@platless/axom-cli 0.1.0 → 0.5.9

package/dist/workstation/acp/processorSession.js

@@ -0,0 +1,1512 @@
+/**
+ * One live agent session driven by the deterministic ACP processor over a transport (Task 19, spec 2026-10-11 §5.3/§5.4/§5.7):
+ * the daemon side of keeper-acp — or of the local fallback, which is the same session mechanism in this process.
+ *
+ * ## The record loop
+ *
+ * The transport's raw stream (`subscribeRaw`) is the only input. For each record, in order:
+ * `step(record)` → every command it produced is executed through the transport (`executeDownCommandsVia`: idempotent by cause,
+ * refused unless its spawn runs now, prompt blocks filled from this daemon's memory, `secretRef`s substituted from this daemon's
+ * memory) → a prompt whose blocks are gone is failed with an `agent_prompt_failed` note → the record's frames go out.
+ * Everything the server or this daemon decides reaches the processor as a note or a write first (`agent_prompt`, `agent_answer`,
+ * `agent_interrupt`, …); nothing here changes processor state directly, and nothing here numbers a frame — the processor does —
+ * with the one exception the poison contract names (below).
+ *
+ * ## What leaves
+ *
+ * Frames the manager sends (`onFrames`), unchanged, with `src`. The ones meant for the daemon itself stay here:
+ * `processor.open_result` settles {@link openSession}; `processor.history_event`/`history_end` become the load's backfill
+ * (never journaled: a daemon that dies inside the window loads again); an `agent_steered` / `agent_config_option_set` whose
+ * request this object made settles that call (one with nobody waiting goes out as a frame).
+ *
+ * ## Secrets and blocks
+ *
+ * Prompt and steer blocks are held in memory under a `blocksRef` until their `down` is written; secrets (a delegation bearer)
+ * under a `secretRef`, for the life of the session. Notes carry only the refs (spec §13).
+ *
+ * ## Poison (interface-contracts, "中毒恢复契约")
+ *
+ * A step that throws poisons the processor. The session is degraded: every turn still open ends with a failed `agent_turn_done`
+ * this object numbers itself, after the processor's last seq; the adapter is terminated; `onDegraded` tells the manager, which
+ * retires the session so the next `agent_open` starts a new spawn (`session/load`). Never retried from a checkpoint: replay is
+ * deterministic and would poison again on the same record. A transport that fails under the loop (keeper gone, raw truncated) is
+ * handled the same way: Task 19 has no re-attach (Task 21).
+ *
+ * ## Qoder side files (17c)
+ *
+ * When the repair is on, a 1 s timer asks the processor's **current** `sideDemand` — only once the processor has folded every
+ * record this object appended — runs `BackgroundSideNotes.poll(demand)` and appends the notes it returns, in order. The reader
+ * stops when the demand is `undefined` (no repair any more).
+ *
+ * ## Outbox, backpressure, checkpoints (Task 20, spec §5.5/§5.6)
+ *
+ * The manager records every journaled frame in {@link outbox} (the transport's outbox stream) before it sends it; the listener
+ * {@link onFrames} registers returns that append, and the loop awaits it before folding the next record — so the outbox holding a
+ * frame with `src.o = o` proves record `o`'s commands are in raw, and a checkpoint at `o` never precedes `o`'s frames. Before each
+ * record the loop waits for {@link SessionOutbox.room}: a server that does not acknowledge stops the processor, and the backlog
+ * stays in the raw log.
+ *
+ * Checkpoints (`acp.commit{checkpoint, rawThrough}`, raw truncated to the checkpoint): at the end of every turn; within a turn
+ * every {@link CHECKPOINT_RAW_BYTES} of folded raw or {@link CHECKPOINT_INTERVAL_MS}; and on a `close('keep')` (graceful exit,
+ * detach). Never while `boundaries.sideChunk` holds a half-read Qoder fact or a load's history window is open — deferred to the
+ * next record where both are clear. Each carries `processorVersion` (`checkpointOf`).
+ *
+ * ## A session left under the same key
+ *
+ * An earlier life of this ref (a swept or degraded session, a previous daemon's, a local outbox) is reused, not released: the new
+ * spawn continues the same raw log and outbox. Its unacknowledged frames are read back into {@link outbox} (resent when the server
+ * reopens the ref) and the processor numbers after the highest seq the outbox ever held — `max(outbox.maxSeq, committedTail.seq,
+ * resumeFromSeq)` (§5.5). An earlier life whose adapter still runs is never stopped here: the daemon adopts it at start
+ * ({@link ProcessorSession.adopt}), and keeper-acp refuses a second spawn into a running session.
+ *
+ * ## Adoption (Task 21, spec §5.5)
+ *
+ * A keeper-acp session whose adapter outlived the daemon (restart, upgrade, crash) is adopted, not stopped:
+ * `acp.attach` → the head checkpoint is restored → raw `(checkpoint.offset, replayEnd]` is replayed **updating state only** —
+ * `replayEnd = max(outbox last.src.o, committedTail.src.o)`, everything whose frames were recorded — and the frames the replay
+ * produces are compared byte for byte with the outbox entries that survive (daemon-numbered ones, `src.i ≥ DAEMON_FRAME_INDEX`,
+ * skipped; differences are only counted when the checkpoint came from this very processor version) → the seq continues after
+ * `max(replayed seq, outbox.maxSeq, committedTail.seq)` → the unacknowledged outbox entries are resent on the server's reopen →
+ * the records after `replayEnd` are folded live (their commands are idempotent by cause). A session whose open never completed, or
+ * that cannot be rebuilt (no readable checkpoint and no spawn record left), is refused ({@link AdoptionRefusedError}); the caller
+ * stops its adapter and keeps its outbox. A checkpoint is cut right after the spawn and when the open completes, so every session
+ * has one that says whether it is open.
+ *
+ * ## Detach (Task 21, spec §5.5.5)
+ *
+ * {@link detach} ends this daemon's hold on a keeper-hosted session without touching the adapter: the loop stops after the
+ * record in hand, a head checkpoint is cut when the state is safe (never mid Qoder chunk or load history — then the next daemon
+ * replays), the subscription is dropped. No `session/cancel`, no answer to a pending card, no `turn_done(failed)`: a detaching
+ * session never degrades. The next daemon adopts it.
+ *
+ * ## Keeper connection loss (Task 21)
+ *
+ * keeper-acp unreachable under the loop (a request lost on a dropped connection, a stream that ended) is not a degradation: the
+ * session re-attaches — `acp.attach` (which relaunches the current generation's keeper-acp if it died; an older generation is
+ * only reconnected) and the same rebuild as an adoption, in place — with bounded retries. A note whose append failed is looked
+ * for in raw before it is appended again. Only a keeper that is gone with the session (not found, or unreachable after the
+ * retries) degrades it. When keeper-acp itself restarted, the session it recovered ends with `proc exit{reason:'keeper_lost'}`:
+ * that tail is folded (a real `turn_done` in it is delivered) and the session reports its adapter dead.
