@pasko70/pibo 3.4.4 → 3.5.1

package/dist/debug/storage-backup.js

@@ -0,0 +1,41 @@
+import { parseArgs } from "node:util";
+import { createStorageBackup, readStorageBackupManifest, verifyStorageBackup, restoreStorageBackup } from "../data/storage-backup.js";
+import { recordStorageMaintenance } from "../data/storage-maintenance.js";
+export async function runStorageBackupCli(args) {
+    const action = args[0];
+    if (!action || args.includes("--help") || args.includes("-h")) {
+        console.log(`pibo debug backup - explicit SQLite snapshot and payload backup
+Commands:
+  create   --source <sqlite> --payload-root <dir> --destination <new-dir>
+           [--resume] [--max-bytes <n>] [--max-payloads <n>] [--max-ms <n>] [--max-wal-growth <n>]
+  inspect  --archive <dir>                    Read the manifest only
+  verify   --archive <dir>                    Verify database and all payload hashes
+  restore  --archive <dir> --destination <new-dir>
+Defaults: 1 GiB data, 100000 payloads, 60000 ms and 64 MiB extra source WAL per create attempt. Resume preserves the original snapshot.
+Each archive contains one database snapshot. Product and reliability snapshots are separate cuts.
+No source deletion, vacuum, or overwrite of an existing restore destination.`);
+        return;
+    }
+    const { values } = parseArgs({ args: args.slice(1), options: { source: { type: "string" }, "payload-root": { type: "string" }, destination: { type: "string" }, archive: { type: "string" }, resume: { type: "boolean" }, "max-bytes": { type: "string" }, "max-payloads": { type: "string" }, "max-ms": { type: "string" }, "max-wal-growth": { type: "string" }, json: { type: "boolean" } } });
+    const required = (name) => { const value = values[name]; if (typeof value !== "string" || !value)
+        throw Error(`Missing --${name}`); return value; };
+    let result;
+    if (action === "create") {
+        const source = required("source");
+        result = await createStorageBackup({ source, payloadRoot: required("payload-root"), destination: required("destination"), resume: values.resume, maxBytes: values["max-bytes"] ? Number(values["max-bytes"]) : undefined, maxPayloads: values["max-payloads"] ? Number(values["max-payloads"]) : undefined, maxMilliseconds: values["max-ms"] ? Number(values["max-ms"]) : undefined, maxWalGrowthBytes: values["max-wal-growth"] ? Number(values["max-wal-growth"]) : undefined });
+        recordStorageMaintenance(source, { operation: "backup", at: new Date().toISOString(), status: result.status, destination: required("destination") });
+    }
+    else if (action === "inspect")
+        result = await readStorageBackupManifest(required("archive"));
+    else if (action === "verify") {
+        const archive = required("archive");
+        result = await verifyStorageBackup(archive, AbortSignal.timeout(60000));
+        const manifest = await readStorageBackupManifest(archive);
+        recordStorageMaintenance(manifest.source, { operation: "backup", at: new Date().toISOString(), status: "verified", archive });
+    }
+    else if (action === "restore")
+        result = await restoreStorageBackup(required("archive"), required("destination"), AbortSignal.timeout(60000));
+    else
+        throw Error("Unknown backup action; use backup --help");
+    console.log(JSON.stringify(result, null, 2));
+}

