error: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+}
+function resolveCurrentFailoverBinding(agentName, lane) {
+    const agentRoot = (0, identity_1.getAgentRoot)();
+    const { config: agentConfig } = (0, auth_flow_1.readAgentConfigForAgent)(agentName, path.dirname(agentRoot));
+    const fallback = lane === "inner" ? agentConfig.agentFacing : agentConfig.humanFacing;
+    return { provider: fallback.provider, model: fallback.model };
+}
+/**
+ * Apply an agent-driven failover switch to agent.json, but only after
+ * re-pinging the candidate. The inventory ping that produced the candidate
+ * may be stale by the time the agent replies — without this preflight, a
+ * "switch to <provider>" reply can move the lane onto an unreachable provider.
+ *
+ * Returns:
+ *   { ok: true }              — preflight passed, state mutated
+ *   { ok: false, refused }    — preflight failed, state untouched, caller should
+ *                                surface the refusal to the agent
+ * Throws on disk errors only (caught by caller as before).
+ */
+async function writeFailoverAgentConfigSwitch(agentName, action) {
+    const validation = await (0, provider_failover_1.validateFailoverSwitchCandidate)(agentName, { provider: action.provider, model: action.model });
+    if (!validation.ok) {
+        return { ok: false, refused: true, classification: validation.classification, message: validation.message };
+    }
+    const agentRoot = (0, identity_1.getAgentRoot)();
+    const { configPath, config } = (0, auth_flow_1.readAgentConfigForAgent)(agentName, path.dirname(agentRoot));
+    const facingKey = action.lane === "inner" ? "agentFacing" : "humanFacing";
+    const nextConfig = {
+        ...config,
+        [facingKey]: {
+            ...config[facingKey],
+            provider: action.provider,
+            model: action.model,
         },
-        actionRequired: [],
-        unresolvedDependencies: [],
-        activeSessions: [],
-        activeBridges: [],
     };
+    fs.writeFileSync(configPath, `${JSON.stringify(nextConfig, null, 2)}\n`, "utf-8");
+    return { ok: true };
+}
+function formatFailoverSwitchLabel(action) {
+    const provenance = (0, provider_failover_1.formatCredentialProvenanceLabel)(action);
+    return `${action.provider} (${action.model}${provenance ? `; ${provenance}` : ""})`;
+}
+/**
+ * Build the operational refusal context message handed back to the agent when
+ * a failover switch is rejected by the preflight ping. Field-tested format:
+ * lead with the refusal + reason, restate the lane that's still standing, then
+ * list remaining ready alternatives so the next turn doesn't have to re-enter
+ * discovery mode.
+ */
+function buildFailoverSwitchRefusedMessage(pendingContext, refusedAction, refusal) {
+    const refusedLabel = formatFailoverSwitchLabel(refusedAction);
+    const remaining = pendingContext.readyProviders.filter((candidate) => candidate.provider !== refusedAction.provider);
+    const alternativesLine = remaining.length > 0
+        ? `available verified alternatives right now: ${remaining.map((c) => `${c.provider} (${c.model})`).join(", ")}.`
+        : "no other verified alternatives are ready right now.";
+    const nextMove = remaining.length > 0
+        ? `next move: reply "switch to <provider>" picking one of the alternatives above, or tell the user you cannot continue and why.`
+        : `next move: ask the operator to repair credentials for ${refusedAction.provider} (or another provider), or tell the user you cannot continue and why.`;
+    return [
+        `[provider switch refused: tried to switch ${refusedAction.lane} lane to ${refusedLabel}.`,
+        `reason: preflight ping failed (${refusal.classification}: ${refusal.message}).`,
+        `current lane unchanged: ${pendingContext.currentProvider} / ${pendingContext.currentModel} on the ${pendingContext.currentLane} lane.`,
+        alternativesLine,
+        nextMove + "]",
+    ].join(" ");
+}
+function prependTurnSections(message, sections) {
+    /* v8 ignore next -- defensive: only user messages with non-empty sections reach here @preserve */
+    if (message.role !== "user" || sections.length === 0)
+        return message;
+    const prefix = sections.join("\n\n");
+    /* v8 ignore start -- defensive: multipart content branch; non-string user messages are rare @preserve */
+    if (typeof message.content === "string") {
+        return {
+            ...message,
+            content: `${prefix}\n\n${message.content}`,
+        };
+    }
+    return {
+        ...message,
+        content: [
+            { type: "text", text: `${prefix}\n\n` },
+            ...message.content,
+        ],
+    };
+    /* v8 ignore stop */
+}
+// ── Pipeline ──────────────────────────────────────────────────────
+let _lastSessionKey = null;
+function runAgentOptionContextPacketIds(options) {
+    return Array.isArray(options.contextPacketIds) ? options.contextPacketIds : [];
+}
+function mergeRunAgentContextPacketIds(left, right) {
+    const merged = [
+        ...(Array.isArray(left) ? left : []),
+        ...(Array.isArray(right) ? right : []),
+    ].filter((value) => typeof value === "string" && value.trim().length > 0);
+    return merged.length > 0 ? [...new Set(merged)] : undefined;
+}
+function mergePreparedRunAgentOptions(base, prepared) {
+    if (!prepared)
+        return base;
+    const contextPacketIds = mergeRunAgentContextPacketIds(base.contextPacketIds, prepared.contextPacketIds);
+    const { contextPacketIds: _baseContextPacketIds, ...baseOptions } = base;
+    const { contextPacketIds: _preparedContextPacketIds, ...preparedOptions } = prepared;
+    const merged = {
+        ...baseOptions,
+        ...preparedOptions,
+        ...(contextPacketIds ? { contextPacketIds } : {}),
+    };
+    if (prepared.toolContext) {
+        const toolContext = {
+            ...base.toolContext,
+            ...prepared.toolContext,
+        };
+        merged.toolContext = {
+            ...toolContext,
+            signin: toolContext.signin ?? (async () => undefined),
+        };
+    }
+    return merged;
 }
-function readInnerWorkState() {
-    const defaultJob = {
-        status: "idle",
-        content: null,
-        origin: null,
-        mode: "reflect",
-        obligationStatus: null,
-        surfacedResult: null,
-        queuedAt: null,
-        startedAt: null,
-        surfacedAt: null,
+function buildInboundRunLedgerInput(input) {
+    const target = {
+        channel: input.channel,
+        senseType: input.senseType,
+        sessionKey: input.sessionKey,
+        sessionPath: input.sessionPath,
+        friendId: input.friendId,
+        currentUserHash: input.currentUserMessage ? (0, run_ledger_1.runLedgerHash)(input.currentUserMessage) : null,
+        traceId: input.runAgentOptions.traceId ?? null,
