@quantiya/codevibe-core 2.0.78 → 2.0.80

package/dist/orchestration-shell/cli.js

@@ -8927,7 +8927,15 @@ var import_zod = require("zod"), MAX_SYNC_SOURCE_ANCHOR_BYTES = 64 * 1024, count
   anchor,
   reason: import_zod.z.enum(["BACKLOG_LIMIT", "OVERSIZED_RECORD", "PARTIAL_RECORD", "MALFORMED_RECORD", "EMPTY_RECORD"]),
   discardUntilNewline: import_zod.z.boolean()
-}).strict().refine((value) => value.endOffset > value.startOffset && value.anchor.endOffset === value.endOffset && value.anchor.startOffset >= value.startOffset && (!value.discardUntilNewline || ["BACKLOG_LIMIT", "OVERSIZED_RECORD", "PARTIAL_RECORD"].includes(value.reason))), position = import_zod.z.object({ byteOffset: count2, anchor: anchor.nullable(), discardUntilNewline: import_zod.z.boolean() }).strict().refine((value) => value.byteOffset === 0 ? value.anchor === null && !value.discardUntilNewline : value.anchor?.endOffset === value.byteOffset), frameAnchor = (value) => value.anchor ?? {
+}).strict().refine((value) => value.endOffset > value.startOffset && value.anchor.endOffset === value.endOffset && value.anchor.startOffset >= value.startOffset && (!value.discardUntilNewline || ["BACKLOG_LIMIT", "OVERSIZED_RECORD", "PARTIAL_RECORD"].includes(value.reason))), position = import_zod.z.object({ byteOffset: count2, anchor: anchor.nullable(), discardUntilNewline: import_zod.z.boolean() }).strict().refine((value) => value.byteOffset === 0 ? value.anchor === null && !value.discardUntilNewline : value.anchor?.endOffset === value.byteOffset);
+function validSourceRebase(previous, target2, skipped) {
+  return position.safeParse({
+    byteOffset: previous.byteOffset,
+    anchor: previous.anchor,
+    discardUntilNewline: previous.discardUntilNewline
+  }).success && previous.byteOffset > 0 && anchor.safeParse(target2).success && typeof skipped == "boolean";
+}
+var frameAnchor = (value) => value.anchor ?? {
   startOffset: value.startOffset,
   endOffset: value.endOffset,
   sha256: value.sourceSha256
@@ -9039,6 +9047,26 @@ function createSourceJournal(options) {
         row3.byteOffset = next.endOffset, row3.anchor = next.anchor, row3.discardUntilNewline = next.discardUntilNewline, row3.skippedBytes += next.endOffset - next.startOffset, row3.lastGap = next, row3.lastFrame = null, row3.projection = null, await write(row3, assertOwnership);
       });
     },
+    rebase: async (previous, target2, skippedHistory, recordedAt, recoveryProjection = null) => {
+      if (!validSourceRebase(previous, target2, skippedHistory) || !Number.isSafeInteger(recordedAt) || recordedAt < 1 || !projection.safeParse(recoveryProjection).success) return options.invalid();
+      await options.locked(async (assertOwnership) => {
+        await recoverLocked(assertOwnership);
+        let row3 = await required(), occurrence = `rebase:${previous.byteOffset}:${previous.anchor.sha256}:${Number(skippedHistory)}:${recordedAt}`;
+        if (row3.lastFrame?.occurrence === occurrence && row3.byteOffset === target2.endOffset && JSON.stringify(row3.anchor) === JSON.stringify(target2))
+          return row3.projection !== recoveryProjection ? options.invalid() : void 0;
+        if (row3.entries.length) throw Error("SYNC_SOURCE_RECOVERY_PENDING");
+        if (row3.byteOffset !== previous.byteOffset || row3.discardUntilNewline !== previous.discardUntilNewline || JSON.stringify(row3.anchor) !== JSON.stringify(previous.anchor)) return options.invalid();
+        if (row3.skippedBytes > target2.endOffset) throw Error("SYNC_SOURCE_RECOVERY_UNAVAILABLE");
+        row3.byteOffset = target2.endOffset, row3.anchor = { ...target2 }, row3.discardUntilNewline = !1, row3.lastGap = null, row3.projection = recoveryProjection, row3.lastFrame = {
+          ...stream,
+          occurrence,
+          sourceSha256: target2.sha256,
+          startOffset: target2.startOffset,
+          endOffset: target2.endOffset,