+ */
+import { PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk';
+import { ACCOUNT_LIMITS_READ_TIMEOUT_MS } from '../protocol/accountLimits.js';
+import { BackgroundSideNotes, nativeTerminalHistoryPath } from '../qoderAdapter/backgroundTerminal.js';
+import { AgentInitializeTimeoutError, AgentSpawnError, UnsupportedProtocolVersionError } from './acpClient.js';
+import { executeDownCommandsVia } from './processor/transport/types.js';
+import { createProcessor, ProcessorPoisonedError, restoreProcessor } from './processor/step.js';
+import { checkpointOf, decodeCheckpoint, encodeCheckpoint, PROCESSOR_VERSION } from './processor/checkpoint.js';
+import { DAEMON_FRAME_INDEX, isOutboxTail, SessionOutbox, transportOutboxStore } from './outbox.js';
+import { initialState } from './processor/state.js';
+import { activityRaw, runtimeDiagnostics } from './processor/runtime.js';
+import { sideDemand } from './processor/sideChannel.js';
+import { unfinishedAsyncTasks } from './processor/updates.js';
+import { pendingRequestIds } from './processor/session.js';
+import { steeredIds } from './processor/control.js';
+import { RawTruncatedError } from './processor/transport/types.js';
+import { REPAIR_NOTE } from '../qoderAdapter/backgroundTerminalFold.js';
+import { AcpKeeperUnavailableError } from '../keepers/acp/client.js';
+import { AcpErrorCode } from '../keepers/acp/protocol.js';
+import { KeeperClosedError, KeeperConnectionLostError, KeeperNotConnectedError, KeeperRequestError, KeeperRequestTimeoutError, } from '../keepers/kit/client.js';
+/** What the executor reports when a prompt's blocks are no longer in this daemon's memory (interface-contracts). */
+export const PROMPT_LOST = 'The prompt was lost before it reached the agent';
+/** The error a turn ends with when the session degrades under it (poison, or a transport that failed under the loop). */
+export const SESSION_DEGRADED = 'The agent session failed and was stopped; reopen it to continue';
+/** How often the Qoder side-file reader polls (the live repair's timer). */
+const SIDE_POLL_MS = 1_000;
+/** stderr kept for a startup failure's message (the `err` records the processor ignores). */
+const STDERR_TAIL_BYTES = 8_192;
+/** Within a turn, a checkpoint every this many bytes of folded raw (spec §5.5, §14). */
+export const CHECKPOINT_RAW_BYTES = 8 * 1024 * 1024;
+/** …or every this long (spec §5.5, §14). */
+export const CHECKPOINT_INTERVAL_MS = 60_000;
+/** Re-attach attempts after keeper-acp's connection was lost, before the session is given up (Task 21). */
+export const REATTACH_ATTEMPTS = 6;
+/** The first retry's delay; it doubles up to {@link REATTACH_BACKOFF_MAX_MS}. */
+export const REATTACH_BACKOFF_MS = 250;
+export const REATTACH_BACKOFF_MAX_MS = 8_000;
+/** More re-attaches than this within {@link REATTACH_WINDOW_MS} is a connection that keeps failing: the session degrades. */
+export const REATTACH_LIMIT = 5;
+export const REATTACH_WINDOW_MS = 60_000;
+/** Steer/config replies this object already settled: one the record loop produces again (after a re-attach) is not sent twice. */
+const SETTLED_REPLIES_KEPT = 256;
+/** A keeper-acp session this daemon will not continue (its open never completed, or it cannot be rebuilt): the caller stops it. */
+export class AdoptionRefusedError extends Error {
+    constructor(message) { super(message); this.name = 'AdoptionRefusedError'; }
+}
+const delay = (ms) => new Promise((resolve) => { setTimeout(resolve, ms).unref?.(); });
+/** keeper-acp could not be reached for this request (the connection dropped, or it is relaunching): a re-attach may fix it. */
+export function isConnectionLoss(error) {
+    return error instanceof KeeperConnectionLostError || error instanceof KeeperNotConnectedError ||
+        error instanceof KeeperRequestTimeoutError || error instanceof AcpKeeperUnavailableError;
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+function lastLines(text, count) {
+    return text.split('\n').filter((line) => line.trim()).slice(-count).join(' | ');
+}
+export class ProcessorSession {
+    options;
+    spawnId;
+    transport;
+    key;
+    /** Replaced (in place) when the session re-attaches after keeper-acp's connection was lost. */
+    processor;
+    /** Bumped by every re-attach: a fold of an older subscription stops. */
+    generation = 0;
+    reattaching;
+    reattaches = [];
+    settledReplies = [];
+    /** The session left this daemon without stopping its adapter ({@link detach}). */
+    detached = false;
+    /**
+     * Every journaled frame of the records through this offset is in the outbox (fix round 1): a checkpoint is never cut past it — the
+     * next daemon would restore past frames it never recorded, and their seqs would be skipped. Frames produced before the manager
+     * registered ({@link onFrames}) are only buffered: from the first such record ({@link unrecordedFrom}) it stops advancing until
+     * their append has landed.
+     */
+    recordedThrough = -1;
+    routedThrough = -1;
+    unrecordedFrom;
+    /** The open was complete (and no load history open) after the last record: its completion is checkpointed (Task 21). */
+    wasOpen = false;
+    /** The last rebuild (adoption, or a re-attach), for diagnostics. */
+    recovery;
+    /** Stops listening for keeper-acp connection drops. */
+    unlisten = () => { };
+    /** This session was adopted from a previous daemon (Task 21), not spawned by this one. */
+    adopted;
+    blocks = new Map();
+    secrets = new Map();
+    pendingReplies = new Map();
+    waiters = new Set();
+    log;
+    subscription;
+    frameListener;
+    /** The transport's outbox for this session (Task 20): the manager records frames here before sending them. */
+    outbox;
+    /** Highest seq this object numbered itself (degraded turns). */
+    daemonSeq = 0;
+    /** Checkpoint cadence: raw folded and time since the last checkpoint, and a checkpoint waiting for a safe record. */
+    sinceCheckpoint = { bytes: 0, records: 0, at: Date.now() };
+    checkpointDue = false;
+    /**
+     * The checkpoint due is only a marker (the spawn, the open completed — Task 21): cut without truncating raw, which only the spec's
+     * own cadence (turn end, 8 MiB / 60 s, exit/detach) does.
+     */
+    checkpointKeepsRaw = false;
+    /** A record is being folded (from `step` until its frames are recorded): not a boundary a checkpoint may be cut at. */
+    inRecord = false;
+    boundaryWaiters = [];
+    buffered = [];
+    degradedListener;
+    adapterExitListener;
+    /** An adapter exit folded before anyone listened ({@link onAdapterExited} delivers it on registration). */
+    undeliveredExit;
+    degraded;
+    closing;
+    refs = 0;
+    /** The highest offset this object appended (notes it wrote): the processor has caught up once it folded it. */
+    appended = -1;
+    stderr = '';
+    openResult;
+    historyEnd;
+    history = [];
+    side;
+    /** The record loop's tail: notes it appends are serialised behind it. */
+    chain = Promise.resolve();
+    /** The loop is held at a record boundary for a switch ({@link suspend}); `release` lets it go on. */
+    suspension;
+    /** Records delivered while the loop was held ({@link suspend}); reset by every suspend. */
+    suspendedArrivals = 0;
+    /** Wall-clock time the last record was folded (the switch's quiet period, spec §6.3 step 2). */
+    lastFoldAtMs = Date.now();
+    constructor(options, spawnId, outbox, processor, adopted) {
+        this.options = options;
+        this.spawnId = spawnId;
+        this.transport = options.transport;
+        this.key = options.sessionKey;
+        this.outbox = outbox;
+        this.processor = processor;
+        this.adopted = adopted;
+        // An adoption's rebuilt state: every record it holds had its frames recorded (through replayEnd), or none to record.
+        this.recordedThrough = adopted ? processor.state.offset : -1;
+        this.routedThrough = this.recordedThrough;
+        this.wasOpen = processor.state.open.status === 'open' && processor.state.history === null;
+        // A spawned session cuts its first checkpoint at the first safe record (its spawn): the seq floor it was given is then on
+        // record, so an adoption never has to guess it (Task 21).
+        this.checkpointDue = !adopted;
+        this.checkpointKeepsRaw = !adopted;
+        this.log = options.log ?? ((line) => console.warn(line));
+        this.unlisten = this.transport.onConnectionLost?.((error) => {
+            this.transportFailure(`keeper-acp connection lost: ${error.message}`, new KeeperConnectionLostError(error.message));
+        }) ?? (() => { });
+    }
+    /**
+     * Spawn the adapter in `sessionKey` and start the record loop. A session an earlier life left under the same key is reused (see
+     * the file comment): its adapter, if it still runs, is stopped (Task 21 adopts it instead), and its outbox is read back.
+     */
+    static async start(options) {
+        const { transport, sessionKey, seed } = options;
+        let spawned;
+        try {
+            spawned = await transport.spawn(sessionKey, options.spawn, { label: options.label, ...(seed ? { baseOffset: seed.baseOffset } : {}) });
+        }
+        catch (error) {
+            // keeper-acp unreachable is not a launch failure: the caller falls back to the local transport.
+            if (error instanceof AcpKeeperUnavailableError)
+                throw error;
+            throw spawnFailure(options.spawn.command, error);
+        }
+        let session;
+        try {
+            // The down-cause index (an earlier life's downs are in raw) and the outbox an earlier life left: unacknowledged frames are
+            // resent when the server reopens the ref, and numbering continues after the highest seq the outbox ever held.
+            const attached = await transport.attach(sessionKey);
+            let leftovers = await readOutboxTail(transport, sessionKey, attached.outbox);
+            if (seed && seed.imports.length > 0) {
+                // A switch's successor (Task 24): the predecessor's unacknowledged frames land here before anything this session numbers —
+                // the predecessor is released only after this append returned (never the other way round: the frames would be nowhere).
+                const at = Math.max(spawned.o - 1, 0);
+                const entries = seed.imports.map((entry, k) => ({ seq: entry.seq, src: { o: at, i: DAEMON_FRAME_INDEX + k }, frame: { ...entry.frame } }));
+                const { first } = await transport.appendOutbox(sessionKey, entries);
+                leftovers = [...leftovers, ...entries.map((entry, k) => ({ o: first + k, t: Date.now(), ...entry }))];
+            }
+            // A child whose relation the processor has folded (this life's, or a load's replayed history) is not an orphan for the
+            // outbox's relation rule (outbox.ts): the processor's relation graph says so.
+            let relatedBy;
+            const outbox = new SessionOutbox(transportOutboxStore(transport, sessionKey), {
+                leftovers, committedTail: attached.committedTail, isRelated: (child) => relatedBy?.(child) ?? false,
+            });
+            let processor;
+            if (seed) {
+                // The predecessor's checkpoint (spec §6.3 step 5), its offset moved to just before this log's first record (the spawn).
+                processor = restoreProcessor(seed.checkpoint);
+                const seeded = processor.state;
+                seeded.offset = spawned.o - 1;
+                seeded.seq = Math.max(seeded.seq, options.seqBase, outbox.lastSeq);
+            }
+            else {
+                const state = initialState();
+                state.seq = Math.max(options.seqBase, outbox.lastSeq);
+                processor = createProcessor({ state });
+            }
+            session = new ProcessorSession({ transport, sessionKey, label: options.label, backfill: options.backfill, command: options.spawn.command,
+                ...(options.onClosed ? { onClosed: options.onClosed } : {}), ...(options.onDegrade ? { onDegrade: options.onDegrade } : {}),
+                ...(options.log ? { log: options.log } : {}) }, spawned.spawnId, outbox, processor, false);
+            const started = session;
+            relatedBy = (child) => Object.hasOwn(started.processor.state.permissionParents, child);
+            // `agent_launch` is the record right after the spawn, before the loop folds the spawn (and writes `initialize`): one order.