+    };
+    return {
+        agent: input.agentName,
+        triggerType: "inbound",
+        sourceKind: "sense",
+        senseOrHabit: String(input.channel),
+        startedAt: input.startedAt,
+        target,
+        idempotencyScope: {
+            channel: input.channel,
+            sessionKey: input.sessionKey,
+            friendId: input.friendId,
+            currentUserHash: target.currentUserHash,
+            traceId: input.runAgentOptions.traceId ?? null,
+        },
+        provider: "unknown",
+        model: "unknown",
+        sessionRef: {
+            channel: String(input.channel),
+            keyHash: (0, run_ledger_1.runLedgerHash)(input.sessionKey),
+        },
+        contextPacketIds: runAgentOptionContextPacketIds(input.runAgentOptions),
     };
+}
+function prepareInboundRunLedger(input) {
     try {
-        const agentRoot = (0, identity_1.getAgentRoot)();
-        const pendingDir = (0, pending_1.getInnerDialogPendingDir)((0, identity_1.getAgentName)());
-        const sessionPath = (0, thoughts_1.getInnerDialogSessionPath)(agentRoot);
-        const { pendingMessages, turns, runtimeState } = (0, thoughts_1.readInnerDialogRawData)(sessionPath, pendingDir);
-        const dialogStatus = (0, thoughts_1.deriveInnerDialogStatus)(pendingMessages, turns, runtimeState);
-        const job = (0, thoughts_1.deriveInnerJob)(pendingMessages, turns, runtimeState);
-        // Derive obligationPending from both the pending message field and the obligation store
-        const storeObligationPending = (0, obligations_1.readPendingObligations)(agentRoot).length > 0;
         return {
-            status: dialogStatus.processing === "started" ? "running" : "idle",
-            hasPending: dialogStatus.queue !== "clear",
-            origin: dialogStatus.origin,
-            contentSnippet: dialogStatus.contentSnippet,
-            obligationPending: dialogStatus.obligationPending || storeObligationPending,
-            job,
+            agentRoot: (0, identity_1.getAgentRoot)(),
+            recordInput: buildInboundRunLedgerInput({
+                ...input,
+                agentName: (0, identity_1.getAgentName)(),
+            }),
         };
     }
     catch {
-        return {
-            status: "idle",
-            hasPending: false,
-            job: defaultJob,
-        };
+        return null;
     }
 }
-// ── Pipeline ──────────────────────────────────────────────────────
 async function handleInboundTurn(input) {
+    return (0, turn_execution_lease_1.withTurnExecutionLease)(() => handleInboundTurnExclusive(input));
+}
+async function handleInboundTurnExclusive(input) {
+    // Continuity resumption is structured caller intent. Never infer it from the
+    // current message or from similarity to prior obligations.
+    const resumePriorWork = input.runAgentOptions?.resumePriorWork === true;
+    // Reset session-scoped state when the session changes
+    const sessionKey = `${input.channel}/${input.sessionKey ?? "session"}`;
+    if (sessionKey !== _lastSessionKey) {
+        _lastSessionKey = sessionKey;
+        // Reset file-state cache and scrutiny tracking for the new session
+        const { fileStateCache } = await Promise.resolve().then(() => __importStar(require("../mind/file-state")));
+        const { resetSessionModifiedFiles } = await Promise.resolve().then(() => __importStar(require("../mind/scrutiny")));
+        fileStateCache.clear();
+        resetSessionModifiedFiles();
+    }
+    // Step 0: Check for pending failover reply
+    if (input.failoverState?.pending) {
+        const userText = input.messages
+            .filter((m) => m.role === "user")
+            .map((m) => typeof m.content === "string" ? m.content : /* v8 ignore next -- defensive: multipart content fallback @preserve */ "")
+            .join(" ")
+            .trim();
+        const pendingContext = input.failoverState.pending;
+        const failoverAction = (0, provider_failover_1.handleFailoverReply)(userText, pendingContext);
+        const failoverAgentName = pendingContext.agentName;
+        input.failoverState.pending = null; // always clear before acting
+        if (failoverAction.action === "switch") {
+            let switchOutcome = null;
+            try {
+                switchOutcome = await writeFailoverAgentConfigSwitch(failoverAgentName, failoverAction);
+                /* v8 ignore start -- defensive: write failure during provider switch @preserve */
+            }
+            catch (switchError) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "senses",
+                    event: "senses.failover_switch_error",
+                    message: `failed to switch ${failoverAction.lane} provider lane to ${failoverAction.provider}`,
+                    meta: { agentName: failoverAgentName, lane: failoverAction.lane, provider: failoverAction.provider, model: failoverAction.model, error: switchError instanceof Error ? switchError.message : String(switchError) },
+                });
+            }
+            /* v8 ignore stop */
+            if (switchOutcome?.ok) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "senses",
+                    event: "senses.failover_switch",
+                    message: `switched ${failoverAction.lane} provider lane to ${failoverAction.provider} via failover`,
+                    meta: {
+                        agentName: failoverAgentName,
+                        lane: failoverAction.lane,
+                        provider: failoverAction.provider,
+                        model: failoverAction.model,
+                        credentialRevision: failoverAction.credentialRevision,
+                        source: failoverAction.source,
+                    },
+                });
+                // Replace "switch to <provider>" with a context message for the agent.
+                // The session already has the user's original question from the failed turn.
+                // The agent needs to know what happened so it can respond appropriately.
+                const newProviderLabel = formatFailoverSwitchLabel(failoverAction);
+                input.messages = [{
+                        role: "user",
+                        content: `[provider switch: ${pendingContext.errorSummary}. switched ${failoverAction.lane} lane to ${newProviderLabel}. your conversation history is intact — respond to the user's last message.]`,
+                    }];
+                input.switchedProvider = failoverAction.provider;
+            }
+            else if (switchOutcome && !switchOutcome.ok) {
+                // Preflight refused the switch — the candidate provider is not actually
+                // reachable right now. Keep the existing lane intact and tell the agent
+                // what happened so it can pick something else next turn.