package/dist/debug/storage-maintenance.js

@@ -0,0 +1,78 @@
+import { parseArgs } from "node:util";
+import { piboHomePath } from "../core/pibo-home.js";
+import { checkpointStorage, inspectStorageStatus, maintainStorageRetention, verifyStorage } from "../data/storage-maintenance.js";
+import { resolveDebugStore } from "./stores.js";
+export async function runStorageMaintenanceCli(args) {
+    const action = args[0];
+    if (!action || args.includes("--help") || args.includes("-h")) {
+        printHelp();
+        return;
+    }
+    const { values } = parseArgs({ args: args.slice(1), strict: true, options: {
+            store: { type: "string" }, path: { type: "string" }, json: { type: "boolean" },
+            "timeout-ms": { type: "string" }, full: { type: "boolean" }, quick: { type: "boolean" },
+            apply: { type: "boolean" }, "dry-run": { type: "boolean" }, mode: { type: "string" },
+            before: { type: "string" }, limit: { type: "string" }, "payload-root": { type: "string" },
+            "database-warn-bytes": { type: "string" }, "wal-warn-bytes": { type: "string" }, "payload-warn-bytes": { type: "string" },
+        } });
+    if (values.apply && values["dry-run"])
+        throw new Error("Choose either --dry-run or --apply");
+    const path = typeof values.path === "string" ? values.path : resolveStorePath(values.store);
+    let result;
+    if (action === "status" || action === "doctor") {
+        result = inspectStorageStatus({ path, databaseWarnBytes: numberValue(values["database-warn-bytes"]), walWarnBytes: numberValue(values["wal-warn-bytes"]), payloadWarnBytes: numberValue(values["payload-warn-bytes"]) });
+    }
+    else if (action === "verify") {
+        if (values.full && values.quick)
+            throw new Error("Choose either --quick or --full");
+        result = await verifyStorage({ path, mode: values.full ? "full" : "quick", timeoutMs: numberValue(values["timeout-ms"]) });
+    }
+    else if (action === "checkpoint") {
+        const mode = values.mode ?? "passive";
+        if (!new Set(["passive", "restart", "truncate"]).has(mode))
+            throw new Error("Checkpoint --mode must be passive, restart, or truncate");
+        result = checkpointStorage({ path, mode: mode, apply: values.apply });
+    }
+    else if (action === "retention") {
+        if (typeof values.before !== "string")
+            throw new Error("Storage retention requires --before <iso-date>");
+        result = await maintainStorageRetention({ path, before: values.before, limit: numberValue(values.limit), apply: values.apply, payloadRoot: typeof values["payload-root"] === "string" ? values["payload-root"] : piboHomePath("payloads") });
+    }
+    else
+        throw new Error(`Unknown storage action "${action}"; run pibo debug storage --help`);
+    if (values.json)
+        console.log(JSON.stringify(result, null, 2));
+    else
+        console.log(formatText(result));
+}
+function resolveStorePath(value) {
+    if (!value || value === "pibo-data")
+        return resolveDebugStore("pibo-data").path;
+    if (value === "reliability")
+        return resolveDebugStore("reliability").path;
+    throw new Error("--store must be pibo-data or reliability; use --path for another SQLite store");
+}
+function numberValue(value) { if (value === undefined)
+    return undefined; const parsed = Number(value); if (!Number.isSafeInteger(parsed) || parsed < 0)
+    throw new Error(`Invalid numeric value "${value}"`); return parsed; }
+function formatText(value) { const object = value; const lines = [`pibo debug storage ${String(object.resultType ?? "result").split(".").at(-1)}`]; for (const [key, item] of Object.entries(object)) {
+    if (key === "resultType" || typeof item === "object")
+        continue;
+    lines.push(`${key}\t${String(item)}`);
+} if (Array.isArray(object.warnings))
+    lines.push(...object.warnings.map((warning) => `warning\t${String(warning)}`)); lines.push("", "Use --json for bounded row, size, projection, and progress detail."); return lines.join("\n"); }
+function printHelp() {
+    console.log(`pibo debug storage - bounded SQLite health and maintenance
+
+Commands:
+  status [--store pibo-data|reliability | --path <sqlite>] [--json]
+  doctor [--store pibo-data|reliability | --path <sqlite>] [--json]
+  verify [--quick|--full] [--timeout-ms <n>] [--store <name>|--path <sqlite>] [--json]
+  checkpoint [--mode passive|restart|truncate] [--dry-run|--apply] [--store <name>|--path <sqlite>] [--json]
+  retention --before <iso-date> [--limit <1..10000>] [--dry-run|--apply] [--payload-root <dir>] [--store <name>|--path <sqlite>] [--json]
+
+Status is read-only and reports DB/WAL/SHM/payload size, pages/freelist, bounded row counts, payload-reference integrity, maintenance metadata, and degraded thresholds.
+Verification runs in a cancellable worker. Timeout is partial and never healthy. Quick/full checks can still be I/O intensive; use backup verification or offline checks when the online budget is insufficient.
+Checkpoint and retention default to dry-run. Apply is bounded and audited in the database maintenance sidecar. Retention deletes only eligible live_delta rows; chat messages, audit events, idempotency evidence, and referenced payloads are preserved.
+`);
+}