+            await started.holdingLoop(async () => {
+                started.subscription = await started.subscribe(spawned.o);
+                await started.appendNote({ type: 'agent_launch', launch: options.launch });
+                if (options.installOutcome) {
+                    await started.appendNote({ type: 'agent_install_outcome', ...options.installOutcome });
+                }
+                if (options.outputGap)
+                    await started.appendNote({ type: 'agent_output_gap', detail: options.outputGap });
+            });
+        }
+        catch (error) {
+            if (!session) {
+                await transport.terminate(sessionKey).catch(() => null);
+                throw error;
+            }
+            // The adapter is running and nobody will drive it: stop it before reporting the failure (an outbox an earlier life left
+            // stays, for the next open).
+            await session.close('auto').catch(() => undefined);
+            throw error;
+        }
+        return session;
+    }
+    static async adopt(options) {
+        const { transport, sessionKey } = options;
+        const attached = await transport.attach(sessionKey);
+        const process = attached.process;
+        const running = process.state === 'running' || process.state === 'starting';
+        const exited = process.state === 'exited' && options.allowExited === true;
+        if (!running && !exited)
+            throw new AdoptionRefusedError(`its adapter is ${process.state}`);
+        // An exited adapter's session is rebuilt only when it may have a turn to finish (fix round 2): a cheap look first, so an idle
+        // one is not replayed on every boot for nothing.
+        if (!running && !await mayHaveTurnToFinish(transport, sessionKey, attached))
+            return undefined;
+        const leftovers = await readOutboxTail(transport, sessionKey, attached.outbox);
+        const { processor, report } = await rebuildProcessor(transport, sessionKey, attached, leftovers);
+        const state = processor.state;
+        let spawnId;
+        if (running) {
+            if (state.process.status !== 'running' || state.process.spawn.spawnId !== process.spawnId) {
+                throw new AdoptionRefusedError('its checkpoint and raw log do not reach the running adapter');
+            }
+            if (state.open.status !== 'open' || state.history !== null)
+                throw new AdoptionRefusedError('its open had not completed');
+            spawnId = state.process.spawn.spawnId;
+        }
+        else {
+            // Nothing to finish: no turn was running where the replay stopped.
+            if (state.turns.length === 0)
+                return undefined;
+            const exitedSpawn = process.spawnId;
+            const lastSpawn = state.process.status === 'running' ? state.process.spawn.spawnId
+                : state.process.status === 'exited' ? state.process.spawnId : undefined;
+            if (exitedSpawn === null || lastSpawn !== exitedSpawn) {
+                throw new AdoptionRefusedError('its checkpoint and raw log do not reach its last adapter');
+            }
+            spawnId = exitedSpawn;
+        }
+        let session;
+        const outbox = new SessionOutbox(transportOutboxStore(transport, sessionKey), {
+            leftovers, committedTail: attached.committedTail,
+            isRelated: (child) => session !== undefined && Object.hasOwn(session.processor.state.permissionParents, child),
+        });
+        // The spawn spec stayed with the daemon that made it; the command only names the agent in startup errors, which an adopted
+        // session (long past `initialize`) never reports.
+        const command = String(options.label.agentId ?? 'agent');
+        session = new ProcessorSession({ transport, sessionKey, label: options.label, backfill: false, command,
+            ...(options.onClosed ? { onClosed: options.onClosed } : {}), ...(options.onDegrade ? { onDegrade: options.onDegrade } : {}),
+            ...(options.log ? { log: options.log } : {}) }, spawnId, outbox, processor, true);
+        session.recovery = report;
+        session.reportRecovery(running ? 'adopted' : 'adopted (its adapter has exited: folding the tail)', report);
+        session.subscription = await session.subscribe(state.offset + 1);
+        return session;
+    }
+    reportRecovery(how, report) {
+        const divergence = report.counted ? `${report.diverged} of ${report.compared} recorded frame(s) differed`
+            : `${report.compared} recorded frame(s) not compared (checkpoint from another processor version, or none)`;
+        const line = `[acp] session ${this.key} ${how}: replayed ${report.replayed} record(s) from ${report.from} through ${report.replayEnd}; ${divergence}`;
+        if (report.counted && report.diverged > 0)
+            this.log(line);
+        else
+            console.info(line);
+    }
+    // ---- the record loop ----------------------------------------------------------------------------------------------------
+    /** The raw subscription from `from`, its records folded by the loop of the current generation. */
+    subscribe(from) {
+        const generation = this.generation;
+        return this.transport.subscribeRaw(this.key, from, (records) => this.onRecords(records, generation), {
+            onClosed: (error) => { if (generation === this.generation)
+                this.transportFailure(`raw stream closed: ${error.message}`, error, true); },
+        });
+    }
+    onRecords(records, generation) {
+        // Held for a switch (Task 24 fix round 1): whatever the adapter wrote meanwhile would never be folded if the switch went ahead.
+        // Only adapter output (`up`) counts (fix round 2): stderr lines (`err`) and the like must not hold a switch back.
+        if (this.suspension)
+            this.suspendedArrivals += records.filter((record) => record.kind === 'up').length;
+        const run = this.chain.then(() => this.fold(records, generation));
+        this.chain = run.catch(() => undefined);
+        return run;
+    }
+    /**
+     * Mid-record: a re-attach (a new generation) or a degrade abandons the record — a degrade has numbered and routed its own frames
+     * already, and this record's would follow them out of seq order (fix round 2). A close or detach lets it finish (fix round 1, I-1).
+     */
+    abandoned(generation) {
+        return generation !== this.generation || this.degraded !== undefined;
+    }
+    /** The loop of this generation must stop: degraded, closing or detached, or replaced by a re-attach. */
+    stopped(generation) {
+        return this.degraded !== undefined || this.closing !== undefined || generation !== this.generation;
+    }
+    async fold(records, generation) {
+        for (const record of records) {
+            if (this.stopped(generation))
+                return;
+            // Backpressure (§5.6): no more frames while this life's unacknowledged backlog fills the window.
+            const room = this.outbox.room();
+            if (room)
+                await room;
+            if (this.stopped(generation))
+                return;
+            if (record.kind === 'err')
+                this.stderr = `${this.stderr}${record.line}\n`.slice(-STDERR_TAIL_BYTES);
+            this.inRecord = true;
+            try {
+                if (!await this.foldOne(record, generation))
+                    return;
+            }
+            finally {
+                this.inRecord = false;
+                for (const resolve of this.boundaryWaiters.splice(0))
+                    resolve();
+            }
+        }
+    }
+    /** One record: step, its commands, its frames recorded, then the checkpoint cadence. `false`: the loop must stop. */
+    async foldOne(record, generation) {
+        const turnsBefore = this.processor.state.turns.length;
+        const invalidBefore = this.processor.state.diagnostics.invalidEvents;
+        // An exit of a running adapter: whether anything was open is read before the fold closes it all.
+        const exiting = record.kind === 'proc' && record.proc.type === 'exit' && this.processor.state.process.status === 'running';
+        const busyBefore = exiting && (this.liveness.turnRunning || pendingRequestIds(this.processor.state).length > 0);
+        let output;
+        try {
+            output = this.processor.step(record);
+        }
+        catch (error) {
+            this.degrade(error instanceof ProcessorPoisonedError || this.processor.poisoned !== undefined
+                ? `processor poisoned at record ${record.o}: ${this.processor.poisoned ?? error.message}`
+                : `record ${record.o} could not be folded: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        let report;
+        try {
+            report = await executeDownCommandsVia(this.transport, this.key, output.commands, (ref) => this.blocks.get(ref), (ref) => this.secrets.get(ref));
+        }
+        catch (error) {
+            if (this.reattachable(error)) {
+                // keeper-acp went away mid-record: the re-attach rebuilds from what keeper-acp holds and folds this record again (its
+                // commands are idempotent by cause), so nothing of it goes out from here.
+                this.transportFailure(`a command could not be written: ${error.message}`, error);
+                return false;
+            }
+            // The record was folded: its frames (a turn that ended on it, numbered) go out before the session degrades, so no turn
+            // loses its `turn_done` and no seq is skipped.
+            void this.route(output.frames)?.catch(() => undefined);
+            this.degrade(`a command could not be written: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        // Mid-record, only a re-attach (a new generation) abandons the record — it is folded again from what keeper-acp holds. A close
+        // or detach that arrived meanwhile lets this record finish: its frames are recorded, or they would be lost behind the head
+        // checkpoint and their seqs skipped (fix round 1, I-1).
+        if (this.abandoned(generation))
+            return false;
+        for (const command of [...report.written, ...report.dropped, ...report.refused]) {
+            if (command.fill)
+                this.blocks.delete(command.fill.blocksRef);
+        }
+        for (const command of report.unresolved) {
+            if (command.fill)
+                this.blocks.delete(command.fill.blocksRef);
+            const requestId = JSON.parse(command.line).id;
+            if (typeof requestId === 'number') {
+                await this.appendNote({ type: 'agent_prompt_failed', requestId, error: PROMPT_LOST }).catch((error) => {
+                    this.transportFailure(`a note could not be written: ${error instanceof Error ? error.message : String(error)}`, error);
+                });
+            }
+        }
+        const invalid = this.processor.state.diagnostics.invalidEvents - invalidBefore;
+        if (invalid > 0) {
+            // The contract check runs before numbering (`processor/emit.ts`): nothing was numbered or sent for these. Named here, as
+            // the manager's `onAgentEvent` used to name each one, so an adapter's contract violation is visible in the daemon log.
