@ours.network/fleet 1.2.0-nightly.63 → 1.2.0-nightly.64

package/dist/session/control.js

@@ -4,6 +4,7 @@ import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from 'node
 import { createConnection, createServer } from 'node:net';
 import { join } from 'node:path';
 import { SessionControlError } from './types.js';
+import { MAX_CONVERSATION_RECORD_BYTES, startConversationReplay } from './conversation-replay.js';
 import { validateFleetAuditBegin, validateFleetAuditFinish, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 import { interruptSession, queueSessionPrompt, respondSessionPermission, respondSessionPermissionV2, } from '../application/session-mutations.js';
 const MAX_LINE_BYTES = 64 * 1024;
@@ -194,6 +195,12 @@ export class RoleControlServer {
                     continue;
                 void this.handle(line, socket).then(follow => {
                     if (follow) {
+                        if (socket.destroyed) {
+                            follow.stop();
+                            if (follow.controller)
+                                this.session.setControllerAttached(false);
+                            return;
+                        }
                         if (unsubscribe) {
                             unsubscribe();
                             if (controllerAttached)
@@ -242,6 +249,7 @@ export class RoleControlServer {
                                 'events_since', 'observer_follow', 'retained_range',
                                 ...(this.correspondence ? ['agent_correspondence'] : []),
                                 ...(this.session.conversationPage ? ['conversation_v3'] : []),
+                                ...this.observationFeatures(),
                                 ...(this.session.submitPromptBrowser ? ['generation_bound_prompts'] : []),
                                 ...(this.session.liveVoiceSupported ? ['idle_bound_prompts', 'targeted_voice_interrupt'] : []),
                                 ...(this.session.capabilities?.steering ? ['steering'] : []),
@@ -427,20 +435,98 @@ export class RoleControlServer {
                 }
                 case 'conversation_page': {
                     this.requireConversation(request);
-                    this.write(socket, {
-                        version: 1, id: request.id, ok: true,
-                        result: this.session.conversationPage({
-                            after: request.after, limit: request.limit,
-                        }),
+                    const page = this.session.conversationPage({
+                        after: request.after === undefined ? undefined : String(request.after), limit: request.limit,
                     });
+                    if (this.session.observeConversation) {
+                        try {
+                            const observation = this.session.observeConversation(() => { });
+                            try {
+                                if (observation.snapshot.observationFailure) {
+                                    page.snapshot = { ...page.snapshot, historyDegraded: true, observationFailure: 'capture_failed' };
+                                }
+                                else
+                                    page.snapshot = observation.snapshot;
+                            }
+                            finally {
+                                observation.unsubscribe();
+                            }
+                        }
+                        catch {
+                            // Canonical REST recovery remains usable without a live observation.
+                            // Never substitute a frozen capture/barrier for the current store page.
+                            page.snapshot = { ...page.snapshot, historyDegraded: true, observationFailure: 'capture_failed' };
+                        }
+                    }
+                    this.write(socket, { version: 1, id: request.id, ok: true, result: page });
                     return;
                 }
                 case 'conversation_follow': {
                     this.requireConversation(request);
+                    if (request.controller === false && request.expectedGeneration !== undefined) {
+                        let stopped = false;
+                        let heartbeat;
+                        let writing = Promise.resolve();
+                        const send = (message) => {
+                            const result = writing.then(() => writeMessage(message));
+                            writing = result.catch(() => { });
+                            return result;
+                        };
+                        const writeMessage = async (message) => {
+                            // Stream one replay record progressively; don't queue a valid 16 MiB record
+                            // into the 8 MiB pending-output budget. Framing is owned by the transport.
+                            const bytes = Buffer.from(JSON.stringify({ version: 1, ...message }) + '\n');
+                            for (let offset = 0; offset < bytes.length; offset += 64 * 1024) {
+                                if (stopped || socket.destroyed)
+                                    throw new Error('conversation socket closed');
+                                if (!socket.write(bytes.subarray(offset, offset + 64 * 1024))) {
+                                    await new Promise((resolve, reject) => {
+                                        const cleanup = () => { socket.off('drain', drained); socket.off('close', ended); socket.off('error', failed); };
+                                        const drained = () => { cleanup(); resolve(); };
+                                        const ended = () => { cleanup(); reject(new Error('conversation socket closed')); };
+                                        const failed = (error) => { cleanup(); reject(error); };
+                                        socket.once('drain', drained);
+                                        socket.once('close', ended);
+                                        socket.once('error', failed);
+                                    });
+                                }
+                            }
+                        };
+                        const follow = startConversationReplay(this.session, {
+                            expectedGeneration: request.expectedGeneration, after: request.after === undefined ? 0 : Number(request.after), controller: false,
+                        }, {
+                            replay: page => send({ conversationReplay: page }),
+                            ready: ready => send({ conversationReady: ready }),