+          anchor: { ...target2 }
+        }, await write(row3, assertOwnership);
+      });
+    },
     recover: () => options.locked(recoverLocked),
     drain: (maximum = 64, signal) => options.drainLocked(async () => {
       if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 256) return options.invalid();
@@ -9063,6 +9091,23 @@ function createSourceJournal(options) {
 function createSourcePair(options) {
   let { source: source2, lanes, laneStreams } = options, recover = async () => {
     for (let lane of lanes) await lane.recover();
+  }, rebaseMarker = (row3) => /^rebase:([1-9][0-9]*):([a-f0-9]{64}):([01]):([1-9][0-9]*)$/.exec(row3.lastFrame?.occurrence ?? ""), finishRebase = async () => {
+    let rows = await Promise.all(lanes.map((lane) => lane.load())), candidates = [];
+    for (let index2 of [0, 1]) {
+      let row4 = rows[index2];
+      if (!row4) continue;
+      let marker2 = rebaseMarker(row4);
+      if (!marker2) continue;
+      let peer2 = rows[1 - index2];
+      if (!peer2) return options.invalid();
+      row4.byteOffset === peer2.byteOffset && JSON.stringify(row4.anchor) === JSON.stringify(peer2.anchor) && row4.projection === peer2.projection && row4.lastFrame?.occurrence === peer2.lastFrame?.occurrence || peer2.byteOffset === Number(marker2[1]) && peer2.anchor?.sha256 === marker2[2] && candidates.push({ index: index2, marker: marker2 });
+    }
+    if (!candidates.length) return;
+    if (candidates.sort((a, b) => Number(b.marker[4]) - Number(a.marker[4])), candidates.length > 1 && candidates[0].marker[4] === candidates[1].marker[4])
+      throw Error("SYNC_SOURCE_RECOVERY_UNAVAILABLE");
+    let { index, marker } = candidates[0], row3 = rows[index], peer = rows[1 - index];
+    if (row3.entries.length || peer.entries.length) throw Error("SYNC_SOURCE_RECOVERY_PENDING");
+    await lanes[1 - index].rebase(position2(peer), row3.anchor, marker[3] === "1", Number(marker[4]), row3.projection);
   }, position2 = (row3) => ({
     byteOffset: row3.byteOffset,
     anchor: row3.anchor ? { ...row3.anchor } : null,
@@ -9070,14 +9115,33 @@ function createSourcePair(options) {
   }), earliest = (rows) => {
     let ordered = [...rows].sort((a, b) => a.byteOffset - b.byteOffset);
     if (ordered.length === 2 && ordered[0].byteOffset === ordered[1].byteOffset && JSON.stringify(position2(ordered[0])) !== JSON.stringify(position2(ordered[1]))) return options.invalid();
-    let baseline = position2(ordered[0]), pending2 = rows.flatMap((row3) => row3.entries.filter((entry5) => entry5.state === "PREPARING" && entry5.frame.startOffset === baseline.byteOffset).map((entry5) => entry5.frame.endOffset));
-    return { ...baseline, ...pending2.length && { pendingFrameEndOffset: Math.min(...pending2) } };
+    let baseline = position2(ordered[0]), pending2 = rows.flatMap((row3) => {
+      let frames = row3.entries.filter((entry5) => entry5.state === "PREPARING" && entry5.frame.startOffset === baseline.byteOffset).map((entry5) => entry5.frame);
+      return row3.byteOffset > baseline.byteOffset && row3.lastFrame && !rebaseMarker(row3) && row3.lastFrame.startOffset === baseline.byteOffset && row3.lastFrame.endOffset === row3.byteOffset && frames.push(row3.lastFrame), frames.map((frame3) => ({
+        startOffset: frame3.startOffset,
+        endOffset: frame3.endOffset,
+        sourceSha256: frame3.sourceSha256
+      }));
+    });
+    if (pending2.some((value) => JSON.stringify(value) !== JSON.stringify(pending2[0]))) return options.invalid();
+    let marker = rebaseMarker(ordered[0]);
+    return {
+      ...baseline,
+      ...pending2.length && { pendingFrameEndOffset: pending2[0].endOffset, pendingFrame: pending2[0] },
+      ...marker && { recovered: {
+        previousOffset: Number(marker[1]),
+        boundaryOffset: baseline.byteOffset,
+        skippedHistory: marker[3] === "1",