package/dist/debug/telemetry-capture.js

@@ -0,0 +1,66 @@
+import { parseArgs } from "node:util";
+import { join, dirname } from "node:path";
+import { opendir } from "node:fs/promises";
+import { resolveDebugStore } from "./stores.js";
+import { startTelemetryCapture, inspectTelemetryCapture, finalizeTelemetryCapture, readTelemetryCapturePage } from "../data/telemetry-capture.js";
+export async function runTelemetryCaptureCli(args) {
+    const action = args[0];
+    if (!action || args.includes("--help") || args.includes("-h")) {
+        console.log(`pibo debug telemetry capture - scoped provider metadata in isolated stores
+Commands:
+  start --session <ps_...> --owner <name> --duration-ms <n> --max-bytes <n> --max-rows <n>
+  stop <capture-id>       Fence appends and finalize an independent closed archive
+  list                   List up to 100 manifests without opening databases
+  inspect <capture-id>   Read one manifest without opening its database
+  page <capture-id> [--after <sequence>] [--limit <1..100>]
+Limits: one active capture, at most one hour, 64 MiB logical data and 100000 rows per run.
+Detail is allow-listed provider metadata only. Arbitrary provider bodies, credentials and prompts are excluded.
+Stopping/finalizing is explicit; archived data is never opened by normal gateway reads.`);
+        return;
+    }
+    const { values, positionals } = parseArgs({ args: args.slice(1), allowPositionals: true, options: { session: { type: "string" }, owner: { type: "string" }, "duration-ms": { type: "string" }, "max-bytes": { type: "string" }, "max-rows": { type: "string" }, after: { type: "string" }, limit: { type: "string" }, json: { type: "boolean" } } });
+    const root = join(dirname(resolveDebugStore("pibo-data").path), "telemetry-captures");
+    let result;
+    if (action === "start")
+        result = startTelemetryCapture(root, { sessionId: values.session ?? "", owner: values.owner ?? "", durationMs: Number(values["duration-ms"]), maxBytes: Number(values["max-bytes"]), maxRows: Number(values["max-rows"]) });
+    else if (action === "list") {
+        const entries = [];
+        let scanned = 0, truncated = false;
+        try {
+            const directory = await opendir(root);
+            for await (const entry of directory) {
+                if (++scanned > 1000 || entries.length >= 100) {
+                    truncated = true;
+                    break;
+                }
+                if (!entry.isDirectory() || !entry.name.startsWith("capture_"))
+                    continue;
+                try {
+                    entries.push(inspectTelemetryCapture(root, entry.name));
+                }
+                catch {
+                    entries.push({ id: entry.name, status: "manifest_unavailable" });
+                }
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        result = { entries, truncated };
+    }
+    else {
+        const id = positionals[0];
+        if (!id)
+            throw Error("Capture id is required");
+        if (action === "stop")
+            result = await finalizeTelemetryCapture(root, id);
+        else if (action === "inspect")
+            result = inspectTelemetryCapture(root, id);
+        else if (action === "page")
+            result = await readTelemetryCapturePage(root, id, Number(values.after ?? 0), Number(values.limit ?? 50));
+        else
+            throw Error("Unknown capture action; use capture --help");
+    }
+    console.log(JSON.stringify(result, null, 2));
+}