+                            event: event => send({ conversationEvent: event }),
+                            state: state => send({ conversationState: state }),
+                            close: reason => {
+                                stopped = true;
+                                if (heartbeat)
+                                    clearInterval(heartbeat);
+                                if (reason && !socket.destroyed)
+                                    socket.end(JSON.stringify({ version: 1, id: request.id, ok: false, error: reason }) + '\n');
+                            },
+                        });
+                        const stop = () => { stopped = true; if (heartbeat)
+                            clearInterval(heartbeat); follow.close(); };
+                        let heartbeatPending = false;
+                        if (!stopped) {
+                            heartbeat = setInterval(() => {
+                                if (heartbeatPending || stopped)
+                                    return;
+                                heartbeatPending = true;
+                                void send({ controlHeartbeat: true }).catch(() => { stop(); socket.destroy(); })
+                                    .finally(() => { heartbeatPending = false; });
+                            }, 2_000);
+                            heartbeat.unref();
+                        }
+                        socket.once('close', stop);
+                        return { controller: false, stop: () => { socket.off('close', stop); stop(); } };
+                    }
                     this.write(socket, {
                         version: 1, id: request.id, ok: true,
                         result: this.session.conversationPage({
-                            after: request.after, limit: request.limit,
+                            after: request.after === undefined ? undefined : String(request.after), limit: request.limit,
                         }),
                     });
                     // A live conversation view is an attached controller: permission
@@ -560,6 +646,23 @@ export class RoleControlServer {
         if (!this.session.conversationPage || !this.session.subscribeConversation)
             throw new SessionControlError('rejected', 'this role has no conversation ledger');
     }
+    observationFeatures() {
+        if (!this.session.observeConversation || !this.session.replayConversation || !this.session.subscribeConversation || !this.session.subscribeConversationFailure)
+            return [];
+        try {
+            const observation = this.session.observeConversation(() => { });
+            try {
+                return observation.snapshot.observationFailure || !this.session.conversationReplayAvailable?.(observation.snapshot.sessionGeneration)
+                    ? [] : ['conversation_observation', 'control_heartbeat'];
+            }
+            finally {
+                observation.unsubscribe();
+            }
+        }
+        catch {
+            return [];
+        }
+    }
     write(socket, response) {
         if (!socket.destroyed)
             socket.write(JSON.stringify(response) + '\n');
@@ -652,32 +755,54 @@ export async function followControl(stateDir, onMessage) {
  * controller-presence this connection contributed.
  */
 export async function followConversation(stateDir, after, onMessage) {
+    const options = typeof after === 'object' ? after : undefined;
+    options?.signal?.throwIfAborted();
     const token = readFileSync(controlTokenPath(stateDir), 'utf8').trim();
     const socket = createConnection(controlSocketPath(stateDir));
     socket.setEncoding('utf8');
-    let buffer = '';
+    // Admit one maximum-size logical record plus its actual private wrapper.
+    // coveredThrough is a safe integer. JSON brackets/envelope are outside the record budget.
+    const privateEnvelopeBytes = Math.max(Buffer.byteLength(JSON.stringify({ version: 1, conversationReplay: { events: [], coveredThrough: Number.MAX_SAFE_INTEGER } })), Buffer.byteLength(JSON.stringify({ version: 1, conversationReady: { snapshot: null, coveredThrough: Number.MAX_SAFE_INTEGER } })) - 4, Buffer.byteLength(JSON.stringify({ version: 1, conversationState: null })) - 4, Buffer.byteLength(JSON.stringify({ version: 1, conversationEvent: null })) - 4);
+    const limit = MAX_CONVERSATION_RECORD_BYTES + privateEnvelopeBytes;
+    let parts = [], bytes = 0;
     socket.on('data', chunk => {
-        buffer += chunk;
-        for (;;) {
-            const newline = buffer.indexOf('\n');
-            if (newline < 0)
-                break;
-            const line = buffer.slice(0, newline);
-            buffer = buffer.slice(newline + 1);
-            if (!line.trim())
-                continue;
-            try {
-                onMessage(JSON.parse(line));
+        for (const [index, part] of String(chunk).split('\n').entries()) {
+            if (index) {
+                const line = parts.join('');
+                parts = [];
+                bytes = 0;
+                if (line.trim()) {
+                    try {
+                        onMessage(JSON.parse(line));
+                    }
+                    catch {
+                        if (options) {
+                            socket.destroy(new Error('invalid conversation private frame'));
+                            return;
+                        }
+                    }
+                }
+            }
+            bytes += Buffer.byteLength(part);
+            if (options && bytes > limit) {
+                socket.destroy(new Error('conversation private frame exceeds assembly limit'));
+                return;
             }
-            catch { /* a torn frame ends this stream; the client resyncs over HTTP */ }
+            parts.push(part);
         }
     });
     await new Promise((resolve, reject) => {
+        const onAbort = () => { socket.destroy(); reject(new Error('conversation follow aborted')); };
+        options?.signal?.addEventListener('abort', onAbort, { once: true });
+        socket.once('close', () => options?.signal?.removeEventListener('abort', onAbort));
         socket.once('connect', resolve);
         socket.once('error', reject);
+        if (options?.signal?.aborted)
+            onAbort();
     });
     socket.write(JSON.stringify({
-        version: 3, id: randomUUID(), token, command: 'conversation_follow', after,
+        version: 3, id: randomUUID(), token, command: 'conversation_follow',
+        ...(options ? { expectedGeneration: options.expectedGeneration, after: options.after ?? 0, controller: false } : { after }),
     }) + '\n');
     return { socket, close: () => socket.destroy() };
 }