+        recordedAt: Number(marker[4]),
+        projection: ordered[0].projection
+      } }
+    };
   };
   return Object.freeze({
     open: (initial, validateInitial) => {
       let snapshot2 = typeof initial == "number" ? initial : position2(initial);
       return options.locked(async () => {
-        await recover();
+        await recover(), await finishRebase();
         let present = (await Promise.all(lanes.map((lane) => lane.load()))).filter((row3) => row3 !== null);
         if (present.length === 1 && (present[0].lastFrame !== null || present[0].entries.length !== 0 || present[0].skippedBytes !== 0 || present[0].projection !== null))
           return options.invalid();
@@ -9092,8 +9156,14 @@ function createSourcePair(options) {
       let snapshot2 = { ...frame3, ...frame3.anchor && { anchor: { ...frame3.anchor } } }, factories = [...prepare];
       return options.locked(async () => {
         let result = [null, null];
-        for (let index of [0, 1])
-          result[index] = await lanes[index].admit({ ...snapshot2, streamSha256: laneStreams[index] }, factories[index]);
+        for (let index of [0, 1]) {
+          let row3 = await lanes[index].load();
+          result[index] = await lanes[index].admit(
+            { ...snapshot2, streamSha256: laneStreams[index] },
+            factories[index],
+            row3 && rebaseMarker(row3) ? null : void 0
+          );
+        }
         return result;
       });
     },
@@ -9104,6 +9174,20 @@ function createSourcePair(options) {
         for (let lane of lanes) await lane.skip(snapshot2);
       });
     },
+    rebase: async (previous, target2, skippedHistory, recoveryProjection = null) => {
+      if (!validSourceRebase(previous, target2, skippedHistory)) return options.invalid();
+      let before = position2(previous), next = { ...target2 };
+      return options.locked(async () => {
+        await recover(), await finishRebase();
+        let rows = await Promise.all(lanes.map((lane) => lane.load()));
+        if (rows.some((row3) => !row3)) return options.invalid();
+        if (rows.some((row3) => row3.entries.length || JSON.stringify(position2(row3)) !== JSON.stringify(before)))
+          throw Error("SYNC_SOURCE_RECOVERY_PENDING");
+        let recordedAt = Math.max(Date.now(), ...rows.map((row3) => Number(rebaseMarker(row3)?.[4] ?? 0) + 1));
+        for (let lane of lanes) await lane.rebase(before, next, skippedHistory, recordedAt, recoveryProjection);
+        return earliest(await Promise.all(lanes.map(async (lane) => await lane.load())));
+      });
+    },
     recover: () => options.locked(recover),
     drain: async (maximumPerLane = 64, signal) => {
       let count4 = 0, failure2, failed = !1;
@@ -10166,7 +10250,19 @@ var import_zod6 = require("zod"), import_node_crypto11 = require("node:crypto"),
   sessionGenerationId: uuid7,
   provider: import_zod6.z.enum(["codex", "claude", "agy"]),
   entries: import_zod6.z.array(entry3).max(64)
-}).strict(), normalize = (text2, mode) => mode === "trim" ? text2.trim() : text2.replace(/\s+/g, " ").trim(), tokenFor = (target2) => (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify(target2)).digest("hex");
+}).strict(), normalize = (text2, mode) => mode === "trim" ? text2.trim() : text2.replace(/\s+/g, " ").trim(), tokenFor = (target2) => (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify(target2)).digest("hex"), omissionPlan = import_zod6.z.object({
+  kind: import_zod6.z.literal("omitted-echoes-v1"),
+  ownerSha256: hash2,
+  matches: import_zod6.z.array(import_zod6.z.tuple([hash2, hash2, hash2])).max(64)
+}).strict(), ownerHash = (row3) => (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify([
+  row3.operationId,
+  row3.sessionId,
+  row3.sessionGenerationId,
+  row3.provider