package/dist/gateway/cli.js

@@ -231,14 +231,40 @@ function activeRun(value) {
         piboSessionId: stringValue(obj.controllerPiboSessionId) ?? stringValue(obj.piboSessionId),
     };
 }
+function runJobReliability(value) {
+    const obj = objectValue(value);
+    if (!obj || (obj.status !== "ok" && obj.status !== "degraded")
+        || !Number.isInteger(obj.expiredOrphanRunJobs) || Number(obj.expiredOrphanRunJobs) < 0
+        || !Number.isInteger(obj.orphanRunDeadLetters) || Number(obj.orphanRunDeadLetters) < 0)
+        return undefined;
+    return {
+        status: obj.status,
+        expiredOrphanRunJobs: Number(obj.expiredOrphanRunJobs),
+        orphanRunDeadLetters: Number(obj.orphanRunDeadLetters),
+    };
+}
+function durableMessageQueueStatus(value) {
+    const obj = objectValue(value);
+    if (!obj)
+        return undefined;
+    const status = obj.status === "healthy" || obj.status === "degraded" || obj.status === "ambiguous" ? obj.status : undefined;
+    const storage = objectValue(obj.storage);
+    const counts = Array.isArray(obj.counts) ? obj.counts.flatMap(value => { const row = objectValue(value); return row ? [{ state: stringValue(row.state), delivery: stringValue(row.delivery), count: numberValue(row.count), bytes: numberValue(row.bytes) }] : []; }) : undefined;
+    const affectedScopes = Array.isArray(obj.affectedScopes) ? obj.affectedScopes.flatMap(value => { const row = objectValue(value); return row ? [{ sessionId: stringValue(row.sessionId), roomId: stringValue(row.roomId), blockingCommandId: stringValue(row.blockingCommandId), blockedSince: numberValue(row.blockedSince), blockedSuccessors: numberValue(row.blockedSuccessors) }] : []; }) : undefined;
+    return { status, storage: storage ? { available: booleanValue(storage.available), error: stringValue(storage.error) } : undefined, counts, interruptedPredecessors: numberValue(obj.interruptedPredecessors), blockedSuccessors: numberValue(obj.blockedSuccessors), expiredOwnedLeases: numberValue(obj.expiredOwnedLeases), oldestDispatchableWaitMs: numberValue(obj.oldestDispatchableWaitMs), oldestBlockedWaitMs: numberValue(obj.oldestBlockedWaitMs), affectedScopes, degradedReasons: Array.isArray(obj.degradedReasons) && obj.degradedReasons.every(v => typeof v === "string") ? obj.degradedReasons : undefined, admissionCapacity: obj.admissionCapacity, bounded: obj.bounded };
+}
 function parseGatewaySafetyPayload(payload, reachable) {
     const obj = objectValue(payload);
     const mode = obj && (obj.mode === "dev" || obj.mode === "prod" || obj.mode === "fallback") ? obj.mode : "unknown";
     const runtimeStatuses = Array.isArray(obj?.runtimeStatuses) ? obj.runtimeStatuses.map(runtimeStatus).filter((item) => Boolean(item)) : [];
     const activeRuns = Array.isArray(obj?.activeRuns) ? obj.activeRuns.map(activeRun).filter((item) => Boolean(item)) : [];
+    const reliability = obj?.reliability === undefined ? undefined : runJobReliability(obj.reliability);
+    const durableMessageQueue = durableMessageQueueStatus(obj?.durableMessageQueue);
     const incomplete = !Array.isArray(obj?.runtimeStatuses) || !Array.isArray(obj?.activeRuns)
-        || runtimeStatuses.length !== obj.runtimeStatuses.length || activeRuns.length !== obj.activeRuns.length;
-    return { reachable, mode, generation: stringValue(obj?.generation), health: obj?.health, runtimeStatuses, activeRuns, ambiguous: incomplete || booleanValue(obj?.ambiguous) };
+        || runtimeStatuses.length !== obj.runtimeStatuses.length || activeRuns.length !== obj.activeRuns.length
+        || (obj?.reliability !== undefined && !reliability)
+        || (obj?.durableMessageQueue !== undefined && !durableMessageQueue?.status);
+    return { reachable, mode, generation: stringValue(obj?.generation), health: obj?.health, runtimeStatuses, activeRuns, reliability, durableMessageQueue, ambiguous: incomplete || booleanValue(obj?.ambiguous) };
 }
 export function checkActiveWork(status, target = "web") {
     const reasons = [];
@@ -337,7 +363,8 @@ function printSafetyStatus(target, status) {
     console.log(`  mode: ${status.mode}`);
     if (status.error)
         console.log(`  status error: ${status.error}`);
-    console.log(`  runtime sessions: ${status.runtimeStatuses.length}`);
+    console.log("  runtime queue layer:");
+    console.log(`    sessions: ${status.runtimeStatuses.length}`);
     for (const session of status.runtimeStatuses) {
         console.log(`    ${session.piboSessionId ?? "unknown"}: processing=${session.processing === true} streaming=${session.streaming === true} queued=${session.queuedMessages ?? 0}`);
         if (session.activeEventId)
@@ -359,6 +386,31 @@ function printSafetyStatus(target, status) {
     console.log(`  active yielded runs: ${status.activeRuns.length}`);
     for (const run of status.activeRuns)
         console.log(`    ${run.runId ?? "unknown"}: ${run.status ?? "active"}${run.toolName ? ` (${run.toolName})` : ""} session=${run.piboSessionId ?? "unknown"}`);
+    if (status.reliability) {
+        console.log(`  run-job reliability: ${status.reliability.status}`);
+        console.log(`    expired orphan jobs: ${status.reliability.expiredOrphanRunJobs}`);
+        console.log(`    orphan DLQ records: ${status.reliability.orphanRunDeadLetters}`);
+    }
+    console.log("  durable message queue layer:");
+    const durable = status.durableMessageQueue;
+    if (!durable)
+        console.log("    status: unavailable (gateway app did not report this layer)");
+    else {
+        console.log(`    status: ${durable.status ?? "ambiguous"}`);
+        console.log(`    storage: ${durable.storage?.available === true ? "available" : "unavailable"}${durable.storage?.error ? ` (${durable.storage.error})` : ""}`);
+        for (const row of durable.counts ?? [])
+            console.log(`    ${row.delivery ?? "unknown"}.${row.state ?? "unknown"}: count=${row.count ?? 0} bytes=${row.bytes ?? 0}`);
+        console.log(`    interrupted predecessors: ${durable.interruptedPredecessors ?? 0}`);
+        console.log(`    FIFO-blocked successors: ${durable.blockedSuccessors ?? 0}`);
+        console.log(`    expired owned leases: ${durable.expiredOwnedLeases ?? 0}`);
+        console.log(`    oldest dispatchable wait: ${durable.oldestDispatchableWaitMs ?? 0}ms`);
+        console.log(`    oldest blocked wait: ${durable.oldestBlockedWaitMs ?? 0}ms`);
+        for (const scope of durable.affectedScopes ?? [])
+            console.log(`    affected session=${scope.sessionId ?? "unknown"} room=${scope.roomId ?? "unknown"} blocker=${scope.blockingCommandId ?? "unknown"} successors=${scope.blockedSuccessors ?? 0}`);
+        for (const reason of durable.degradedReasons ?? [])
+            console.log(`    degraded: ${reason}`);
+    }
+    console.log("  next: pibo debug message-queue");
 }
 function managerRequiresShell(command) {
     return process.platform === "win32" && /\.(?:cmd|bat)$/i.test(command);
@@ -385,8 +437,11 @@ async function waitForManagedGatewayHealth(target) {
 async function runManagedGatewayCommand(target, command, args, argv = process.argv) {
     if (command === "status" || command === "doctor") {
         const status = await readGatewaySafetyStatus(target);
-        printSafetyStatus(target, status);
-        if (target === "web") {
+        if (args.includes("--json"))
+            console.log(JSON.stringify({ ...status, nextCommands: [`pibo gateway ${target} doctor`, `pibo debug message-queue`] }, null, 2));
+        else
+            printSafetyStatus(target, status);
+        if (target === "web" && !args.includes("--json")) {
             const active = checkActiveWork(status, target);
             if (active.unsafe) {
                 console.log("  restart safety: blocked");
@@ -397,8 +452,16 @@ async function runManagedGatewayCommand(target, command, args, argv = process.ar
                 console.log("  restart safety: idle");
             printRestartApproval(status);
         }
-        if (command === "doctor")
-            process.exitCode = status.reachable && !status.error && status.mode === expectedMode(target) ? 0 : 1;
+        if (command === "doctor") {
+            process.exitCode = status.reachable
+                && !status.error
+                && status.mode === expectedMode(target)
+                && status.reliability?.status !== "degraded"
+                && status.durableMessageQueue?.status === "healthy"
+                && status.durableMessageQueue.storage?.available === true
+                ? 0
+                : 1;
+        }
         return true;
     }
     if (command === "start") {
@@ -730,6 +793,7 @@ Commands:
   dev doctor       Check dev gateway health
 