package/dist/session/conversation-observation.d.ts

@@ -0,0 +1,25 @@
+import type { ConversationObservation as Observation, ConversationObservationState } from './conversation-types.js';
+type Capture = () => Omit<ConversationObservationState, 'stateRevision'>;
+/** Revision/publication only: the backend remains the sole owner of snapshot construction. */
+export declare class ConversationObservation {
+    private readonly capture;
+    private revision;
+    private fingerprint?;
+    private current?;
+    private scheduled;
+    private checkpointDepth;
+    private failed;
+    private readonly listeners;
+    constructor(capture: Capture);
+    observe(listener: (state: ConversationObservationState) => void): Observation;
+    /** Keep reentrant registration on the preceding coherent snapshot until the
+     * owner's synchronous durable append and inventory mutation finish together.
+     */
+    checkpoint<T>(mutation: () => T): T;
+    publish(): void;
+    private failCapture;
+    private deliver;
+    /** Fresh capture after a durable append's synchronous owner mutation completes. */
+    scheduleCapture(): void;
+}
+export {};

package/dist/session/conversation-observation.js

@@ -0,0 +1,100 @@
+/** Revision/publication only: the backend remains the sole owner of snapshot construction. */
+export class ConversationObservation {
+    capture;
+    revision = 0;
+    fingerprint;
+    current;
+    scheduled = false;
+    checkpointDepth = 0;
+    failed = false;
+    listeners = new Set();
+    constructor(capture) {
+        this.capture = capture;
+    }
+    observe(listener) {
+        // Registration and synchronous stable capture have no await gap. Inside an
+        // owner checkpoint, publish retains the preceding snapshot and its barrier.
+        // A reconnect never resets this generation's revision or implies control.
+        this.publish();
+        if (!this.current)
+            throw new Error('conversation observation unavailable: capture_failed');
+        this.listeners.add(listener);
+        return {
+            snapshot: structuredClone(this.current),
+            unsubscribe: () => { this.listeners.delete(listener); },
+        };
+    }
+    /** Keep reentrant registration on the preceding coherent snapshot until the
+     * owner's synchronous durable append and inventory mutation finish together.
+     */
+    checkpoint(mutation) {
+        if (this.checkpointDepth === 0)
+            this.publish();
+        this.checkpointDepth++;
+        try {
+            return mutation();
+        }
+        finally {
+            this.checkpointDepth--;
+            if (this.checkpointDepth === 0)
+                this.publish();
+        }
+    }
+    publish() {
+        if (this.checkpointDepth > 0 || this.failed)
+            return;
+        try {
+            const captured = this.capture();
+            const fingerprint = JSON.stringify(captured);
+            if (fingerprint === this.fingerprint)
+                return;
+            const current = structuredClone({ ...captured, stateRevision: this.revision + 1 });
+            this.fingerprint = fingerprint;
+            this.current = current;
+            this.revision++;
+        }
+        catch {
+            this.failCapture();
+            return;
+        }
+        this.deliver();
+    }
+    failCapture() {
+        if (this.failed)
+            return;
+        this.failed = true;
+        // Retain the entire preceding coherent state and its barrier. Consumers
+        // must stop healthy coverage; owner admission/receipt processing continues.
+        if (this.current) {
+            this.current = { ...this.current, stateRevision: ++this.revision, observationFailure: 'capture_failed' };
+            this.deliver();
+        }
+    }
+    deliver() {
+        for (const listener of this.listeners) {
+            let state;
+            try {
+                state = structuredClone(this.current);
+            }
+            catch {
+                this.failCapture();
+                return;
+            }
+            // An observer callback cannot break the owning backend's transition.
+            try {
+                listener(state);
+            }
+            catch { /* passive observer */ }
+        }
+    }
+    /** Fresh capture after a durable append's synchronous owner mutation completes. */
+    scheduleCapture() {
+        if (this.scheduled)
+            return;
+        this.scheduled = true;
+        queueMicrotask(() => {
+            this.scheduled = false;
+            this.publish();
+        });
+    }
+}