+            this.log(`[acp:${String(this.options.label.agentId)} agent:${String(this.options.label.agentKey)}] dropped ${invalid} event(s) ` +
+                `for ${this.key} that fail the wire contract (record ${record.o})`);
+        }
+        if (this.abandoned(generation))
+            return false;
+        try {
+            await this.route(output.frames);
+        }
+        catch (error) {
+            // The outbox refused the frames: they were neither recorded nor sent. The session cannot keep its delivery promise — unless
+            // keeper-acp only went away for a while: the re-attach reads back what landed and folds this record again.
+            this.transportFailure(`frames could not be recorded: ${error instanceof Error ? error.message : String(error)}`, error);
+            return false;
+        }
+        if (this.abandoned(generation))
+            return false;
+        this.routedThrough = record.o;
+        this.lastFoldAtMs = Date.now();
+        if (this.unrecordedFrom === undefined)
+            this.recordedThrough = record.o;
+        this.settleWaiters();
+        this.afterRecord(record, turnsBefore);
+        if (exiting && record.kind === 'proc' && record.proc.type === 'exit' && this.processor.state.process.status === 'exited') {
+            const exit = record.proc;
+            this.adapterExited({ spawnId: this.processor.state.process.spawnId, reason: exit.reason, busy: busyBefore,
+                code: exit.code, signal: exit.signal, stderrTail: exit.stderrTail });
+        }
+        return true;
+    }
+    /** Tells the manager (once its frames are recorded: a failed `turn_done` precedes whatever the manager says about the exit). */
+    adapterExited(exit) {
+        if (this.closing || this.degraded !== undefined)
+            return;
+        if (!this.adapterExitListener) {
+            this.undeliveredExit = exit;
+            return;
+        }
+        try {
+            this.adapterExitListener(exit);
+        }
+        catch { /* a listener never stops the loop */ }
+    }
+    // ---- checkpoints (Task 20) ------------------------------------------------------------------------------------------------
+    /** The cadence (spec §5.5): a turn ended, or 8 MiB of raw / 60 s since the last checkpoint. Cut on the first safe record. */
+    afterRecord(record, turnsBefore) {
+        const since = this.sinceCheckpoint;
+        since.bytes += recordBytes(record);
+        since.records += 1;
+        const state = this.processor.state;
+        // The spec's cadence (§5.5): these checkpoints truncate raw to themselves.
+        if ((turnsBefore > 0 && state.turns.length === 0) || since.bytes >= CHECKPOINT_RAW_BYTES || Date.now() - since.at >= CHECKPOINT_INTERVAL_MS) {
+            this.checkpointDue = true;
+            this.checkpointKeepsRaw = false;
+        }
+        // The open completed (a load's history closed too): a marker checkpoint, so an adoption knows the session is open (Task 21).
+        const open = state.open.status === 'open' && state.history === null;
+        if (open && !this.wasOpen && !this.checkpointDue) {
+            this.checkpointDue = true;
+            this.checkpointKeepsRaw = true;
+        }
+        this.wasOpen = open;
+        if (this.checkpointDue && this.checkpointSafe())
+            this.cutCheckpoint();
+    }
+    /**
+     * A checkpoint must let a replay continue from it alone: not while a chunked Qoder fact is half-read (`sideChunk`, its first
+     * chunks would be truncated away) nor inside a load's history window (history is never journaled: a daemon that dies in the
+     * window loads again — interface-contracts, T19).
+     */
+    checkpointSafe() {
+        const state = this.processor.state;
+        return state.offset >= 0 && state.offset <= this.recordedThrough && state.boundaries.sideChunk === null && state.history === null &&
+            this.processor.poisoned === undefined;
+    }
+    /** Snapshot now (a record boundary: the loop is between records) and commit it with raw truncated through it (not a marker's). */
+    cutCheckpoint(keepRaw = this.checkpointKeepsRaw) {
+        const checkpoint = checkpointOf(this.processor.state);
+        this.checkpointDue = false;
+        this.checkpointKeepsRaw = false;
+        this.sinceCheckpoint = { bytes: 0, records: 0, at: Date.now() };
+        return this.outbox.commitCheckpoint(checkpoint.offset, encodeCheckpoint(checkpoint), !keepRaw).catch((error) => {
+            this.log(`[acp] session ${this.key}: checkpoint at record ${checkpoint.offset} failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    }
+    /**
+     * A head checkpoint on the loop (graceful exit, detach — spec §5.5): after the record being folded, if anything was folded
+     * since the last one and the state is safe to cut. Resolves once it is written (or skipped).
+     */
+    async checkpoint() {
+        // Between records — also while the loop waits for room: everything folded so far has its frames recorded.
+        while (this.inRecord)
+            await new Promise((resolve) => { this.boundaryWaiters.push(resolve); });
+        if (this.sinceCheckpoint.records === 0 && !this.checkpointDue)
+            return;
+        if (!this.checkpointSafe())
+            return;
+        await this.cutCheckpoint(false);
+    }
+    // ---- switching (Task 24, spec §6.3) ---------------------------------------------------------------------------------------
+    /**
+     * Hold the record loop at a record boundary for a switch: every record delivered so far is folded and its frames are recorded,
+     * nothing more is folded until {@link resume} (or a close). Answers the processor's checkpoint there — the successor's initial
+     * state (spec §6.3 step 5) — or `undefined` when the session cannot be held (degraded, closing, already held). The adapter is not
+     * touched: a switch that does not go ahead resumes it as if nothing happened.
+     */
+    async suspend() {
+        if (this.degraded !== undefined || this.closing || this.suspension)
+            return undefined;
+        let release;
+        const gate = new Promise((resolve) => { release = resolve; });
+        let reached;
+        const atGate = new Promise((resolve) => { reached = resolve; });
+        this.suspension = { release };
+        this.suspendedArrivals = 0;
+        this.chain = this.chain.then(() => { reached(); return gate; });
+        await atGate;
+        await this.outbox.flush();
+        if (this.degraded !== undefined || this.closing || this.processor.poisoned !== undefined) {
+            this.resume();
+            return undefined;
+        }
+        return checkpointOf(this.processor.state);
+    }
+    /**
+     * Records the transport delivered since {@link suspend} held the loop — output of the predecessor's adapter that only this session
+     * can fold. A switch must not stop the adapter while any is waiting (fix round 1): it would be dropped with the predecessor's log.
+     */
+    get arrivedWhileSuspended() { return this.suspension ? this.suspendedArrivals : 0; }
+    /**
+     * A switch stops the adapter while the loop stays held (fix round 2): keeper-acp records whatever the adapter still writes on its
+     * way out into raw, where only this session can fold it. Answers the exit.
+     */
+    async stopAdapter() {
+        await this.transport.terminate(this.key);
+    }
+    /** Resolves once the loop has folded every record through `offset` (after a {@link resume}). */
+    foldedThrough(offset, timeoutMs = 10_000) {
+        return this.waitFor(() => (this.processor.state.offset >= offset ? true : undefined), timeoutMs);
+    }
+    /** The switch did not go ahead: the loop folds on from where {@link suspend} held it. */
+    resume() {
+        const suspension = this.suspension;
+        this.suspension = undefined;
+        suspension?.release();
+    }
+    /** The transport session key (Task 24: a switch moves a ref to a new key). */
+    get sessionKey() { return this.key; }
+    /** Which transport hosts the session (only a keeper-hosted one can be switched). */
+    get transportMode() { return this.transport.mode; }
+    /** The spawn label (`{sessionRef, agentId, agentKey, buildId, version, kind, specDigest, keyGen?}`). */
+    get label() { return this.options.label; }
+    /** Wall-clock time of the last folded record. */
+    get lastFoldAt() { return this.lastFoldAtMs; }
+    /** Async tasks / background work the adapter still runs for this session (processor state): a switch would kill them. */
+    get liveBackgroundWork() {
+        const state = this.processor.state;
+        return unfinishedAsyncTasks(state).length + (sideDemand(state)?.active() ? 1 : 0);
+    }
+    /** The adapter's exit, once it has one: the spawn it ended and why (keeper-acp's `reason`, absent for an exit of its own). */
+    get adapterExit() {
+        const process = this.processor.state.process;
+        if (process.status !== 'exited')
+            return undefined;
+        const reason = process.exit.reason;
+        return { spawnId: process.spawnId, reason: typeof reason === 'string' ? reason : undefined };
+    }
+    /** The session degraded (its adapter is being stopped; the manager retires it). */
+    get isDegraded() { return this.degraded !== undefined; }
+    route(frames) {
+        const out = [];
+        for (const output of frames) {
+            const frame = output.frame;
+            switch (frame.t) {
+                case 'processor.open_result':
+                    this.openResult = frame.ok === true
+                        ? { ok: true, mode: frame.mode, nativeSessionId: frame.nativeSessionId ?? null,
+                            configOptions: frame.configOptions ?? [] }
+                        : { ok: false, mode: frame.mode, error: String(frame.error),
+                            ...(typeof frame.code === 'number' ? { code: frame.code } : {}) };
+                    continue;
+                case 'processor.history_event':
+                    if (this.options.backfill) {
+                        const { t: _t, ...event } = frame;
+                        this.history.push(event);
+                    }
+                    continue;
+                case 'processor.history_end': {
+                    const droppedCount = typeof frame.droppedCount === 'number' ? frame.droppedCount : 0;
+                    this.historyEnd = { ok: frame.ok === true, droppedCount };
+                    if (droppedCount > 0) {
+                        this.log(`[acp] session ${this.key}: ${droppedCount} history update(s) could not be mapped and were left out of the replayed history`);
+                    }
+                    continue;
+                }
+                case 'agent_steered':
+                case 'agent_account_read_result':
+                case 'agent_config_option_set': {
+                    const key = typeof frame.id === 'string' ? `${frame.t}:${frame.id}` : undefined;
+                    const reply = key !== undefined ? this.pendingReplies.get(key) : undefined;
+                    if (reply) {
+                        this.pendingReplies.delete(key);
+                        this.settledReplies.push(key);
+                        if (this.settledReplies.length > SETTLED_REPLIES_KEPT)
+                            this.settledReplies.shift();
+                        reply(frame);
+                        continue;
+                    }
+                    // A reply this object already handed over, produced again by a re-attach's live fold: not a second answer.