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "senses",
+                    event: "senses.failover_switch_refused",
+                    message: `refused failover switch of ${failoverAction.lane} lane to ${failoverAction.provider}: ${switchOutcome.message}`,
+                    meta: {
+                        agentName: failoverAgentName,
+                        lane: failoverAction.lane,
+                        provider: failoverAction.provider,
+                        model: failoverAction.model,
+                        classification: switchOutcome.classification,
+                        error: switchOutcome.message,
+                    },
+                });
+                input.messages = [{
+                        role: "user",
+                        content: buildFailoverSwitchRefusedMessage(pendingContext, failoverAction, switchOutcome),
+                    }];
+            }
+            // Switch failed OR succeeded — either way, fall through to normal processing.
+        }
+        else if (failoverAction.action === "refresh") {
+            const refresh = failoverAction.provider === "openai-codex"
+                ? await (0, openai_codex_token_1.refreshOpenAICodexProviderCredentials)(failoverAgentName, {
+                    force: true,
+                    reason: "failover-reply",
+                })
+                : { ok: false, actor: "human-required", message: `provider ${failoverAction.provider} does not support chat-driven refresh` };
+            if (refresh.ok) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "senses",
+                    event: "senses.failover_refresh",
+                    message: `refreshed ${failoverAction.provider} provider credentials via failover`,
+                    meta: {
+                        agentName: failoverAgentName,
+                        lane: failoverAction.lane,
+                        provider: failoverAction.provider,
+                        refreshed: refresh.refreshed,
+                    },
+                });
+                input.messages = [{
+                        role: "user",
+                        content: `[provider refresh: ${pendingContext.errorSummary}. refreshed ${failoverAction.provider} credentials for the ${failoverAction.lane} lane. your conversation history is intact — respond to the user's last message.]`,
+                    }];
+            }
+            else {
+                (0, runtime_1.emitNervesEvent)({
+                    level: refresh.actor === "human-required" ? "warn" : "error",
+                    component: "senses",
+                    event: "senses.failover_refresh_error",
+                    message: `failed to refresh ${failoverAction.provider} provider credentials via failover`,
+                    meta: {
+                        agentName: failoverAgentName,
+                        lane: failoverAction.lane,
+                        provider: failoverAction.provider,
+                        actor: refresh.actor,
+                        error: refresh.message,
+                    },
+                });
+                input.messages = [{
+                        role: "user",
+                        content: `[provider refresh failed: tried to refresh ${failoverAction.provider} for the ${failoverAction.lane} lane. actor: ${refresh.actor}. reason: ${refresh.message}. current lane unchanged: ${pendingContext.currentProvider} / ${pendingContext.currentModel}. If ready alternatives are listed in the prior failover message, switch to one; otherwise tell the user the concrete human-required auth step.]`,
+                    }];
+            }
+        }
+    }
+    const firstUserMsg = input.messages.find((m) => m.role === "user");
+    const userText = firstUserMsg
+        ? (typeof firstUserMsg.content === "string"
+            ? firstUserMsg.content
+            : Array.isArray(firstUserMsg.content)
+                ? firstUserMsg.content.find((p) => p.type === "text")?.text ?? ""
+                : /* v8 ignore next -- defensive: content is always string or array @preserve */ "")
+        : "";
+    // Step 0b: Slash command interception (before friend resolution / agent turn)
+    {
+        const parsed = (0, commands_1.parseSlashCommand)(userText);
+        if (parsed) {
+            const registry = (0, commands_1.getSharedCommandRegistry)();
+            const dispatchResult = registry.dispatch(parsed.command, { channel: input.channel });
+            if (dispatchResult.handled && dispatchResult.result) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "senses",
+                    event: "senses.pipeline_command",
+                    message: `slash command intercepted: /${parsed.command}`,
+                    meta: { command: parsed.command, channel: input.channel },
+                });
+                if (dispatchResult.result.message) {
+                    input.callbacks.onTextChunk(dispatchResult.result.message);
+                }
+                // Return a minimal result — no agent turn, no session write
+                const resolvedContext = await input.friendResolver.resolve();
+                return {
+                    resolvedContext,
+                    gateResult: { allowed: true },
+                    turnOutcome: "command",
+                    commandAction: dispatchResult.result.action,
+                };
+            }
+        }
+    }
     // Step 1: Resolve friend
     const resolvedContext = await input.friendResolver.resolve();
     (0, runtime_1.emitNervesEvent)({
@@ -89,6 +685,27 @@ async function handleInboundTurn(input) {
             senseType: input.capabilities.senseType,
         },
     });
+    // Step 1b: Identity link code. Runs before the trust gate so an identity the agent
+    // does not trust yet can prove it belongs to someone it does. Never a model turn.