package/dist/session/conversation-replay.d.ts

@@ -0,0 +1,50 @@
+import type { ConversationEventV1 } from './conversation-types.js';
+export declare const MAX_REPLAY_BUFFER_BYTES: number;
+export declare const MAX_CONVERSATION_RECORD_BYTES: number;
+export interface ConversationReplayRequest {
+    expectedGeneration: string;
+    after: number;
+    through: number;
+    pageSize?: number;
+    signal?: AbortSignal;
+}
+export interface ConversationReplayPage {
+    events: ConversationEventV1[];
+    /** Storage coverage, including invisible events; never a visible-event cursor. */
+    coveredThrough: number;
+}
+export declare class ReplayCoverageError extends Error {
+    constructor(detail: string);
+}
+/** Bounded reads and explicit scheduling even when a whole segment is cached by the OS. */
+export declare function replayLines(path: string, signal?: AbortSignal): AsyncGenerator<string>;
+import type { ConversationObservation, ConversationObservationState } from './conversation-types.js';
+export interface PassiveConversationFollowRequest {
+    expectedGeneration: string;
+    after?: number;
+    controller: false;
+    signal?: AbortSignal;
+}
+export interface ConversationReplayReady {
+    snapshot: ConversationObservationState;
+    coveredThrough: number;
+}
+interface ReplayOwner {
+    observeConversation?(listener: (state: ConversationObservationState) => void): ConversationObservation;
+    subscribeConversationFailure?(listener: (generation: string) => void): () => void;
+    subscribeConversation?(listener: (event: ConversationEventV1) => void): () => void;
+    replayConversation?(request: ConversationReplayRequest): AsyncIterable<ConversationReplayPage>;
+}
+export interface ConversationReplaySink {
+    replay(page: ConversationReplayPage): void | Promise<void>;
+    ready(ready: ConversationReplayReady): void | Promise<void>;
+    event(event: ConversationEventV1): void | Promise<void>;
+    state(state: ConversationObservationState): void | Promise<void>;
+    close(reason?: string): void;
+}
+/** Passive owner-turn registration, complete replay, ready, then buffered post-barrier delivery. */
+export declare function startConversationReplay(owner: ReplayOwner, request: PassiveConversationFollowRequest, sink: ConversationReplaySink): {
+    ready: Promise<void>;
+    close: () => void;
+};
+export {};