+])).digest("hex"), reservationHash = (e) => (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({ ...e, claim: null, claimedEchoSha256: null })).digest("hex"), matchesText = (e, content, nativeMs) => {
+  let normalized = normalize(content, e.normalization);
+  return nativeMs >= Math.floor(e.armedAt / e.clockPrecisionMs) * e.clockPrecisionMs && nativeMs <= e.expiresAt && (e.normalized === normalized || e.allowSuffix && normalized.length >= 16 && normalized.length / e.normalized.length >= 0.35 && e.normalized.endsWith(normalized));
+};
 function decodeMobileEcho(value) {
   let parsed = row2.parse(value);
   if (new Set(parsed.entries.map((e) => e.token)).size !== parsed.entries.length || parsed.entries.some((e) => e.token !== tokenFor(e.target))) throw Error("SYNC_MOBILE_ECHO_INVALID");
@@ -10196,6 +10292,31 @@ function createMobileEchoJournal(options) {
         row3.entries.push(snapshot2), await save();
       });
     },
+    planOmitted: (records) => options.mutate(async (row3) => {
+      let eligible = row3.entries.filter((e) => !e.claim), used = /* @__PURE__ */ new Set(), proofs = /* @__PURE__ */ new Set(), matches2 = [];
+      if (eligible.length) for (let record2 of records) {
+        hash2.parse(record2.sourceSha256);
+        let nativeMs = Date.parse(record2.timestamp);
+        if (!Number.isFinite(nativeMs) || proofs.has(record2.sourceSha256)) continue;
+        let match = eligible.find((e) => !used.has(e.token) && matchesText(e, record2.content, nativeMs));
+        if (match && (used.add(match.token), proofs.add(record2.sourceSha256), matches2.push([match.token, reservationHash(match), record2.sourceSha256])), used.size === eligible.length) break;
+      }
+      let plan = JSON.stringify({ kind: "omitted-echoes-v1", ownerSha256: ownerHash(row3), matches: matches2 });
+      if (Buffer.byteLength(plan) > 16384) throw Error("SYNC_MOBILE_ECHO_INVALID");
+      return plan;
+    }),
+    settleOmitted: (value) => {
+      if (Buffer.byteLength(value) > 16384) throw Error("SYNC_MOBILE_ECHO_INVALID");
+      let plan = omissionPlan.parse(JSON.parse(value)), tokens = new Set(plan.matches.map((m) => m[0])), proofs = new Set(plan.matches.map((m) => m[2]));
+      if (tokens.size !== plan.matches.length || proofs.size !== plan.matches.length) throw Error("SYNC_MOBILE_ECHO_INVALID");
+      return options.mutate(async (row3, save) => {
+        if (ownerHash(row3) !== plan.ownerSha256) throw Error("SYNC_MOBILE_ECHO_INVALID");
+        let exact2 = new Map(plan.matches.map(([token4, fingerprint2]) => [token4, fingerprint2])), before = row3.entries.length;
+        row3.entries = row3.entries.filter((e) => e.claim || exact2.get(e.token) !== reservationHash(e));
+        let count4 = before - row3.entries.length;
+        return count4 && await save(), count4;
+      });
+    },
     claim: (value, content, timestamp5) => {
       let next = frame2.parse(value), echoHash = (e) => (0, import_node_crypto11.createHash)("sha256").update(normalize(content, e.normalization)).digest("hex"), nativeMs = Date.parse(timestamp5);
       if (!Number.isFinite(nativeMs)) throw Error("SYNC_MOBILE_ECHO_TIMESTAMP_INVALID");
@@ -10203,10 +10324,7 @@ function createMobileEchoJournal(options) {
         let claimed = row3.entries.find((e) => e.claim?.streamSha256 === next.streamSha256 && e.claim?.occurrence === next.occurrence);
         if (claimed)
           return JSON.stringify(claimed.claim) !== JSON.stringify(next) || claimed.claimedEchoSha256 !== echoHash(claimed) ? options.collision() : !0;
-        let pending2 = row3.entries.find((e) => {
-          let normalized = normalize(content, e.normalization);
-          return !e.claim && nativeMs >= Math.floor(e.armedAt / e.clockPrecisionMs) * e.clockPrecisionMs && nativeMs <= e.expiresAt && (e.normalized === normalized || e.allowSuffix && normalized.length >= 16 && normalized.length / e.normalized.length >= 0.35 && e.normalized.endsWith(normalized));