 Options:
+  --json         Print status or doctor output as JSON with next discovery commands
   --force --confirm <snapshot-token>
                  Restart only the work explicitly approved from web status
 

package/dist/gateway/server.js

@@ -360,6 +360,7 @@ export class PiboGatewayServer {
             },
             findSessions: (input) => this.requireSessionStore().find(input),
             listSessions: () => this.requireSessionStore().list?.() ?? [],
+            getSessionStructureRevision: () => this.requireSessionStore().getStructureRevision?.(),
             getSessionRuntimeBinding: (piboSessionId) => this.requireRouter().getSessionRuntimeBinding(piboSessionId),
             getSessionRuntimeProfile: (piboSessionId) => this.requireRouter().getSessionRuntimeProfile(piboSessionId),
             inspectSessionRuntimeHistory: async (piboSessionId) => {
@@ -424,7 +425,9 @@ export class PiboGatewayServer {
             getSessionStatusSnapshot: (piboSessionId, options) => this.requireRouter().getSessionStatusSnapshot(piboSessionId, options),
             getSessionForkCandidates: (piboSessionId) => this.requireRouter().getSessionForkCandidates(piboSessionId),
             listSessionRuntimeStatuses: () => this.requireRouter().listSessionRuntimeStatuses(),
+            getRuntimeCapacityStatus: () => this.requireRouter().getRuntimeCapacityStatus(),
             listRuns: (options) => this.requireRouter().listRuns(options),
+            getRunJobReliabilityStatus: () => this.requireRouter().getRunJobReliabilityStatus(),
             snapshotSignalSession: (piboSessionId) => this.requireRouter().snapshotSignalSession(piboSessionId),
             snapshotSignalTree: (rootPiboSessionId) => this.requireRouter().snapshotSignalTree(rootPiboSessionId),
             snapshotSignalStatuses: () => this.requireRouter().snapshotSignalStatuses(),