+                    if (key !== undefined && this.settledReplies.includes(key))
+                        continue;
+                    out.push(output);
+                    continue;
+                }
+                default:
+                    if (typeof frame.t === 'string' && frame.t.startsWith('processor.'))
+                        continue;
+                    out.push(output);
+            }
+        }
+        if (out.length === 0)
+            return undefined;
+        // Before the manager registers: journaled frames wait for it; levels do not (`agent_opened` carries them from state).
+        if (!this.frameListener) {
+            const journaled = out.filter((frame) => frame.journaled);
+            if (journaled.length > 0)
+                this.unrecordedFrom ??= journaled[0].src.o;
+            this.buffered.push(...journaled);
+            return undefined;
+        }
+        return this.frameListener(out) ?? undefined;
+    }
+    settleWaiters() {
+        for (const waiter of [...this.waiters]) {
+            if (waiter.check())
+                this.waiters.delete(waiter);
+        }
+    }
+    /** Resolves once `ready()` returns a value; rejects on `deadline` or when the session degrades/closes. */
+    waitFor(ready, timeoutMs, timeoutError) {
+        return new Promise((resolve, reject) => {
+            let timer;
+            const waiter = {
+                check: () => {
+                    const value = ready();
+                    if (value === undefined)
+                        return false;
+                    if (timer)
+                        clearTimeout(timer);
+                    resolve(value);
+                    return true;
+                },
+                reject: (error) => {
+                    if (timer)
+                        clearTimeout(timer);
+                    this.waiters.delete(waiter);
+                    reject(error);
+                },
+            };
+            if (waiter.check())
+                return;
+            if (this.degraded !== undefined) {
+                reject(new Error(this.degraded));
+                return;
+            }
+            if (this.closing) {
+                reject(new Error('The agent session is closed'));
+                return;
+            }
+            this.waiters.add(waiter);
+            if (timeoutMs !== undefined) {
+                timer = setTimeout(() => waiter.reject(timeoutError ? timeoutError() : new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+            }
+        });
+    }
+    async appendNote(note) {
+        // The earliest offset this note can land at: everything the processor folded is older.
+        const floor = this.processor.state.offset + 1;
+        let o;
+        try {
+            ({ o } = await this.transport.note(this.key, note));
+        }
+        catch (error) {
+            if (!this.reattachable(error))
+                throw error;
+            // keeper-acp went away: the note may have landed before the reply was lost. Once re-attached, look for it before appending.
+            await this.reattach(error);
+            if (this.degraded !== undefined || this.closing)
+                throw error;
+            const landed = await this.findNote(note, floor);
+            o = landed ?? (await this.transport.note(this.key, note)).o;
+        }
+        if (o > this.appended)
+            this.appended = o;
+        return o;
+    }
+    /** The offset of a note identical to `note` at or after `from` in raw, if one landed there. */
+    async findNote(note, from) {
+        const wanted = JSON.stringify(note);
+        for (let at = from;;) {
+            let page;
+            try {
+                page = await this.transport.readRaw(this.key, at);
+            }
+            catch (error) {
+                if (error instanceof RawTruncatedError && error.first > at) {
+                    at = error.first;
+                    continue;
+                }
+                throw error;
+            }
+            if (page.length === 0)
+                return undefined;
+            for (const record of page)
+                if (record.kind === 'note' && JSON.stringify(record.note) === wanted)
+                    return record.o;
+            at = page[page.length - 1].o + 1;
+        }
+    }
+    /** Append a note and resolve once the processor has folded it. */
+    async noteFolded(note) {
+        const o = await this.appendNote(note);
+        await this.waitFor(() => (this.processor.state.offset >= o ? true : undefined));
+    }
+    /** Fire-and-forget note: a transport failure degrades the session (nothing reached the log). */
+    send(note) {
+        return this.appendNote(note).then(() => undefined, (error) => {
+            this.transportFailure(`a note could not be written: ${error instanceof Error ? error.message : String(error)}`, error);
+            throw error;
+        });
+    }
+    // ---- keeper connection loss (Task 21) ------------------------------------------------------------------------------------
+    /** A transport failure keeper-acp may recover from: this session re-attaches instead of degrading. */
+    reattachable(error) {
+        return this.transport.mode === 'keeper' && !this.detached && isConnectionLoss(error);
+    }
+    /**
+     * The transport failed under the session. keeper-acp that only went away (or a stream that ended: `stream` — the re-attach finds
+     * out whether the session is still there) → re-attach; the daemon closing its own client → nothing (it is going away); anything
+     * else → degrade.
+     */
+    transportFailure(reason, error, stream = false) {
+        if (this.closing || this.degraded !== undefined)
+            return;
+        if (error instanceof KeeperClosedError)
+            return;
+        if (this.reattachable(error) || (stream && this.transport.mode === 'keeper' && !this.detached)) {
+            void this.reattach(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
+        this.degrade(reason);
+    }
+    /**
+     * Re-attach after keeper-acp's connection was lost (see the file comment): drop the subscription, attach again, rebuild the
+     * processor and the outbox from what keeper-acp holds, subscribe after the rebuilt offset. Bounded: a session keeper-acp no longer
+     * has, or one it cannot be reached for after {@link REATTACH_ATTEMPTS}, degrades. Shared by concurrent failures.
+     */
+    reattach(cause) {
+        if (this.reattaching)
+            return this.reattaching;
+        if (this.closing || this.degraded !== undefined)
+            return Promise.resolve();
+        const now = Date.now();
+        while (this.reattaches.length > 0 && now - this.reattaches[0] > REATTACH_WINDOW_MS)
+            this.reattaches.shift();
+        if (this.reattaches.length >= REATTACH_LIMIT) {
+            this.degrade(`keeper-acp connection keeps failing (${REATTACH_LIMIT} re-attaches within ${REATTACH_WINDOW_MS / 1000} s): ${cause.message}`);
+            return Promise.resolve();
+        }
+        if (this.processor.state.history !== null) {
+            // Inside a load's history window: what was folded of it went to this object's backfill, and a rebuild would fold part of it
+            // again (or skip what the replay discards). The load is redone instead — the open fails, the next one spawns and loads anew
+            // (interface-contracts: a daemon that dies inside the window loads again).
+            this.degrade(`keeper-acp connection lost during a load's history: ${cause.message}`);
+            return Promise.resolve();
+        }
+        this.reattaches.push(now);
+        this.generation += 1;
+        this.log(`[acp] session ${this.key}: keeper-acp connection lost (${cause.message}); re-attaching`);
+        this.reattaching = (async () => {
+            const old = this.subscription;
+            this.subscription = undefined;
+            void old?.unsubscribe().catch(() => undefined);
+            // No stream operation may land after the outbox is read back.
+            await this.outbox.flush();
+            let last = cause;
+            for (let attempt = 0; attempt < REATTACH_ATTEMPTS; attempt += 1) {
+                if (this.closing || this.degraded !== undefined)
+                    return;
+                if (attempt > 0)
+                    await delay(Math.min(REATTACH_BACKOFF_MS * 2 ** (attempt - 1), REATTACH_BACKOFF_MAX_MS));
+                try {
+                    const attached = await this.transport.attach(this.key);
+                    const leftovers = await readOutboxTail(this.transport, this.key, attached.outbox);
+                    // No seq floor of its own: a frame this session numbered but never recorded was never sent either, and folding its record
+                    // again numbers it the same.
+                    const { processor, report } = await rebuildProcessor(this.transport, this.key, attached, leftovers);
+                    if (this.closing || this.degraded !== undefined)
+                        return;
+                    this.processor = processor;
+                    this.recordedThrough = this.unrecordedFrom === undefined ? processor.state.offset : Math.min(this.recordedThrough, processor.state.offset);
+                    this.routedThrough = processor.state.offset;
+                    this.outbox.rebase({ leftovers, committedTail: attached.committedTail });
+                    this.recovery = report;
+                    this.reportRecovery('re-attached', report);
+                    this.subscription = await this.subscribe(processor.state.offset + 1);
+                    this.settleWaiters();
+                    return;
+                }
+                catch (error) {
+                    last = error;
+                    // The session is gone (keeper-acp no longer has it), or what it holds cannot be continued: no retry helps.