-        });
+        let pending2 = row3.entries.find((e) => !e.claim && matchesText(e, content, nativeMs));
         return pending2 ? (pending2.claim = next, pending2.claimedEchoSha256 = echoHash(pending2), await save(), !0) : !1;
       });
     },
@@ -13975,6 +14093,7 @@ var AppSyncClient = class _AppSyncClient {
     this.syncRegistrations = /* @__PURE__ */ new Map();
     // MARK: - Heartbeat
     this.heartbeatTimers = /* @__PURE__ */ new Map();
+    this.heartbeatReadiness = /* @__PURE__ */ new Map();
     /** Identity tokens invalidate in-flight pulses when a session is stopped. */
     this.heartbeatTokens = /* @__PURE__ */ new Map();
     /** Shared initial confirmation makes duplicate start calls idempotent. */
@@ -18300,6 +18419,13 @@ var AppSyncClient = class _AppSyncClient {
   cleanupApplyUserDecisionWatcherState(state) {
     state.destroyed = !0, this.cancelReconnectReconciliationWait(state), state.reconnectTimer && (clearTimeout(state.reconnectTimer), state.reconnectTimer = void 0), state.keepAliveTimer && (clearTimeout(state.keepAliveTimer), state.keepAliveTimer = void 0), state.ws && (disposeWatcherSocket(state.ws, state.subscriptionId), state.ws = null);
   }
+  /** Local producer health, not a quota/transport flag. Reconnect must not
+   * advertise readiness while the owning transcript reader is degraded. */
+  setHeartbeatReadiness(sessionId, ready) {
+    return this.heartbeatReadiness.set(sessionId, ready), () => {
+      this.heartbeatReadiness.get(sessionId) === ready && this.heartbeatReadiness.delete(sessionId);
+    };
+  }
   /**
    * Start periodic heartbeat for a session.
    * Updates lastHeartbeatAt on the session every intervalMs (default 2 minutes).
@@ -18382,6 +18508,11 @@ var AppSyncClient = class _AppSyncClient {
    */
   async sendHeartbeat(sessionId, token4) {
     if (this.heartbeatTokens.get(sessionId) !== token4) return "stopped";
+    try {
+      if (this.heartbeatReadiness.get(sessionId)?.() === !1) return "stopped";
+    } catch {
+      return "stopped";
+    }
     try {
       let heartbeatAt = (/* @__PURE__ */ new Date()).toISOString(), refreshed = await this.updateSession({
         sessionId,
@@ -18750,6 +18881,14 @@ async function updateMobileInputStatus(update, event, status) {
   return receipt2;
 }
 
+// src/appsync/sync-source-recovery.ts
+var DEFAULT_SYNC_SOURCE_RECOVERY_POLICY = Object.freeze({
+  staleAfterMs: 5 * 6e4,
+  maximumRecentMessages: 20,
+  anchorSearchBytes: 8 * 1024 * 1024,
+  maximumScanBytes: 64 * 1024 * 1024
+});
+
 // src/appsync/sync-source-file.ts
 var CHUNK = 64 * 1024;
 
@@ -77487,6 +77626,7 @@ function validateOutboxLocation(value, generation, file) {
 }
 function definitiveRejectionCode(error) {
   if (!(error instanceof AppSyncGraphQLError)) return null;
+  if (error.errorType === "SYNC_QUOTA_EXHAUSTED") return "SYNC_QUOTA_EXHAUSTED";
   let values = [error.errorType, error.message.replace(/^GraphQL error: /, "")].filter(
     (value) => typeof value == "string"
   );
@@ -77549,14 +77689,14 @@ var WorkspaceTerminalCoordinator = class {
       throw new Error("WorkspaceTerminalCoordinator: record exceeds size limit");
     return bytes;
   }
-  async readJson(filePath) {
+  async readJson(filePath, missing = null) {
     try {
       let stat14 = await import_node_fs34.promises.lstat(filePath);
       if (!stat14.isFile() || stat14.isSymbolicLink() || stat14.size > MAX_RECORD_BYTES2)
         throw new Error("WorkspaceTerminalCoordinator: unsafe or oversized record");
       return JSON.parse(await import_node_fs34.promises.readFile(filePath, "utf8"));
     } catch (error) {
-      if (error.code === "ENOENT") return null;
+      if (error.code === "ENOENT") return missing;
       throw error;
     }
   }
@@ -77949,6 +78089,7 @@ var WorkspaceTerminalCoordinator = class {
     ]);
   }
   async flushTerminalIntent(intent) {