+    if (input.channel !== "inner" && (0, friend_link_codes_1.parseLinkCode)(userText)) {
+        const agentRoot = (0, identity_1.getAgentRoot)();
+        const redemption = (await (0, friend_link_codes_1.redeemLinkCode)({
+            agentRoot,
+            friendsDir: path.join(agentRoot, "friends"),
+            store: input.friendStore,
+            text: userText,
+            claimant: resolvedContext.friend,
+            channel: input.channel,
+            isGroupChat: input.isGroupChat ?? false,
+        }));
+        input.callbacks.onTextChunk(redemption.reply);
+        return {
+            resolvedContext: redemption.status === "linked" ? { ...resolvedContext, friend: redemption.friend } : resolvedContext,
+            gateResult: { allowed: true },
+            turnOutcome: "command",
+            commandAction: "response",
+        };
+    }
     // Step 2: Trust gate
     const gateInput = {
         friend: resolvedContext.friend,
@@ -121,7 +738,11 @@ async function handleInboundTurn(input) {
     }
     // Step 3: Load/create session
     const session = await input.sessionLoader.loadOrCreate();
+    if (input.sessionTurnLease && path.resolve(session.sessionPath) !== input.sessionTurnLease.sessionPath) {
+        throw new Error(`leased session path mismatch: expected ${input.sessionTurnLease.sessionPath}, loaded ${path.resolve(session.sessionPath)}`);
+    }
     const sessionMessages = session.messages;
+    const sessionEvents = session.events ?? [];
     let mustResolveBeforeHandoff = (0, continuity_1.resolveMustResolveBeforeHandoff)(session.state?.mustResolveBeforeHandoff === true, input.continuityIngressTexts);
     const lastFriendActivityAt = input.channel === "inner"
         ? session.state?.lastFriendActivityAt
@@ -136,172 +757,505 @@ async function handleInboundTurn(input) {
         key: input.sessionKey ?? "session",
         sessionPath: session.sessionPath,
     };
-    const activeBridges = (0, manager_1.createBridgeManager)().findBridgesForSession({
-        friendId: currentSession.friendId,
-        channel: currentSession.channel,
-        key: currentSession.key,
-    });
-    const bridgeContext = (0, manager_1.formatBridgeContext)(activeBridges) || undefined;
-    let sessionActivity = [];
+    const currentSessionTiming = (0, session_events_1.describeCurrentSessionTiming)(sessionEvents);
+    // Step 3b: Pre-turn sync pull (opt-in) — MUST happen before any continuity state reads
+    // so that obligations, episodes, cares, etc. reflect the latest remote state.
+    let syncFailure;
+    let syncConfig = { enabled: false, remote: "origin" };
+    const liveLatencyMode = input.latencyMode === "live";
+    let declinedForHome = false;
     try {
-        const agentRoot = (0, identity_1.getAgentRoot)();
-        sessionActivity = (0, session_activity_1.listSessionActivity)({
-            sessionsDir: `${agentRoot}/state/sessions`,
-            friendsDir: `${agentRoot}/friends`,
-            agentName: (0, identity_1.getAgentName)(),
-            currentSession: {
-                friendId: currentSession.friendId,
-                channel: currentSession.channel,
-                key: currentSession.key,
-            },
-        });
-    }
-    catch {
-        sessionActivity = [];
+        syncConfig = (0, config_1.getSyncConfig)();
     }
-    let targetCandidates = [];
+    catch { /* config not available */ }
+    // Wrap the turn body in try/finally so postTurnPush always runs — even on
+    // error or early-return failover paths.
     try {
-        if (input.channel !== "inner") {
+        /* v8 ignore start -- sync-enabled branches tested in sync.test.ts, pipeline tests mock at module boundary @preserve */
+        if (syncConfig.enabled && !liveLatencyMode) {
+            const pullResult = (0, sync_1.preTurnPull)((0, identity_1.getAgentRoot)(), syncConfig);
+            if (!pullResult.ok) {
+                syncFailure = pullResult.error;
+            }
+            // Check for pending-sync from a prior failed push. The record stays
+            // until a sync succeeds, so every turn sees a failure that persists.
+            if (!syncFailure) {
+                const pendingSyncPath = path.join((0, identity_1.getAgentRoot)(), "state", "pending-sync.json");
+                try {
+                    if (fs.existsSync(pendingSyncPath)) {
+                        const failure = (0, sync_health_1.parseBundleSyncFailure)(JSON.parse(fs.readFileSync(pendingSyncPath, "utf-8")));
+                        syncFailure = failure
+                            ? `bundle ${(0, sync_health_1.describeSyncFailure)(failure)}`
+                            : "bundle sync failed earlier; state/pending-sync.json is unreadable";
+                    }
+                }
+                catch {
+                    // Ignore read errors for pending-sync
+                }
+            }
+        }
+        /* v8 ignore stop */
+        // Each agent runs on one machine. If the (just pulled) lease names another
+        // machine, this machine must not act for the agent, even before its daemon
+        // has noticed and stopped it. Nothing is written, so nothing is pushed.
+        // Leases travel only through bundle sync, so only synced bundles can move.
+        const homeElsewhere = syncConfig.enabled ? (0, agent_discovery_1.readAgentHomeElsewhere)((0, identity_1.getAgentRoot)()) : null;
+        if (homeElsewhere) {
+            declinedForHome = true;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "senses",
+                event: "senses.turn_declined_homed_elsewhere",
+                message: "declined a turn for an agent homed on another machine",
+                meta: { channel: input.channel, homeMachineId: homeElsewhere.machineId, homeMachineName: homeElsewhere.machineName },
+            });
+            return { resolvedContext, gateResult };
+        }
+        // Build the turn context snapshot — centralizes all state reads
+        const ctx = await (0, turn_context_1.buildTurnContext)({
+            currentSession,
+            channel: input.channel,
+            friendStore: input.friendStore,
+            includeAmbientBackgroundDiscovery: !liveLatencyMode,
+        });
+        // Propagate sync failure from pre-turn pull
+        ctx.syncFailure = syncFailure;
+        const { activeBridges, sessionActivity, pendingObligations, codingSessions, otherCodingSessions, backgroundOperations } = ctx;
+        const bridgeContext = (0, manager_1.formatBridgeContext)(activeBridges) || undefined;
+        const activeWorkFrame = (0, active_work_1.buildActiveWorkFrame)({
+            currentSession,
+            currentObligation,
+            mustResolveBeforeHandoff,
+            inner: ctx.innerWorkState,
+            bridges: activeBridges,
+            codingSessions,
+            backgroundOperations,
+            otherCodingSessions,
+            pendingObligations,
+            friendActivity: sessionActivity,
+            targetCandidates: ctx.targetCandidates,
+            innerReturnObligations: ctx.returnObligations,
+        });
+        const friendContactTiming = (0, session_activity_1.describeSessionActivityTiming)((0, session_activity_1.selectFreshestFriendFacingActivity)(sessionActivity), { prefix: "freshest friend-facing contact" });
+        const delegationDecision = (0, delegation_1.decideDelegation)({
+            channel: input.channel,
+            ingressTexts: input.continuityIngressTexts ?? [],
+            activeWork: activeWorkFrame,
+            mustResolveBeforeHandoff,
+        });
+        // Step 4: Drain deferred friend returns, then ordinary per-session pending.