package/dist/session/conversation-replay.js

@@ -0,0 +1,203 @@
+import { open } from 'node:fs/promises';
+import { setImmediate as yieldTurn } from 'node:timers/promises';
+export const MAX_REPLAY_BUFFER_BYTES = 8 * 1024 * 1024;
+export const MAX_CONVERSATION_RECORD_BYTES = 16 * 1024 * 1024;
+export class ReplayCoverageError extends Error {
+    constructor(detail) { super(`replay coverage unavailable: ${detail}`); }
+}
+/** Bounded reads and explicit scheduling even when a whole segment is cached by the OS. */
+export async function* replayLines(path, signal) {
+    const file = await open(path, 'r');
+    try {
+        const chunk = Buffer.alloc(64 * 1024);
+        let pending = Buffer.alloc(0);
+        for (;;) {
+            signal?.throwIfAborted();
+            const { bytesRead } = await file.read(chunk, 0, chunk.length, null);
+            if (!bytesRead)
+                break;
+            const data = Buffer.concat([pending, chunk.subarray(0, bytesRead)]);
+            let start = 0;
+            for (let i = 0; i < data.length; i++) {
+                if (data[i] !== 10)
+                    continue;
+                if (i - start > MAX_CONVERSATION_RECORD_BYTES)
+                    throw new ReplayCoverageError('record exceeds assembly limit');
+                yield data.toString('utf8', start, i);
+                start = i + 1;
+            }
+            pending = Buffer.from(data.subarray(start));
+            if (pending.length > MAX_CONVERSATION_RECORD_BYTES)
+                throw new ReplayCoverageError('record exceeds assembly limit');
+            await yieldTurn();
+        }
+        if (pending.length)
+            throw new ReplayCoverageError('unterminated record');
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Passive owner-turn registration, complete replay, ready, then buffered post-barrier delivery. */
+export function startConversationReplay(owner, request, sink) {
+    if (request.controller !== false || !owner.observeConversation || !owner.subscribeConversation || !owner.subscribeConversationFailure || !owner.replayConversation)
+        throw new ReplayCoverageError('passive observation is unavailable');
+    const after = request.after ?? 0;
+    if (!request.expectedGeneration || !Number.isSafeInteger(after) || after < 0)
+        throw new ReplayCoverageError('invalid cursor or generation');
+    const abort = new AbortController();
+    const disposers = [];
+    const pending = [];
+    let pendingBytes = 0;
+    let closed = false;
+    let committed = false;
+    let draining = false;
+    let snapshot;
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+    // Consumers can attach later without an unhandled rejection during synchronous registration.
+    void ready.catch(() => { });
+    const close = (reason) => {
+        if (closed)
+            return;
+        closed = true;
+        abort.abort(new Error(reason ?? 'conversation follow closed'));
+        for (const dispose of disposers.splice(0))
+            dispose();
+        pending.length = 0;
+        pendingBytes = 0;
+        rejectReady(new Error(reason ?? 'conversation follow closed'));
+        sink.close(reason);
+    };
+    const own = (dispose) => { if (closed)
+        dispose();
+    else
+        disposers.push(dispose); };
+    const drain = async () => {
+        if (!committed || draining || closed)
+            return;
+        draining = true;
+        try {
+            while (pending.length && !closed) {
+                const next = pending[0];
+                if (next.value.event) {
+                    if (next.value.event.seq > snapshot.ledgerBarrier)
+                        await sink.event(next.value.event);
+                }
+                else if (next.value.state.stateRevision > snapshot.stateRevision)
+                    await sink.state(next.value.state);
+                if (!closed) {
+                    pending.shift();
+                    pendingBytes -= next.bytes;
+                }
+            }
+        }
+        catch (error) {
+            close(error.message);
+        }
+        finally {
+            draining = false;
+        }
+    };
+    const enqueue = (value) => {
+        if (closed)
+            return;
+        if (value.state?.observationFailure) {
+            close('conversation observation failed');
+            return;
+        }
+        if ((value.event ?? value.state).sessionGeneration !== request.expectedGeneration) {
+            close('session generation changed');
+            return;
+        }
+        const recordBytes = Buffer.byteLength(JSON.stringify(value.event ?? value.state));
+        const bytes = recordBytes + 10; // {"event":...} or {"state":...} queued envelope
+        if (recordBytes > MAX_CONVERSATION_RECORD_BYTES) {
+            close('conversation record exceeds assembly limit');
+            return;
+        }
+        // One active record goes straight to the progressive writer. Only waiting
+        // records count against the 8 MiB queue; the active assembly is bounded separately.
+        if (committed && !draining && pending.length === 0) {
+            draining = true;
+            void (async () => {
+                try {
+                    if (value.event) {
+                        if (value.event.seq > snapshot.ledgerBarrier)
+                            await sink.event(value.event);
+                    }
+                    else if (value.state.stateRevision > snapshot.stateRevision)
+                        await sink.state(value.state);
+                }
+                catch (error) {
+                    close(error.message);
+                }
+                finally {
+                    draining = false;
+                    void drain();
+                }
+            })();
+            return;
+        }
+        if (pendingBytes + bytes > MAX_REPLAY_BUFFER_BYTES) {
+            close('conversation live replay buffer exceeded');
+            return;
+        }
+        pending.push({ value, bytes });
+        pendingBytes += bytes;
+        void drain();
+    };
+    try {
+        // No await between registration and the owner's coherent snapshot/barrier capture.
+        own(owner.subscribeConversation(event => enqueue({ event })));
+        own(owner.subscribeConversationFailure(generation => {
+            if (generation === request.expectedGeneration)
+                close('conversation generation has non-durable events');
+        }));
+        const observation = owner.observeConversation(state => enqueue({ state }));
+        own(observation.unsubscribe);
+        snapshot = observation.snapshot;
+        if (snapshot.observationFailure)
+            throw new ReplayCoverageError('conversation observation failed');
+        if (snapshot.sessionGeneration !== request.expectedGeneration)
+            throw new ReplayCoverageError('session generation changed');
+        if (after > snapshot.ledgerBarrier)
+            throw new ReplayCoverageError('cursor exceeds barrier');
+        if (request.signal) {
+            const onAbort = () => close('conversation follow aborted');
+            request.signal.addEventListener('abort', onAbort, { once: true });
+            own(() => request.signal.removeEventListener('abort', onAbort));
+            if (request.signal.aborted)
+                onAbort();
+        }
+    }
+    catch (error) {
+        close(error.message);
+    }
+    if (!closed)
+        void (async () => {
+            try {
+                let coveredThrough = after;
+                for await (const page of owner.replayConversation({ expectedGeneration: request.expectedGeneration, after, through: snapshot.ledgerBarrier, signal: abort.signal })) {
+                    abort.signal.throwIfAborted();
+                    if (page.coveredThrough <= coveredThrough || page.coveredThrough > snapshot.ledgerBarrier)
+                        throw new ReplayCoverageError('non-progressing page');
+                    await sink.replay(page);
+                    coveredThrough = page.coveredThrough;
+                }
+                abort.signal.throwIfAborted();
+                if (coveredThrough !== snapshot.ledgerBarrier)
+                    throw new ReplayCoverageError('incomplete replay');
+                await sink.ready({ snapshot, coveredThrough });
+                abort.signal.throwIfAborted();
+                committed = true;
+                resolveReady();
+                await drain();
+            }
+            catch (error) {
+                close(error.message);
+            }
+        })();
+    return { ready, close: () => close() };
+}