package/dist/providers/openai-gpt56.js

@@ -38,6 +38,9 @@ export const OPENAI_CODEX_GPT_6_ASTRA_MODEL = {
     name: "GPT-6-Astra",
     cost: { input: 10, output: 50, cacheRead: 1, cacheWrite: 12.5 },
 };
+// Codex serves the Reserve quota alias from the Luna-class model, so Reserve borrows Luna's metadata.
+export const OPENAI_CODEX_RESERVE_MODEL = { id: "gpt-reserve", name: "Luna Reserve" };
+const OPENAI_CODEX_RESERVE_BASE_MODEL_ID = "gpt-5.6-luna";
 const OPENAI_GPT_56_MODEL_IDS = new Set(OPENAI_GPT_56_MODELS.map((model) => model.id));
 export function getBuiltInOpenAiModels() {
     return getBuiltInProviderModels(OPENAI_PROVIDER_ID);
@@ -69,6 +72,10 @@ export function buildOpenAiCodexGpt56Models(baseModels = getBuiltInOpenAiCodexMo
 }
 export function buildOpenAiCodexSupplementalModels(baseModels = getBuiltInOpenAiCodexModels()) {
     const models = buildOpenAiCodexGpt56Models(baseModels);
+    const reserveBase = models.find((model) => model.id === OPENAI_CODEX_RESERVE_BASE_MODEL_ID);
+    if (reserveBase && !models.some((model) => model.id === OPENAI_CODEX_RESERVE_MODEL.id)) {
+        models.push({ ...cloneModel(reserveBase), ...OPENAI_CODEX_RESERVE_MODEL });
+    }
     if (models.some((model) => model.id === OPENAI_CODEX_GPT_6_ASTRA_MODEL.id))
         return models;
     return [...models, openAiCodexAstraModelToRegistryModel()];
@@ -76,7 +83,7 @@ export function buildOpenAiCodexSupplementalModels(baseModels = getBuiltInOpenAi
 export function registerOpenAiSupplementalModels(modelRegistry, options = {}) {
     const baseOpenAiModels = options.baseOpenAiModels ?? getBuiltInOpenAiModels();
     const openAiModels = buildOpenAiGpt56Models(baseOpenAiModels);
-    const openAiAdded = countMissingGpt56Models(baseOpenAiModels, OPENAI_PROVIDER_ID);
+    const openAiAdded = countAddedModels(baseOpenAiModels, OPENAI_PROVIDER_ID, openAiModels);
     modelRegistry.registerProvider(OPENAI_PROVIDER_ID, {
         baseUrl: OPENAI_BASE_URL,
         api: OPENAI_RESPONSES_API,
@@ -85,9 +92,7 @@ export function registerOpenAiSupplementalModels(modelRegistry, options = {}) {
     });
     const baseOpenAiCodexModels = options.baseOpenAiCodexModels ?? getBuiltInOpenAiCodexModels();
     const openAiCodexModels = buildOpenAiCodexSupplementalModels(baseOpenAiCodexModels);
-    const hasBuiltInAstra = baseOpenAiCodexModels.some((model) => model.provider === OPENAI_CODEX_PROVIDER_ID && model.id === OPENAI_CODEX_GPT_6_ASTRA_MODEL.id);
-    const openAiCodexAdded = countMissingGpt56Models(baseOpenAiCodexModels, OPENAI_CODEX_PROVIDER_ID)
-        + (hasBuiltInAstra ? 0 : 1);
+    const openAiCodexAdded = countAddedModels(baseOpenAiCodexModels, OPENAI_CODEX_PROVIDER_ID, openAiCodexModels);
     modelRegistry.registerProvider(OPENAI_CODEX_PROVIDER_ID, {
         baseUrl: OPENAI_CODEX_BASE_URL,
         api: OPENAI_CODEX_RESPONSES_API,
@@ -128,9 +133,9 @@ function buildProviderGpt56Models(options) {
         .map((model) => openAiGpt56ModelToRegistryModel(model, options));
     return [...providerBaseModels, ...additions];
 }
-function countMissingGpt56Models(baseModels, providerId) {
+function countAddedModels(baseModels, providerId, registeredModels) {
     const existingIds = new Set(baseModels.filter((model) => model.provider === providerId).map((model) => model.id));
-    return OPENAI_GPT_56_MODELS.filter((model) => !existingIds.has(model.id)).length;
+    return registeredModels.filter((model) => !existingIds.has(model.id)).length;
 }
 function cloneModel(model) {
     return {