+        const deferredReturns = input.channel === "inner"
+            ? []
+            : (input.drainDeferredReturns?.(resolvedContext.friend.id) ?? []);
+        const sessionPending = input.drainPending(input.pendingDir);
+        const pending = filterDeliverablePendingMessages({
+            pendingDir: input.pendingDir,
+            channel: input.channel,
+            messages: [...deferredReturns, ...sessionPending],
+        });
+        const promotedPendingUserMessages = input.channel === "inner"
+            ? pending
+                .filter((message) => message.from === "ouro-cli" && message.content.trim().length > 0)
+                .map((message) => ({ role: "user", content: message.content }))
+            : [];
+        const backgroundPendingMessages = promotedPendingUserMessages.length > 0
+            ? pending.filter((message) => message.from !== "ouro-cli")
+            : pending;
+        // Assemble messages: session messages + pending + inbound user messages
+        // NOTE: live world-state checkpoint and pending messages are rendered via buildSystem (system prompt sections)
+        const extraPrefixSections = input.onPendingDrained?.(pending) ?? [];
+        // extraPrefixSections from onPendingDrained still prepend to user message (e.g., private-runtime wakes)
+        if (extraPrefixSections.length > 0 && input.messages.length > 0) {
+            input.messages[0] = prependTurnSections(input.messages[0], extraPrefixSections);
+        }
+        // Append user messages from the inbound turn
+        for (const msg of [...input.messages, ...promotedPendingUserMessages]) {
+            (0, session_events_1.stampIngressTime)(msg);
+            sessionMessages.push(msg);
+        }
+        const currentUserMessages = [...input.messages, ...promotedPendingUserMessages].filter((message) => message.role === "user");
+        const orientationFrame = input.runAgentOptions?.orientationFrame
+            ?? (currentUserMessages.length > 0
+                ? (0, orientation_frame_1.buildOrientationFrame)({
+                    channel: input.channel,
+                    messages: sessionMessages,
+                    currentUserMessages,
+                    structuredOutputs: session.structuredOutputs ?? [],
+                })
+                : undefined);
+        // Step 4b: Continuity pipeline — derive tempo, build start-of-turn packet, snapshot obligations
+        let renderedStartOfTurnPacket;
+        const careEvidenceNow = Date.now();
+        const activeCaresSnapshot = ctx.activeCares;
+        const preTurnObligationIds = new Set(pendingObligations.map((ob) => `${ob.id}:${ob.status}`));
+        try {
             const agentRoot = (0, identity_1.getAgentRoot)();
-            targetCandidates = await (0, target_resolution_1.listTargetSessionCandidates)({
-                sessionsDir: `${agentRoot}/state/sessions`,
-                friendsDir: `${agentRoot}/friends`,
-                agentName: (0, identity_1.getAgentName)(),
-                currentSession: {
-                    friendId: currentSession.friendId,
-                    channel: currentSession.channel,
-                    key: currentSession.key,
+            const agentName = (0, identity_1.getAgentName)();
+            const { recentEpisodes } = ctx;
+            const projectedCares = activeCaresSnapshot.map((care) => (0, cares_1.projectCareEvidence)(care, careEvidenceNow));
+            const tempoState = (0, tempo_1.deriveTempo)({
+                activeSessions: sessionActivity.length + 1,
+                openObligations: pendingObligations.length,
+                recentEpisodeCount: recentEpisodes.length,
+                lastActivityAgeMs: sessionActivity.length > 0
+                    ? Date.now() - new Date(sessionActivity[0].lastActivityAt).getTime()
+                    : 0,
+                hasBlockers: false, // obligations use specific statuses, not "blocked"
+                highSalienceEpisodes: recentEpisodes.filter((ep) => ep.salience === "high" || ep.salience === "critical").length,
+                activeCareCount: activeCaresSnapshot.length,
+                atRiskCareCount: projectedCares.filter((care) => !("recheckRequired" in care) && care.currentRisk != null).length,
+            });
+            const temporalView = (0, temporal_view_1.buildTemporalView)(agentRoot, {
+                tempo: tempoState.mode,
+                preloaded: {
+                    recentEpisodes,
+                    activeObligations: pendingObligations,
+                    activeCares: activeCaresSnapshot,
                 },
-                friendStore: input.friendStore,
             });
+            const startOfTurnPacket = (0, start_of_turn_packet_1.buildStartOfTurnPacket)(temporalView, {
+                canonicalObligations: {
+                    primary: activeWorkFrame.primaryObligation,
+                    all: activeWorkFrame.pendingObligations,
+                },
+                currentSessionTiming,
+                friendContactTiming,
+                flightRecorderResume: ctx.flightRecorderResume,
+                recoverySentinel: ctx.recoverySentinel,
+                careEvidenceNow,
+            });
+            /* v8 ignore next 3 -- syncFailure propagation tested in sync.test.ts @preserve */
+            if (syncFailure) {
+                startOfTurnPacket.syncFailure = syncFailure;
+            }
+            if (ctx.providerVisibility) {
+                startOfTurnPacket.providerSelection = (0, provider_visibility_1.formatAgentProviderVisibilityForStartOfTurn)(ctx.providerVisibility);
+            }
+            // Structured bundle state detection — surfaces discrete issues the
+            // agent can remediate via the bundle_* tools. Runs independently of
+            // syncFailure so the two signals coexist during the transition away
+            // from the legacy free-form syncFailure string. Always assigned; the
+            // packet renderer's empty-filter handles the empty-array case without
+            // a separate branch here.