+                    if (error instanceof AdoptionRefusedError || (error instanceof KeeperRequestError && error.code === AcpErrorCode.notFound))
+                        break;
+                    if (error instanceof KeeperClosedError)
+                        return;
+                }
+            }
+            this.degrade(`keeper-acp lost this session: ${last instanceof Error ? last.message : String(last)}`);
+        })().finally(() => { this.reattaching = undefined; });
+        return this.reattaching;
+    }
+    // ---- degradation --------------------------------------------------------------------------------------------------------
+    degrade(reason) {
+        if (this.degraded !== undefined || this.closing)
+            return;
+        this.degraded = reason;
+        this.unlisten();
+        this.log(`[acp] session ${this.key} degraded: ${reason}`);
+        // The poison contract: open turns end failed, numbered after the processor's last seq by this daemon.
+        const state = this.processor.state;
+        let seq = state.seq;
+        // The processor's open turns, and the admitted prompts whose note it never folded (they would otherwise never end).
+        const unfolded = [...this.promptsInFlight].filter((pending) => pending.o === undefined || pending.o > state.offset);
+        this.promptsInFlight.clear();
+        const frames = [...state.turns, ...unfolded].map((turn, index) => ({
+            journaled: true,
+            src: { o: Math.max(state.offset, 0), i: DAEMON_FRAME_INDEX + index },
+            frame: { t: 'agent_turn_done', seq: ++seq, status: 'failed', ...(turn.platformTurnId !== undefined ? { platformTurnId: turn.platformTurnId } : {}),
+                nativeSessionId: state.rootSessionId, error: SESSION_DEGRADED },
+        }));
+        this.daemonSeq = seq;
+        // These frames usually fail to record too — a degrade is mostly the transport failing (or a failed append itself). Then
+        // nothing carries their turns' end: the manager's `agent_session_lost{sweep}` (`notifySwept`) does — the server ends the
+        // turn when the session is lost.
+        // The loop may be waiting for room: it must see the degradation and stop, not wait for an ack.
+        this.outbox.stopWaiting();
+        if (frames.length > 0) {
+            if (this.frameListener)
+                void Promise.resolve(this.frameListener(frames)).catch(() => undefined);
+            else
+                this.buffered.push(...frames);
+        }
+        for (const waiter of [...this.waiters])
+            waiter.reject(new Error(reason));
+        for (const [, reply] of this.pendingReplies)
+            reply({ ok: false, error: reason });
+        this.pendingReplies.clear();
+        this.stopSide();
+        void this.transport.terminate(this.key).catch(() => null);
+        try {
+            this.options.onDegrade?.(this.headSeq);
+        }
+        catch { /* a bookkeeping hook never stops the degrade */ }
+        this.degradedListener?.(reason);
+    }
+    // ---- open ---------------------------------------------------------------------------------------------------------------
+    /** The `initialize` reading, or the failure today's `connectAgent` reports for it. */
+    async initialized(timeoutMs) {
+        const command = this.options.command;
+        const result = await this.waitFor(() => {
+            const state = this.processor.state;
+            if (state.initialize.status === 'ready' || state.initialize.status === 'failed')
+                return state.initialize;
+            return undefined;
+        }, timeoutMs, () => {
+            const detail = this.stderr.trim();
+            return new AgentInitializeTimeoutError(`Agent '${command}' did not respond to initialize within ${timeoutMs}ms.` +
+                (detail ? ` Last stderr: ${lastLines(detail, 6)}` : ''), detail);
+        });
+        if (result.status === 'ready') {
+            if (result.facts.droppedAuthMethods > 0) {
+                this.log(`[acp] agent '${result.facts.agentInfo?.name ?? command}' advertised ${result.facts.droppedAuthMethods} auth method(s) ` +
+                    'without the required id/name; ignoring them');
+            }
+            return result.facts;
+        }
+        const detail = this.stderr.trim();
+        switch (result.reason) {
+            case 'unsupported_protocol':
+                throw new UnsupportedProtocolVersionError(`Agent '${command}' negotiated protocol version ${String(result.protocolVersion)}, ` +
+                    `but this client only supports version ${PROTOCOL_VERSION}.`);
+            case 'rpc_error':
+                throw new RequestError(result.code ?? -32603, result.detail ?? 'initialize failed');
+            case 'malformed':
+                throw new Error(`Agent '${command}' answered initialize with a malformed result${result.detail ? `: ${result.detail}` : ''}`);
+            case 'closed': {
+                const exit = this.processor.state.process.status === 'exited' ? this.processor.state.process.exit : undefined;
+                const tail = exit?.stderrTail?.trim() || detail;
+                const summary = `Agent process for '${command}' exited before responding to initialize ` +
+                    `(code=${exit?.code ?? 'null'}, signal=${exit?.signal ?? 'null'}).`;
+                throw new AgentSpawnError(tail ? `${summary} stderr: ${lastLines(tail, 6)}` : summary, tail);
+            }
+        }
+    }
+    /** Register a secret for `secretRef` substitution in this session's down lines; returns its ref. */
+    secret(value) {
+        this.refs += 1;
+        const ref = `axom-secret-ref:${this.spawnId}:${this.refs}`;
+        this.secrets.set(ref, value);
+        return ref;
+    }
+    /**
+     * `session/new|load|resume` through an `agent_session_open` note; resolves with the processor's open result. A load's history
+     * window stays open until {@link endHistory}.
+     */
+    async openSession(request) {
+        this.openResult = undefined;
+        const note = {
+            type: 'agent_session_open', mode: request.mode, cwd: request.cwd,
+            ...(request.sessionId !== undefined ? { sessionId: request.sessionId } : {}),
+            mcpServers: request.mcpServers,
+            ...(request.redact && request.redact.length > 0 ? { redact: [...request.redact] } : {}),
+            ...(request.delegation ? { delegation: request.delegation } : {}),
+        };
+        const repair = request.mode === 'load' ? request.repair : undefined;
+        if (repair) {
+            // The repair note must follow the open note before the loop folds the open note (and so writes the `session/load` line
+            // the history answers): the loop is held while both are appended.
+            await this.holdingLoop(async () => {
+                await this.send(note);
+                await this.enableRepair(request.sessionId, request.cwd, repair.historyHome);
+            });
+        }
+        else {
+            await this.send(note);
+        }
+        return this.waitFor(() => this.openResult);
+    }
+    /** Runs `work` (appends only — never a wait on the loop) with the record loop held, so no record is folded meanwhile. */
+    async holdingLoop(work) {
+        let release;
+        const gate = new Promise((resolve) => { release = resolve; });
+        this.chain = this.chain.then(() => gate);
+        try {
+            return await work();
+        }
+        finally {
+            release();
+        }
+    }
+    /** A load's history is over (the daemon's decision, analysis B A4): write `historyEnd` and wait for the window to close. */
+    async endHistory() {
+        if (!this.historyEnd)
+            await this.send({ type: 'historyEnd' });
+        return this.waitFor(() => this.historyEnd);
+    }
+    /**
+     * Turn the Qoder background terminal repair on (17c): the `qoder_terminal_repair` note, then the side-file reader. Nothing for a
+     * runtime the repair does not certify (no history path).
+     */
+    async enableRepair(nativeSessionId, cwd, historyHome, restoreCalls = false) {
+        const path = nativeTerminalHistoryPath(this.agentInfo, nativeSessionId, cwd, historyHome);
+        if (!path || this.side?.nativeSessionId === nativeSessionId)
+            return;
+        // A load that failed and fell back to `session/new`: the processor closed the load's repair (`settleOpen`); its reader goes
+        // too, and the new session gets its own (the old path closed the attached session and opened a fresh one).
+        this.stopSide();
+        const from = await this.appendNote({ type: REPAIR_NOTE, nativeSessionId, ...(restoreCalls ? { restoreCalls: true } : {}) });
+        const reader = new BackgroundSideNotes({ path, nativeSessionId, cwd, restoreCalls });
+        const timer = setInterval(() => { void this.pollSide(); }, SIDE_POLL_MS);
+        timer.unref();
+        this.side = { reader, timer, from, polling: false, nativeSessionId };
+    }
+    async pollSide() {
+        const side = this.side;
+        if (!side || side.polling || this.degraded !== undefined || this.closing)
+            return;
+        // The demand is the processor's *current* state, so only once it has folded everything this object appended.