package/dist/reliability/store.js

@@ -44,12 +44,14 @@ function ensurePiboJobColumn(db, name, definition) {
         db.exec(`ALTER TABLE pibo_jobs ADD COLUMN ${name} ${definition}`);
 }
 export class PiboReliabilityStore {
+    options;
     db;
     appendEventStatement;
     getEventByStreamIdStatement;
     getEventByTopicEventIdStatement;
     getEventByTopicIdempotencyKeyStatement;
-    constructor(path = piboHomePath("pibo-events.sqlite")) {
+    constructor(path = piboHomePath("pibo-events.sqlite"), options = {}) {
+        this.options = options;
         const resolvedPath = path === ":memory:" ? path : resolve(path);
         const insidePiboHome = ensurePrivatePiboHomeForPath(resolvedPath);
         if (resolvedPath !== ":memory:")
@@ -571,6 +573,38 @@ export class PiboReliabilityStore {
         }
         return jobs;
     }
+    inspectJobs(input = {}) {
+        const timestamp = now();
+        return this.listJobs(input).map((job) => this.inspectJob(job, timestamp));
+    }
+    reconcileOrphanRunJobs(input) {
+        const checkedAt = asDate(input.now).toISOString();
+        return this.inImmediateTransaction(() => this.reconcileOrphanRunJobsInTransaction(checkedAt, input.apply));
+    }
+    getRunJobReliabilityStatus() {
+        const timestamp = now();
+        const expired = this.db.prepare(`
+			SELECT COUNT(*) AS count
+			FROM pibo_jobs AS job
+			LEFT JOIN pibo_runs AS run ON run.job_id = job.job_id
+			WHERE job.queue = 'runs'
+				AND job.state = 'running'
+				AND job.claim_expires_at IS NOT NULL
+				AND job.claim_expires_at <= ?
+				AND run.run_id IS NULL
+		`).get(timestamp);
+        const dead = this.db.prepare(`
+			SELECT COUNT(*) AS count FROM pibo_dead_jobs
+			WHERE queue = 'runs' AND dead_reason = 'orphan_run_job'
+		`).get();
+        const expiredOrphanRunJobs = Number(expired.count);
+        const orphanRunDeadLetters = Number(dead.count);
+        return {
+            status: expiredOrphanRunJobs > 0 || orphanRunDeadLetters > 0 ? "degraded" : "ok",
+            expiredOrphanRunJobs,
+            orphanRunDeadLetters,
+        };
+    }
     listRecoverableJobs(input = {}) {
         const timestamp = now();
         const clauses = [
@@ -683,28 +717,37 @@ export class PiboReliabilityStore {
         const runId = input.runId ?? `run_${randomUUID()}`;
         const maxAttempts = Math.max(1, input.maxAttempts ?? 1);
         const timeoutAt = input.timeoutMs === undefined ? undefined : new Date(Date.parse(timestamp) + input.timeoutMs).toISOString();
-        const job = this.enqueue({
-            queue: "runs",
-            payload: {
-                runId,
-                controllerPiboSessionId: input.controllerPiboSessionId,
-                toolName: input.toolName,
-                params: input.params,
-                timeoutMs: input.timeoutMs,
-            },
-            maxAttempts,
+        return this.inImmediateTransaction(() => {
+            const job = this.enqueue({
+                queue: "runs",
+                runAt: timestamp,
+                payload: {
+                    runId,
+                    controllerPiboSessionId: input.controllerPiboSessionId,
+                    toolName: input.toolName,
+                    params: input.params,
+                    timeoutMs: input.timeoutMs,
+                },
+                maxAttempts,
+            });
+            this.options.onRunCreationBoundary?.("after_enqueue");
+            const claimed = this.claimPendingJobInTransaction(job.jobId, input.workerId ?? `run-registry:${process.pid}`, timestamp, 24 * 60 * 60 * 1000);
+            if (!claimed)
+                throw new Error(`Failed to claim newly-created run job "${job.jobId}"`);
+            this.options.onRunCreationBoundary?.("after_claim");
+            this.options.onRunCreationBoundary?.("before_run_insert");
+            this.db
+                .prepare(`
+					INSERT INTO pibo_runs (
+						run_id, kind, controller_pibo_session_id, status, completion_policy, consumed, tool_name,
+						summary, result_json, error, notified_status, acknowledged_status, created_at, updated_at,
+						completed_at, job_id, retryable, max_attempts, timeout_ms, timeout_at, timeout_phase, service_warning, resource_json, origin_json
+					) VALUES (?, 'tool', ?, 'running', ?, 0, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL, ?, ?, ?, ?, ?, NULL, ?, ?, ?)
+				`)
+                .run(runId, input.controllerPiboSessionId, input.completionPolicy, input.toolName, `${input.toolName} run is running.`, timestamp, timestamp, job.jobId, input.retryable ? 1 : 0, maxAttempts, input.timeoutMs ?? null, timeoutAt ?? null, input.serviceWarning ?? null, input.resources ? JSON.stringify(input.resources) : null, input.origin ? JSON.stringify(input.origin) : null);