+            startOfTurnPacket.bundleState = (0, bundle_state_1.detectBundleState)(agentRoot);
+            const capabilities = (0, start_of_turn_packet_1.buildCapabilitiesSection)(agentRoot);
+            if (capabilities) {
+                startOfTurnPacket.capabilities = capabilities;
+            }
+            renderedStartOfTurnPacket = (0, start_of_turn_packet_1.renderStartOfTurnPacket)(startOfTurnPacket, { resumePriorWork });
+            if (!renderedStartOfTurnPacket)
+                renderedStartOfTurnPacket = undefined;
+            // Update self-presence
+            const presence = (0, presence_1.derivePresence)(agentRoot, agentName, {
+                activeSessions: sessionActivity.length + 1,
+                openObligations: pendingObligations.length,
+                activeBridges: activeBridges.length,
+                codingLanes: codingSessions.length,
+                currentTempo: tempoState.mode,
+            });
+            (0, presence_1.writePresence)(agentRoot, agentName, presence);
         }
-    }
-    catch {
-        targetCandidates = [];
-    }
-    let pendingObligations = [];
-    try {
-        pendingObligations = (0, obligations_1.readPendingObligations)((0, identity_1.getAgentRoot)());
-    }
-    catch {
-        pendingObligations = [];
-    }
-    const activeWorkFrame = (0, active_work_1.buildActiveWorkFrame)({
-        currentSession,
-        currentObligation,
-        mustResolveBeforeHandoff,
-        inner: readInnerWorkState(),
-        bridges: activeBridges,
-        pendingObligations,
-        taskBoard: (() => {
+        catch (continuityError) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "senses",
+                event: "senses.continuity_error",
+                message: "continuity pipeline failed, continuing without start-of-turn packet",
+                meta: { error: continuityError instanceof Error ? continuityError.message : String(continuityError) },
+            });
+        }
+        // Step 5: runAgent
+        const existingToolContext = input.runAgentOptions?.toolContext;
+        const promotedCurrentUserMessage = latestUserAuthoredText(promotedPendingUserMessages, undefined);
+        const currentUserMessage = promotedCurrentUserMessage
+            ?? existingToolContext?.currentUserMessage
+            ?? latestUserAuthoredText([...input.messages, ...promotedPendingUserMessages], input.continuityIngressTexts);
+        let runAgentOptions = {
+            ...input.runAgentOptions,
+            resumePriorWork,
+            ...(orientationFrame ? { orientationFrame } : {}),
+            ...(liveLatencyMode ? { skipKeptNotes: true } : {}),
+            bridgeContext,
+            activeWorkFrame,
+            delegationDecision,
+            startOfTurnPacket: renderedStartOfTurnPacket,
+            pendingMessages: backgroundPendingMessages.length > 0 ? backgroundPendingMessages.map((msg) => ({ from: msg.from, content: msg.content })) : undefined,
+            currentSessionKey: currentSession.key,
+            currentObligation,
+            mustResolveBeforeHandoff,
+            setMustResolveBeforeHandoff: (value) => {
+                mustResolveBeforeHandoff = value;
+            },
+            // Pre-read state from TurnContext for prompt assembly
+            daemonRunning: ctx.daemonRunning,
+            senseStatusLines: ctx.senseStatusLines,
+            bundleMeta: ctx.bundleMeta,
+            daemonHealth: ctx.daemonHealth,
+            flightRecorderResume: ctx.flightRecorderResume,
+            ...(ctx.providerVisibility ? { providerVisibility: ctx.providerVisibility } : {}),
+            toolContext: {
+                /* v8 ignore next -- default no-op signin satisfies interface; real signin injected by sense adapter @preserve */
+                signin: async () => undefined,
+                ...existingToolContext,
+                ...(currentUserMessage ? { currentUserMessage } : {}),
+                context: resolvedContext,
+                friendStore: input.friendStore,
+                currentSession,
+                activeBridges,
+                ...(orientationFrame ? { orientationFrame } : {}),
+            },
+        };
+        runAgentOptions = mergePreparedRunAgentOptions(runAgentOptions, await input.prepareRunAgentOptions?.({
+            messages: sessionMessages,
+            currentUserMessages,
+            resolvedContext,
+            runAgentOptions,
+            activeCares: activeCaresSnapshot,
+            careEvidenceNow,
+        }));
+        const checkpointCurrentAsk = selectCheckpointCurrentAsk({
+            currentUserMessage: runAgentOptions.toolContext?.currentUserMessage ?? currentUserMessage,
+            orientationFrame: runAgentOptions.orientationFrame,
+        });
+        const runLedger = prepareInboundRunLedger({
+            channel: input.channel,
+            senseType: input.capabilities.senseType,
+            sessionKey: currentSession.key,
+            sessionPath: session.sessionPath,
+            friendId: resolvedContext.friend.id,
+            currentUserMessage,
+            startedAt: new Date().toISOString(),
+            runAgentOptions,
+        });
+        if (runLedger)
+            (0, run_ledger_1.appendRunLedgerRecordNonFatal)(runLedger.agentRoot, (0, run_ledger_1.createRunLedgerRecord)({
+                ...runLedger.recordInput,
+                lifecycle: "started",
+            }));
+        let result;
+        try {
+            result = await input.runAgent(sessionMessages, input.callbacks, input.channel, input.signal, runAgentOptions);
+        }
+        catch (error) {
+            if (runLedger)
+                (0, run_ledger_1.appendRunLedgerRecordNonFatal)(runLedger.agentRoot, (0, run_ledger_1.createRunLedgerRecord)({
+                    ...runLedger.recordInput,
+                    lifecycle: "error",
+                    endedAt: new Date().toISOString(),
+                    usage: (0, run_ledger_1.usageMetadataFromUsageData)(undefined, "reported-unavailable"),
+                    errorName: error instanceof Error ? error.name : "NonErrorThrown",
+                }));
             try {
-                return (0, tasks_1.getTaskModule)().getBoard();
+                const agentRoot = (0, identity_1.getAgentRoot)();
+                const postTurnArc = readPostTurnFlightRecorderArcSnapshot(agentRoot);
+                recordTurnFlightRecorderCheckpoint({
+                    agentRoot,
+                    currentSession,
+                    currentAsk: checkpointCurrentAsk,
+                    nextSafeAction: activeWorkFrame.resumeHandle?.nextAction
+                        ?? activeWorkFrame.primaryObligation?.nextAction?.trim()
+                        ?? null,
+                    outcome: "errored",
+                    sessionPersisted: false,
+                    mustResolveBeforeHandoff,
+                    activeObligationIds: postTurnArc.activeObligationIds,
+                    activeReturnObligationIds: postTurnArc.activeReturnObligationIds,
+                    activePacketIds: postTurnArc.activePacketIds,
+                    openEvolutionCaseIds: postTurnArc.openEvolutionCaseIds,
+                    recentClaimIds: postTurnArc.recentClaimIds,
+                    unverifiedClaimIds: postTurnArc.unverifiedClaimIds,
+                });
+                await refreshContextLossSentinelNonFatal({ agentName: (0, identity_1.getAgentName)(), agentRoot, trigger: "post_turn" });
             }
-            catch {
-                return emptyTaskBoard();
+            catch (checkpointError) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "senses",
+                    event: "senses.flight_recorder_checkpoint_error",
+                    message: "failed to record thrown-turn flight recorder checkpoint",
+                    meta: { error: checkpointError instanceof Error ? checkpointError.message : String(checkpointError) },
+                });
             }
-        })(),
-        friendActivity: sessionActivity,
-        targetCandidates,
-    });
-    const delegationDecision = (0, delegation_1.decideDelegation)({
-        channel: input.channel,
-        ingressTexts: input.continuityIngressTexts ?? [],
-        activeWork: activeWorkFrame,
-        mustResolveBeforeHandoff,
-    });
-    // Step 4: Drain deferred friend returns, then ordinary per-session pending.