package/dist/session/conversation-store.d.ts

@@ -1,3 +1,4 @@
+import { type ConversationReplayRequest, type ConversationReplayPage } from './conversation-replay.js';
 import type { ConversationEventV1, PromptReceipt } from './conversation-types.js';
 export interface ConversationStoreOptions {
     roleId: string;
@@ -29,6 +30,13 @@ type EventDraft = Omit<ConversationEventV1, 'schemaVersion' | 'roleId' | 'eventI
 export declare class ConversationEventStore {
     private readonly dir;
     private nextSeq;
+    private lastDurableSeq;
+    private readonly segmentRanges;
+    private readonly generationFloors;
+    private readonly failedGenerations;
+    private readonly failureListeners;
+    private unavailable;
+    private rotateBeforeAppend;
     private firstAvailableSeq?;
     private segments;
     private tail;
@@ -45,6 +53,8 @@ export declare class ConversationEventStore {
     constructor(dir: string, options: ConversationStoreOptions);
     /** First 24 hex chars of sha-256; the idempotency body-digest convention. */
     static bodyDigest(body: string): string;
+    /** Current delivery eligibility only; requested historical ranges still need replay verification. */
+    generationDurable(generation: string): boolean;
     get degraded(): boolean;
     get degradedDetail(): string | undefined;
     /**
@@ -59,6 +69,8 @@ export declare class ConversationEventStore {
     appendSafe(draft: EventDraft): ConversationEventV1 | undefined;
     page(request?: ConversationPageRequest): ConversationStorePage;
     subscribe(listener: (event: ConversationEventV1) => void): () => void;
+    /** A current-generation failed append invalidates even a follow already past ready. */
+    subscribeFailure(listener: (generation: string) => void): () => void;
     /** Store the receipt a repeated command must get back. */
     recordReceipt(commandId: string, receipt: PromptReceipt, bodyDigest: string): void;
     /**
@@ -82,6 +94,8 @@ export declare class ConversationEventStore {
     private trackPromptState;
     private segmentFd;
     private writeManifest;
+    /** One forward iterator owns the scan; each segment is opened at most once. */
+    replay(request: ConversationReplayRequest): AsyncGenerator<ConversationReplayPage>;
     private eventsAfter;
     private markDegraded;
 }