+            this.options.onRunCreationBoundary?.("after_run_insert");
+            return this.requireRun(runId);
         });
-        this.db
-            .prepare(`
-				INSERT INTO pibo_runs (
-					run_id, kind, controller_pibo_session_id, status, completion_policy, consumed, tool_name,
-					summary, result_json, error, notified_status, acknowledged_status, created_at, updated_at,
-					completed_at, job_id, retryable, max_attempts, timeout_ms, timeout_at, timeout_phase, service_warning, resource_json, origin_json
-				) VALUES (?, 'tool', ?, 'running', ?, 0, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL, ?, ?, ?, ?, ?, NULL, ?, ?, ?)
-			`)
-            .run(runId, input.controllerPiboSessionId, input.completionPolicy, input.toolName, `${input.toolName} run is running.`, timestamp, timestamp, job.jobId, input.retryable ? 1 : 0, maxAttempts, input.timeoutMs ?? null, timeoutAt ?? null, input.serviceWarning ?? null, input.resources ? JSON.stringify(input.resources) : null, input.origin ? JSON.stringify(input.origin) : null);
-        this.claimJob(job.jobId, input.workerId ?? `run-registry:${process.pid}`, 24 * 60 * 60 * 1000);
-        return this.requireRun(runId);
     }
     updateRun(runId, patch) {
         const existing = this.getRun(runId);
@@ -779,9 +822,10 @@ export class PiboReliabilityStore {
     }
     recoverInterruptedRuns(workerId = `run-registry:${process.pid}`) {
         return this.inImmediateTransaction(() => {
+            const timestamp = now();
+            this.reconcileOrphanRunJobsInTransaction(timestamp, true);
             const rows = this.db.prepare("SELECT * FROM pibo_runs WHERE status = 'running'").all();
             const recovered = [];
-            const timestamp = now();
             for (const row of rows) {
                 if (row.job_id && this.hasUnexpiredJobClaim(row.job_id, timestamp, workerId))
                     continue;
@@ -883,6 +927,58 @@ export class PiboReliabilityStore {
 			`)
             .get(jobId, workerId, claimToken ?? null, claimToken ?? null, timestamp);
     }
+    claimPendingJobInTransaction(jobId, workerId, timestamp, visibilityTimeoutMs) {
+        const claimExpiresAt = new Date(Date.parse(timestamp) + visibilityTimeoutMs).toISOString();
+        return this.db.prepare(`
+			UPDATE pibo_jobs
+			SET state = 'running',
+				worker_id = ?,
+				claim_expires_at = ?,
+				claim_token = claim_token + 1,
+				attempts = attempts + 1,
+				updated_at = ?
+			WHERE job_id = ?
+				AND state = 'pending'
+				AND run_at <= ?
+				AND attempts < max_attempts
+				AND (expires_at IS NULL OR expires_at > ?)
+			RETURNING *
+		`).get(workerId, claimExpiresAt, timestamp, jobId, timestamp, timestamp);
+    }
+    inspectJob(job, timestamp) {
+        const claimExpired = job.state === "running"
+            && (!job.claimExpiresAt || job.claimExpiresAt <= timestamp);
+        const missingRunRecord = job.queue === "runs"
+            && this.db.prepare("SELECT 1 AS found FROM pibo_runs WHERE job_id = ? LIMIT 1").get(job.jobId) === undefined;
+        let effectiveLiveness;
+        if (job.state === "pending")
+            effectiveLiveness = missingRunRecord ? "orphan_pending" : "pending";
+        else if (claimExpired)
+            effectiveLiveness = missingRunRecord ? "expired_orphan" : "expired_claim";
+        else
+            effectiveLiveness = missingRunRecord ? "live_orphan_claim" : "live_claim";
+        return { ...job, claimExpired, missingRunRecord, effectiveLiveness };
+    }
+    reconcileOrphanRunJobsInTransaction(timestamp, apply) {
+        const rows = this.db.prepare(`
+			SELECT job.*
+			FROM pibo_jobs AS job
+			LEFT JOIN pibo_runs AS run ON run.job_id = job.job_id
+			WHERE job.queue = 'runs'
+				AND job.state = 'running'
+				AND job.claim_expires_at IS NOT NULL
+				AND job.claim_expires_at <= ?
+				AND run.run_id IS NULL
+			ORDER BY job.created_at ASC, job.job_id ASC
+		`).all(timestamp);
+        const candidates = rows.map((row) => this.inspectJob(jobFromRow(row), timestamp));
+        if (apply) {
+            for (const row of rows) {
+                this.moveJobToDead(row, "Expired runs job has no matching pibo_runs record.", "orphan_run_job", timestamp);
+            }
+        }
+        return { checkedAt: timestamp, apply, candidates, moved: apply ? rows.length : 0 };
+    }
     moveExpiredJobs(timestamp) {
         const expired = this.db.prepare("SELECT * FROM pibo_jobs WHERE expires_at IS NOT NULL AND expires_at <= ?").all(timestamp);
         for (const row of expired)