+        if (this.processor.state.offset < Math.max(side.from, this.appended))
+            return;
+        const demand = sideDemand(this.processor.state);
+        if (!demand) {
+            this.stopSide();
+            return;
+        }
+        side.polling = true;
+        try {
+            const notes = await side.reader.poll(demand);
+            for (const note of notes)
+                await this.appendNote(note);
+        }
+        catch (error) {
+            this.log(`[acp] session ${this.key}: background terminal read failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            side.polling = false;
+        }
+    }
+    stopSide() {
+        if (!this.side)
+            return;
+        clearInterval(this.side.timer);
+        this.side.reader.close();
+        this.side = undefined;
+    }
+    // ---- AcpAgentSession ----------------------------------------------------------------------------------------------------
+    get facts() {
+        const initialize = this.processor.state.initialize;
+        return initialize.status === 'ready' ? initialize.facts : undefined;
+    }
+    /** The processor's `initialize` reading, once {@link initialized} resolved. */
+    get initializeFacts() { return this.facts; }
+    get capabilities() { return this.facts?.capabilities; }
+    get agentInfo() { return this.facts?.agentInfo; }
+    get supportsSteering() { return this.facts?.supportsSteering ?? false; }
+    get steeringTimings() { return this.facts?.steeringTimings ?? []; }
+    get supportsImageInput() { return this.facts?.capabilities.promptImage ?? false; }
+    get configOptions() { return this.processor.state.configOptions ?? []; }
+    get runtimeDiagnostics() { return runtimeDiagnostics(this.processor.state); }
+    get activityRaw() { return activityRaw(this.processor.state); }
+    get delegation() { return this.processor.state.delegation ?? null; }
+    get nativeSessionId() {
+        const root = this.processor.state.rootSessionId;
+        return root !== null && root.length > 0 ? root : null;
+    }
+    /** Hosted by keeper-acp: the session outlives this daemon (`agent_opened.durable`, spec §5.5.4). */
+    get durable() { return this.transport.mode === 'keeper'; }
+    /** Every unanswered permission/elicitation card (`agent_opened.pendingRequestIds`, spec §5.5.4). */
+    get pendingRequestIds() { return pendingRequestIds(this.processor.state); }
+    /** Steers injected or written and not yet answered (`agent_opened.steeredIds`, spec §5.5.4). */
+    get steeredIds() { return steeredIds(this.processor.state); }
+    get liveness() {
+        const state = this.processor.state;
+        for (const pending of [...this.promptsInFlight]) {
+            if (pending.o !== undefined && pending.o <= state.offset)
+                this.promptsInFlight.delete(pending);
+        }
+        return {
+            agentAlive: this.degraded === undefined && !this.closing && state.process.status === 'running' && state.closed === undefined,
+            // An admitted prompt is a turn from the moment the manager hands it over, as it was when `AcpSession.prompt` pushed its
+            // turn synchronously: its note is counted until the processor has folded it (then `state.turns` has it, or it ended).
+            turnRunning: state.turns.length > 0 || this.promptsInFlight.size > 0,
+        };
+    }
+    /** Admitted prompts whose note the processor has not folded yet (`o` once appended). */
+    promptsInFlight = new Set();
+    holdBlocks(blocks) {
+        this.refs += 1;
+        const ref = `blocks-${this.refs}`;
+        this.blocks.set(ref, blocks);
+        return ref;
+    }
+    prompt(blocks, platformTurnId) {
+        const blocksRef = this.holdBlocks(blocks);
+        const pending = platformTurnId !== undefined ? { platformTurnId } : {};
+        this.promptsInFlight.add(pending);
+        this.appendNote({ type: 'agent_prompt', blocksRef, ...(platformTurnId !== undefined ? { platformTurnId } : {}) }).then((o) => { pending.o = o; }, (error) => {
+            this.promptsInFlight.delete(pending);
+            this.transportFailure(`a note could not be written: ${error instanceof Error ? error.message : String(error)}`, error);
+        });
+    }
+    refusePrompt(platformTurnId) {
+        // No blocks are held: the processor ends the turn on the note itself.
+        void this.send({ type: 'agent_prompt', blocksRef: 'refused', admitted: false, ...(platformTurnId !== undefined ? { platformTurnId } : {}) })
+            .catch(() => undefined);
+    }
+    answer(requestId, outcome) {
+        void this.send({ type: 'agent_answer', requestId, outcome }).catch(() => undefined);
+    }
+    answerElicitation(requestId, response) {
+        const content = 'content' in response && isRecord(response.content) ? response.content : undefined;
+        void this.send({ type: 'agent_elicitation_answer', requestId, action: response.action, ...(content ? { content } : {}) }).catch(() => undefined);
+    }
+    async interrupt() {
+        await this.send({ type: 'agent_interrupt' });
+    }
+    /**
+     * The processor's reply to the request this object is about to note, by the server's frame id. The callers refuse a second
+     * request under an id still in flight: the processor would drop its note (one steer per id) and nothing would answer it.
+     */
+    reply(kind, id) {
+        const key = `${kind}:${id}`;
+        if (this.degraded !== undefined || this.closing)
+            return Promise.resolve({ ok: false, error: this.degraded ?? 'The agent session is closed' });
+        return new Promise((resolve) => this.pendingReplies.set(key, resolve));
+    }
+    async steer(blocks, priority, id) {
+        if (this.pendingReplies.has(`agent_steered:${id}`))
+            throw new Error(`A steer with id '${id}' is already in flight`);
+        const answered = this.reply('agent_steered', id);
+        await this.send({ type: 'agent_steer', id, blocksRef: this.holdBlocks(blocks), ...(priority !== undefined ? { priority } : {}) })
+            .catch((error) => { this.pendingReplies.delete(`agent_steered:${id}`); throw error; });
+        const frame = await answered;
+        if (frame.ok !== true)
+            throw new Error(String(frame.error));
+        return frame.outcome;
+    }
+    async setConfigOption(configId, value, id) {
+        if (this.pendingReplies.has(`agent_config_option_set:${id}`))
+            throw new Error(`A config change with id '${id}' is already in flight`);
+        const answered = this.reply('agent_config_option_set', id);
+        await this.send({ type: 'agent_set_config_option', id, configId, value })
+            .catch((error) => { this.pendingReplies.delete(`agent_config_option_set:${id}`); throw error; });
+        const frame = await answered;
+        if (frame.ok !== true)
+            throw new Error(String(frame.error));
+        return frame.configOptions;
+    }
+    get accountLimitsVersion() { const init = this.processor.state.initialize; return init.status === 'ready' ? init.facts.accountLimitsVersion ?? 1 : 0; }
+    get supportsAccountLimits() { const init = this.processor.state.initialize; return init.status === 'ready' && init.facts.supportsAccountLimits === true && this.accountLimitsVersion >= 2; }
+    get accountLimits() { return this.processor.state.accountLimits; }
+    async readAccountLimits(id) {
+        const answered = this.reply('agent_account_read_result', id);
+        await this.send({ type: 'agent_account_read', id }).catch(error => { this.pendingReplies.delete(`agent_account_read_result:${id}`); throw error; });
+        let timer;
+        let frame;
+        try {
+            frame = await Promise.race([answered, new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Failed to fetch usage')), ACCOUNT_LIMITS_READ_TIMEOUT_MS); })]);
+        }
+        finally {
+            clearTimeout(timer);
+            this.pendingReplies.delete(`agent_account_read_result:${id}`);
+        }
+        if (frame.ok !== true)
+            throw new Error(String(frame.error));
+        return frame.snapshot;
+    }
+    async stopAsyncTask(asyncTaskId) {
+        await this.send({ type: 'agent_async_task_stop', asyncTaskId });
+    }
+    async note(note) {
+        await this.noteFolded(note);
+    }
+    /**
+     * The manager's frame pipeline. What it returns for a batch (the outbox append) is awaited by the record loop before the next
+     * record; frames buffered before registration are handed over now (their append runs ahead of anything the loop produces next,
+     * on the manager's per-session queue).
+     */
+    onFrames(cb) {
+        this.frameListener = cb;
+        const pending = this.buffered;
+        this.buffered = [];
+        if (pending.length > 0) {
+            void Promise.resolve(cb(pending)).then(() => {
+                // The buffered frames landed; every record routed since landed before them or after (one outbox chain).
+                this.unrecordedFrom = undefined;
+                this.recordedThrough = this.routedThrough;
+            }, (error) => {
+                this.transportFailure(`frames could not be recorded: ${error instanceof Error ? error.message : String(error)}`, error);
+            });
+        }
+        else if (this.unrecordedFrom !== undefined) {
+            this.unrecordedFrom = undefined;
+            this.recordedThrough = this.routedThrough;
+        }
+    }
+    /** The processor's head seq (spec §5.5.2 `journalMaxSeq`): every seq this session numbered, or its outbox held. */
+    get headSeq() {
+        return Math.max(this.processor.state.seq, this.daemonSeq, this.outbox.lastSeq);
+    }
+    /** The adapter exited under the live loop ({@link AdapterExitNotice}); one folded before this call is delivered at once. */
+    onAdapterExited(cb) {
+        this.adapterExitListener = cb;
+        const pending = this.undeliveredExit;
+        this.undeliveredExit = undefined;
+        if (pending && !this.closing && this.degraded === undefined)
+            cb(pending);
+    }
+    onDegraded(cb) {
+        this.degradedListener = cb;
+        if (this.degraded !== undefined)
+            cb(this.degraded);
+    }
+    /** The load's history (only when asked for, and only once the window closed with it). */
+    get backfill() {
+        if (!this.options.backfill || this.history.length === 0)
+            return undefined;
+        const history = this.history;
+        return async function* backfill() { for (const event of history)
+            yield event; };
+    }
+    /**
+     * Leave the session to the next daemon (spec §5.5.5, Task 21): the loop stops after the record in hand, a head checkpoint is cut
+     * when the state is safe to cut (otherwise the next daemon replays from the last one), the subscription is dropped. The adapter
+     * keeps running; nothing is written to it (no `session/cancel`, no answer to a pending card) and no turn ends — a detaching session
+     * never degrades. Pending steer/config replies stay unanswered (`agent_opened.steeredIds` lets the server decide). Only a
+     * keeper-hosted session can be detached (a local adapter dies with the daemon): for one, this is `close('keep')`.
+     */
+    detach() {
+        if (this.transport.mode !== 'keeper')
+            return this.close('keep');
+        this.closing ??= (async () => {
+            this.resume();
+            this.detached = true;
+            this.unlisten();
+            this.stopSide();
+            for (const waiter of [...this.waiters])
+                waiter.reject(new Error('The agent session was handed to the next daemon'));
+            // A loop waiting for room stops (it sees `closing`); the head checkpoint is cut at the record boundary after it.