-    const deferredReturns = input.channel === "inner"
-        ? []
-        : (input.drainDeferredReturns?.(resolvedContext.friend.id) ?? []);
-    const sessionPending = input.drainPending(input.pendingDir);
-    const pending = [...deferredReturns, ...sessionPending];
-    // Assemble messages: session messages + pending (formatted) + inbound user messages
-    if (pending.length > 0) {
-        // Format pending messages and prepend to the user content
-        const pendingSection = pending
-            .map((msg) => `[pending from ${msg.from}]: ${msg.content}`)
-            .join("\n");
-        // If there are inbound user messages, prepend pending to the first one
-        if (input.messages.length > 0) {
-            const firstMsg = input.messages[0];
-            if (firstMsg.role === "user") {
-                if (typeof firstMsg.content === "string") {
-                    input.messages[0] = {
-                        ...firstMsg,
-                        content: `## pending messages\n${pendingSection}\n\n${firstMsg.content}`,
-                    };
+            throw error;
+        }
+        const runLedgerLifecycle = result.outcome === "errored" ? "error" : "completed";
+        if (runLedger)
+            (0, run_ledger_1.appendRunLedgerRecordNonFatal)(runLedger.agentRoot, (0, run_ledger_1.createRunLedgerRecord)({
+                ...runLedger.recordInput,
+                lifecycle: runLedgerLifecycle,
+                endedAt: new Date().toISOString(),
+                usage: (0, run_ledger_1.usageMetadataFromUsageData)(result.usage, result.usage ? "provider" : "none"),
+                ...(result.error ? { errorName: result.error.name } : {}),
+                ...(result.errorClassification ? { errorCode: result.errorClassification } : {}),
+            }));
+        if (result.outcome === "suspended") {
+            if (!result.suspension)
+                throw new Error("suspended agent turn omitted durable approval suspension");
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.pipeline_approval_suspended",
+                message: "pipeline returned a durably checkpointed approval suspension without duplicate post-turn persistence",
+                meta: { approvalId: result.suspension.approvalId, sessionPath: session.sessionPath },
+            });
+            return {
+                resolvedContext,
+                gateResult,
+                usage: result.usage,
+                turnOutcome: result.outcome,
+                suspension: result.suspension,
+                sessionPath: session.sessionPath,
+                messages: sessionMessages,
+                drainedPending: pending,
+            };
+        }
+        // Step 5b: Failover on terminal error
+        if (result.outcome === "errored" && input.failoverState) {
+            try {
+                const agentName = (0, identity_1.getAgentName)();
+                const currentLane = providerLaneForChannel(input.channel);
+                const currentBinding = resolveCurrentFailoverBinding(agentName, currentLane);
+                const currentProvider = currentBinding.provider;
+                /* v8 ignore next -- defensive: errorClassification always set when errored @preserve */
+                const classification = result.errorClassification ?? "unknown";
+                const inventory = await (0, provider_failover_1.runMachineProviderFailoverInventory)(agentName, currentProvider);
+                const failoverContext = (0, provider_failover_1.buildFailoverContext)(
+                /* v8 ignore next -- defensive: error always set when errored @preserve */
+                result.error?.message ?? "unknown error", classification, currentProvider, currentBinding.model, agentName, inventory, {}, { currentLane });
+                input.failoverState.pending = failoverContext;
+                const failoverNextState = selectPostTurnContinuityState({
+                    outcome: "errored",
+                    mustResolveBeforeHandoff,
+                    lastFriendActivityAt,
+                });
+                await input.postTurn(sessionMessages, session.sessionPath, result.usage, undefined, failoverNextState);
+                try {
+                    const agentRoot = (0, identity_1.getAgentRoot)();
+                    const postTurnArc = readPostTurnFlightRecorderArcSnapshot(agentRoot);
+                    recordTurnFlightRecorderCheckpoint({
+                        agentRoot,
+                        currentSession,
+                        currentAsk: checkpointCurrentAsk,
+                        nextSafeAction: failoverContext.userMessage,
+                        outcome: "errored",
+                        sessionPersisted: true,
+                        mustResolveBeforeHandoff,
+                        activeObligationIds: postTurnArc.activeObligationIds,
+                        activeReturnObligationIds: postTurnArc.activeReturnObligationIds,
+                        activePacketIds: postTurnArc.activePacketIds,
+                        openEvolutionCaseIds: postTurnArc.openEvolutionCaseIds,
+                        recentClaimIds: postTurnArc.recentClaimIds,
+                        unverifiedClaimIds: postTurnArc.unverifiedClaimIds,
+                    });
+                    await refreshContextLossSentinelNonFatal({ agentName, agentRoot, trigger: "provider_failover" });
                 }
-                else {
-                    input.messages[0] = {
-                        ...firstMsg,
-                        content: [
-                            { type: "text", text: `## pending messages\n${pendingSection}\n\n` },
-                            ...firstMsg.content,
-                        ],
-                    };
+                catch (checkpointError) {
+                    /* v8 ignore next -- best-effort recorder write must not hide provider-failover guidance @preserve */
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "senses",
+                        event: "senses.flight_recorder_checkpoint_error",
+                        message: "failed to record provider-failover flight recorder checkpoint",
+                        meta: { error: checkpointError instanceof Error ? checkpointError.message : String(checkpointError) },
+                    });
                 }
+                return {
+                    resolvedContext,
+                    gateResult,
+                    usage: result.usage,
+                    turnOutcome: result.outcome,
+                    sessionPath: session.sessionPath,
+                    messages: sessionMessages,
+                    drainedPending: pending,