+    if (await this.settleQuarantined(intent.nonce, intent.sessionGenerationId)) return;
     intent.subjectKind === "task" ? (validateTerminal(intent), await this.prepareExactInput(intent, "outbox")) : (validateGroupTerminal(intent), await this.prepareExactInput(intent, "draft"), await this.promoteDraftToOutbox(intent));
     let row3 = await this.readJson(
       this.outboxPath(intent.nonce, intent.sessionGenerationId)
@@ -77956,25 +78097,64 @@ var WorkspaceTerminalCoordinator = class {
     if (!row3) throw new Error("WorkspaceTerminalCoordinator: exact outbox row is unavailable");
     await this.sendOutbox(validateOutboxForIntent(row3, intent));
   }
-  async acknowledge(nonce, generation = this.generation()) {
+  async syncSettlementDirectory(directory) {
+    let handle;
+    try {
+      handle = await import_node_fs34.promises.open(directory, import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_DIRECTORY | import_node_fs34.constants.O_NOFOLLOW);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  }
+  async persistSettlementMarker(file, record2) {
+    await atomicWriteFileSync2(file, this.serialize(record2), { requireDirectorySync: !0 });
+    for (let directory of [this.quarantineRoot(), path74.join(this.rootDir, "quarantine"), this.rootDir]) {
+      let handle = await import_node_fs34.promises.open(directory, import_node_fs34.constants.O_RDONLY | import_node_fs34.constants.O_DIRECTORY | import_node_fs34.constants.O_NOFOLLOW);
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+    }
+  }
+  async acknowledge(nonce, generation = this.generation(), settlement = !1) {
+    let sync = (directory) => settlement ? this.syncSettlementDirectory(directory) : fsyncDir(directory);
     await import_node_fs34.promises.unlink(this.outboxPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
-    }), await fsyncDir(this.outboxDir(generation)), await import_node_fs34.promises.unlink(this.draftPath(nonce, generation)).catch((error) => {
+    }), await sync(this.outboxDir(generation)), await import_node_fs34.promises.unlink(this.draftPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
-    }), await fsyncDir(this.draftDir(generation)), await import_node_fs34.promises.unlink(this.intentPath(nonce, generation)).catch((error) => {
+    }), await sync(this.draftDir(generation)), await import_node_fs34.promises.unlink(this.intentPath(nonce, generation)).catch((error) => {
       if (error.code !== "ENOENT") throw error;
-    }), await fsyncDir(this.intentDir(generation));
+    }), await sync(this.intentDir(generation));
   }
   async quarantine(nonce, rejectionCode, generation = this.generation()) {
     let raw = await this.readJson(this.outboxPath(nonce, generation));
     if (!raw) return;
-    let row3 = validateOutbox(raw), directory = this.quarantineDir(generation), files = await this.listRecordsAcrossGenerations(this.quarantineRoot());
+    let row3 = validateOutbox(raw);
+    if (await this.settleQuarantined(nonce, generation, row3.inputHash)) return;
+    let directory = this.quarantineDir(generation), files = await this.listRecordsAcrossGenerations(this.quarantineRoot());
     if (files.length >= MAX_QUARANTINE_RECORDS) {
-      let oldest = (await Promise.all(files.map(async (record2) => ({
+      let pending2 = /* @__PURE__ */ new Set();
+      for (let root of [this.intentRoot(), this.outboxRoot(), this.draftRoot()])
+        for (let record2 of await this.listRecordsAcrossGenerations(root))
+          pending2.add(`${record2.generation}/${sha2563(path74.basename(record2.file, ".json"))}`);
+      let disposable = files.filter((record2) => !pending2.has(`${record2.generation}/${path74.basename(record2.file, ".json")}`)), oldest = (await Promise.all(disposable.map(async (record2) => ({
         ...record2,
         mtimeMs: (await import_node_fs34.promises.stat(record2.file)).mtimeMs