+            this.outbox.stopWaiting();
+            await this.checkpoint().catch(() => undefined);
+            await this.subscription?.unsubscribe().catch(() => undefined);
+            await this.outbox.flush();
+            this.blocks.clear();
+            this.secrets.clear();
+        })();
+        return this.closing;
+    }
+    /**
+     * Ends the session and its adapter: the subscription stops and the adapter is terminated. `release` (an `agent_close`) also drops
+     * the transport session — raw, outbox and checkpoints. `keep` (a sweep, a degraded session, a dropped open) keeps them, after a
+     * head checkpoint: the unacknowledged frames are resent when the ref is reopened, and its numbering continues there. `auto` (an
+     * open that failed): keep while the outbox still holds unacknowledged frames (an earlier life's), release otherwise.
+     */
+    close(requested = 'release') {
+        const mode = requested === 'auto' ? (this.outbox.pending.length > 0 ? 'keep' : 'release') : requested;
+        this.closing ??= (async () => {
+            this.resume(); // a held loop drains (every fold sees `closing`)
+            this.unlisten();
+            this.stopSide();
+            for (const waiter of [...this.waiters])
+                waiter.reject(new Error('The agent session is closed'));
+            for (const [, reply] of this.pendingReplies)
+                reply({ ok: false, error: 'The agent session is closed' });
+            this.pendingReplies.clear();
+            // A loop waiting for room stops; the chain then drains (every fold sees `closing`) and the head checkpoint runs after it.
+            this.outbox.stopWaiting();
+            if (mode === 'keep' && this.degraded === undefined)
+                await this.checkpoint().catch(() => undefined);
+            await this.subscription?.unsubscribe().catch(() => undefined);
+            await this.transport.terminate(this.key).catch(() => null);
+            await this.outbox.flush();
+            if (mode === 'release')
+                await this.transport.release(this.key).catch(() => undefined);
+            this.blocks.clear();
+            this.secrets.clear();
+            await this.options.onClosed?.();
+        })();
+        return this.closing;
+    }
+}
+/** A spawn the transport could not make, in the words `connectAgent` used for the same failure. */
+function spawnFailure(command, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/\bENOENT\b/.test(message)) {
+        return new AgentSpawnError(`Could not launch '${command}': no such command on PATH. ` +
+            'If this is npx or uvx, make sure it is installed and reachable from this process.');
+    }
+    return new AgentSpawnError(`Failed to launch '${command}': ${message}`);
+}
+/** Unacknowledged outbox records an earlier life left (past the stream's watermark), read in pages. */
+export async function readOutboxTail(transport, sessionKey, state) {
+    if (!state)
+        return [];
+    const out = [];
+    for (let from = Math.max(state.first, state.committed + 1); from < state.next;) {
+        const page = await transport.readOutbox(sessionKey, from);
+        if (page.length === 0)
+            break;
+        out.push(...page);
+        from = page[page.length - 1].o + 1;
+    }
+    return out;
+}
+/**
+ * Rebuild a session's processor from what keeper-acp holds (spec §5.5.1; Task 21): the checkpoint restored — or, without a readable
+ * one, a fresh processor from this life's spawn record (the last `proc spawn` raw still holds) — then raw replayed through
+ * `replayEnd = max(outbox last.src.o, committedTail.src.o)` **updating state only**: the frames it produces are compared with the
+ * outbox entries that survive (daemon-numbered ones skipped) and dropped; no command is executed (every record up to `replayEnd`
+ * had its commands written before its frames were recorded). The seq then continues after the highest of the replayed seq, the
+ * outbox's and the watermark's (and `seqFloor`). Throws {@link AdoptionRefusedError} when that is not
+ * possible (no checkpoint and no spawn record left, a gap in raw, a record the processor cannot fold).
+ */
+/**
+ * Whether an exited adapter's session may still have a turn running (Task 23 fix round 2), without replaying anything: its head
+ * checkpoint (cut at every turn end) says no turn is running, and no prompt was admitted after it (no `agent_prompt` note, no
+ * `session/prompt` down in the raw records the checkpoint does not cover — for an idle session only its exit and a few notes, since
+ * raw is truncated to the checkpoint). A checkpoint this processor cannot read, or none, answers `true`: the rebuild decides.
+ */
+export async function mayHaveTurnToFinish(transport, sessionKey, attached) {
+    if (!attached.checkpoint)
+        return true;
+    let checkpoint;
+    try {
+        checkpoint = decodeCheckpoint(Buffer.from(attached.checkpoint.blob, 'base64').toString('utf8'));
+    }
+    catch {
+        return true;
+    }
+    if (checkpoint.processorVersion !== PROCESSOR_VERSION || !Array.isArray(checkpoint.state.turns) || checkpoint.state.turns.length > 0) {
+        return true;
+    }
+    for (let at = checkpoint.offset + 1;;) {
+        let page;
+        try {
+            page = await transport.readRaw(sessionKey, at);
+        }
+        catch {
+            return true;
+        }
+        if (page.length === 0)
+            return false;
+        for (const record of page) {
+            if (record.kind === 'note' && record.note.type === 'agent_prompt')
+                return true;
+            if (record.kind === 'down' && record.line.includes('"session/prompt"'))
+                return true;
+        }
+        at = page[page.length - 1].o + 1;
+    }
+}
+export async function rebuildProcessor(transport, sessionKey, attached, leftovers, seqFloor = 0) {
+    let checkpoint;
+    let unreadable;
+    if (attached.checkpoint) {
+        try {
+            checkpoint = decodeCheckpoint(Buffer.from(attached.checkpoint.blob, 'base64').toString('utf8'));
+        }
+        catch (error) {
+            unreadable = error instanceof Error ? error.message : String(error);
+        }
+    }
+    const tail = isOutboxTail(attached.committedTail) ? attached.committedTail : undefined;
+    const replayEnd = Math.max(leftovers.length > 0 ? leftovers[leftovers.length - 1].src.o : -1, tail?.src.o ?? -1);
+    let processor;
+    let from;
+    if (checkpoint) {
+        processor = restoreProcessor(checkpoint);
+        from = checkpoint.offset + 1;
+    }
+    else {
+        const spawn = await lastSpawnRecord(transport, sessionKey, attached);
+        if (spawn === undefined) {
+            throw new AdoptionRefusedError(`${unreadable ? `its checkpoint is unreadable (${unreadable})` : 'it has no checkpoint'} and raw no longer holds its spawn`);
+        }
+        processor = createProcessor();
+        from = spawn;
+    }
+    const produced = new Map();
+    let replayed = 0;
+    for (let at = from; at <= replayEnd;) {
+        let page;
+        try {
+            page = await transport.readRaw(sessionKey, at);
+        }
+        catch (error) {
+            if (error instanceof RawTruncatedError)
+                throw new AdoptionRefusedError(`raw no longer holds records ${at}..${error.first - 1}`);
+            throw error;
+        }
+        if (page.length === 0)
+            throw new AdoptionRefusedError(`raw ends before record ${at} (the outbox reaches ${replayEnd})`);
+        for (const record of page) {
+            if (record.o > replayEnd)
+                break;
+            let output;
+            try {
+                output = processor.step(record);
+            }
+            catch (error) {
+                throw new AdoptionRefusedError(`record ${record.o} could not be replayed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            replayed += 1;
+            for (const frame of output.frames)
+                if (frame.journaled)
+                    produced.set(`${frame.src.o}:${frame.src.i}`, JSON.stringify(frame.frame));
+            at = record.o + 1;
+        }
+    }
+    let compared = 0;
+    let diverged = 0;
+    for (const entry of leftovers) {
+        if (entry.src.i >= DAEMON_FRAME_INDEX || entry.src.o < from || entry.src.o > replayEnd)
+            continue;
+        compared += 1;
+        if (produced.get(`${entry.src.o}:${entry.src.i}`) !== JSON.stringify(entry.frame))
+            diverged += 1;
+    }
+    // nextSeq = max(replayed seq, outbox.maxSeq, committedTail.seq, the floor) + 1 (§5.5): never a seq the server may have applied, or
+    // one an earlier life numbered (a frame the projection withheld from an old server is numbered but never recorded). Set here, as
+    // the start seeds it (the processor's own steps never lower it).
+    const state = processor.state;
+    state.seq = Math.max(state.seq, seqFloor, tail?.seq ?? 0, ...leftovers.map((entry) => entry.seq));
+    return {
+        processor,
+        report: { checkpoint: checkpoint?.offset ?? null, from, replayEnd, replayed, compared, diverged,
+            counted: checkpoint !== undefined && checkpoint.processorVersion === PROCESSOR_VERSION },
+    };
+}
+/** The offset of the last `proc spawn` record raw still holds (this life's start), if any. */
+async function lastSpawnRecord(transport, sessionKey, attached) {
+    let found;
+    for (let at = attached.raw?.first ?? 0; at <= attached.head;) {
+        let page;
+        try {
+            page = await transport.readRaw(sessionKey, at);
+        }
+        catch {
+            return undefined;
+        }
+        if (page.length === 0)
+            break;
+        for (const record of page)
+            if (record.kind === 'proc' && record.proc.type === 'spawn')
+                found = record.o;
+        at = page[page.length - 1].o + 1;
+    }
+    return found;
+}
+/** The checkpoint cadence's measure of a record: its line (or note) length. */
+function recordBytes(record) {
+    switch (record.kind) {
+        case 'up':
+        case 'down':
+        case 'err':
+            return record.line.length;
+        case 'note':
+            return JSON.stringify(record.note).length;
+        default:
+            return 256;
+    }
+}