+                    failoverMessage: failoverContext.userMessage,
+                };
+                /* v8 ignore start -- failover catch: tested via pipeline failover sequence throws test but v8 under-reports catch coverage @preserve */
+            }
+            catch (failoverError) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "senses",
+                    event: "senses.failover_error",
+                    message: "failover sequence failed, falling through",
+                    meta: { error: failoverError instanceof Error ? failoverError.message : String(failoverError) },
+                });
             }
+            /* v8 ignore stop */
+        }
+        // Step 5c: Emit episodes for obligation state transitions
+        try {
+            const agentRoot = (0, identity_1.getAgentRoot)();
+            const postTurnObligations = (0, obligations_1.readPendingObligations)(agentRoot);
+            emitObligationTransitionEpisodes(agentRoot, preTurnObligationIds, postTurnObligations, pendingObligations);
         }
+        catch {
+            // Episode emission is non-fatal
+        }
+        // Step 6: postTurn
+        const nextState = selectPostTurnContinuityState({
+            outcome: result.outcome,
+            mustResolveBeforeHandoff,
+            lastFriendActivityAt,
+        });
+        await input.postTurn(sessionMessages, session.sessionPath, result.usage, undefined, nextState);
+        try {
+            const agentRoot = (0, identity_1.getAgentRoot)();
+            const postTurnArc = readPostTurnFlightRecorderArcSnapshot(agentRoot);
+            recordTurnFlightRecorderCheckpoint({
+                agentRoot,
+                currentSession,
+                currentAsk: checkpointCurrentAsk,
+                nextSafeAction: activeWorkFrame.resumeHandle?.nextAction
+                    ?? activeWorkFrame.primaryObligation?.nextAction?.trim()
+                    ?? null,
+                outcome: result.outcome ?? "observed",
+                sessionPersisted: true,
+                mustResolveBeforeHandoff,
+                activeObligationIds: postTurnArc.activeObligationIds,
+                activeReturnObligationIds: postTurnArc.activeReturnObligationIds,
+                activePacketIds: postTurnArc.activePacketIds,
+                openEvolutionCaseIds: postTurnArc.openEvolutionCaseIds,
+                recentClaimIds: postTurnArc.recentClaimIds,
+                unverifiedClaimIds: postTurnArc.unverifiedClaimIds,
+            });
+            await refreshContextLossSentinelNonFatal({ agentName: (0, identity_1.getAgentName)(), agentRoot, trigger: "post_turn" });
+        }
+        catch (error) {
+            /* v8 ignore next -- defensive recorder failures are non-fatal to already-persisted user turns @preserve */
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "senses",
+                event: "senses.flight_recorder_checkpoint_error",
+                message: "failed to record post-turn flight recorder checkpoint",
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+        // Step 7: Token accumulation
+        await input.accumulateFriendTokens(input.friendStore, resolvedContext.friend.id, result.usage);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.pipeline_end",
+            message: "inbound turn pipeline completed",
+            meta: {
+                channel: input.channel,
+                friendId: resolvedContext.friend.id,
+            },
+        });
+        return {
+            resolvedContext,
+            gateResult,
+            usage: result.usage,
+            turnOutcome: result.outcome,
+            completion: result.completion,
+            sessionPath: session.sessionPath,
+            messages: sessionMessages,
+            drainedPending: pending,
+            ...(input.switchedProvider ? { switchedProvider: input.switchedProvider } : {}),
+        };
     }
-    // Append user messages from the inbound turn
-    for (const msg of input.messages) {
-        sessionMessages.push(msg);
+    finally {
+        // Step 6b: Post-turn sync push (opt-in, git-status-based discovery).
+        if (syncConfig.enabled && !liveLatencyMode && !declinedForHome) {
+            (0, sync_1.postTurnPush)((0, identity_1.getAgentRoot)(), syncConfig);
+        }
     }
-    // Step 5: runAgent
-    const existingToolContext = input.runAgentOptions?.toolContext;
-    const runAgentOptions = {
-        ...input.runAgentOptions,
-        bridgeContext,
-        activeWorkFrame,
-        delegationDecision,
-        currentSessionKey: currentSession.key,
-        currentObligation,
-        mustResolveBeforeHandoff,
-        setMustResolveBeforeHandoff: (value) => {
-            mustResolveBeforeHandoff = value;
-        },
-        toolContext: {
-            /* v8 ignore next -- default no-op signin satisfies interface; real signin injected by sense adapter @preserve */
-            signin: async () => undefined,
-            ...existingToolContext,
-            context: resolvedContext,
-            friendStore: input.friendStore,
-            currentSession,
-            activeBridges,
-        },
-    };
-    const result = await input.runAgent(sessionMessages, input.callbacks, input.channel, input.signal, runAgentOptions);
-    // Step 6: postTurn
-    const continuingState = {
-        ...(mustResolveBeforeHandoff ? { mustResolveBeforeHandoff: true } : {}),
-        ...(typeof lastFriendActivityAt === "string" ? { lastFriendActivityAt } : {}),
-    };
-    const nextState = result.outcome === "complete" || result.outcome === "blocked" || result.outcome === "superseded" || result.outcome === "no_response"
-        ? (typeof lastFriendActivityAt === "string"
-            ? { lastFriendActivityAt }
-            : undefined)
-        : (Object.keys(continuingState).length > 0 ? continuingState : undefined);
-    input.postTurn(sessionMessages, session.sessionPath, result.usage, undefined, nextState);
-    // Step 7: Token accumulation
-    await input.accumulateFriendTokens(input.friendStore, resolvedContext.friend.id, result.usage);
-    (0, runtime_1.emitNervesEvent)({
-        component: "senses",
-        event: "senses.pipeline_end",
-        message: "inbound turn pipeline completed",
-        meta: {
-            channel: input.channel,
-            friendId: resolvedContext.friend.id,
-        },
-    });
-    return {
-        resolvedContext,
-        gateResult,
-        usage: result.usage,
-        turnOutcome: result.outcome,
-        completion: result.completion,
-        sessionPath: session.sessionPath,
-        messages: sessionMessages,
-        drainedPending: pending,
-    };
 }