       })))).sort((left, right) => left.mtimeMs - right.mtimeMs || left.file.localeCompare(right.file))[0];
-      await import_node_fs34.promises.unlink(oldest.file), await fsyncDir(path74.dirname(oldest.file));
+      if (!oldest) throw new Error("WorkspaceTerminalCoordinator: pending settlement capacity is full");
+      for (let directory2 of [this.intentDir(oldest.generation), this.outboxDir(oldest.generation), this.draftDir(oldest.generation)]) {
+        await this.syncSettlementDirectory(directory2);
+        for (let file of await this.listRecords(directory2))
+          if (sha2563(path74.basename(file, ".json")) === path74.basename(oldest.file, ".json"))
+            throw new Error("WorkspaceTerminalCoordinator: settlement cleanup is still pending");
+      }
+      await import_node_fs34.promises.unlink(oldest.file), await this.syncSettlementDirectory(path74.dirname(oldest.file));
     }
     let diagnostic = {
       version: QUARANTINE_VERSION,
@@ -77983,10 +78163,37 @@ var WorkspaceTerminalCoordinator = class {
       rejectionCode,
       quarantinedAt: this.now().toISOString()
     };
-    await atomicWriteFileSync2(
+    await this.persistSettlementMarker(
       path74.join(directory, `${sha2563(nonce)}.json`),
-      this.serialize(diagnostic)
-    ), await this.acknowledge(nonce, generation), this.reportSyncIssue(`Workspace result could not be synchronized (${rejectionCode}).`);
+      diagnostic
+    ), await this.acknowledge(nonce, generation, !0), this.reportSyncIssue(`Workspace result could not be synchronized (${rejectionCode}).`);
+  }
+  async settleQuarantined(nonce, generation, inputHash) {
+    let markerPath = path74.join(this.quarantineDir(generation), `${sha2563(nonce)}.json`), missing = /* @__PURE__ */ Symbol("absent settlement record"), raw = await this.readJson(markerPath, missing);
+    if (raw === missing) return !1;
+    if (raw === null || typeof raw != "object" || Array.isArray(raw))
+      throw new Error("WorkspaceTerminalCoordinator: invalid settlement barrier");
+    let record2 = raw;
+    if (record2.version !== QUARANTINE_VERSION || record2.nonceHash !== sha2563(nonce) || typeof record2.inputHash != "string" || !SHA256_RE2.test(record2.inputHash) || inputHash !== void 0 && record2.inputHash !== inputHash || typeof record2.rejectionCode != "string" || ![
+      "SYNC_QUOTA_EXHAUSTED",
+      "OUTCOME_ADMISSION_EXPIRED",
+      "OUTCOME_ADMISSION_CONFLICT",
+      "GENERATION_MISMATCH",
+      "ACCOUNT_DELETING"
+    ].includes(record2.rejectionCode) || typeof record2.quarantinedAt != "string")
+      throw new Error("WorkspaceTerminalCoordinator: invalid settlement barrier");
+    let intentValue = await this.readJson(this.intentPath(nonce, generation), missing), intent = intentValue === missing ? void 0 : validateAnyIntent(intentValue);
+    if (intent && (intent.nonce !== nonce || intent.sessionId !== this.session.sessionId || intent.sessionGenerationId !== generation))
+      throw new Error("WorkspaceTerminalCoordinator: settlement intent identity changed");
+    for (let file of [this.outboxPath(nonce, generation), this.draftPath(nonce, generation)]) {
+      let saved = await this.readJson(file, missing);
+      if (saved === missing) continue;
+      let row3 = validateOutboxLocation(saved, generation, file);
+      if (row3.sessionId !== this.session.sessionId || row3.inputHash !== record2.inputHash)
+        throw new Error("WorkspaceTerminalCoordinator: settlement identity changed");
+      intent && validateOutboxForIntent(row3, intent);
+    }
+    return await this.persistSettlementMarker(markerPath, record2), await this.acknowledge(nonce, generation, !0), this.reportSyncIssue(`Workspace result could not be synchronized (${record2.rejectionCode}).`), !0;
   }
   reportSyncIssue(message2) {
     this.reportedSyncIssues.has(message2) || (this.reportedSyncIssues.add(message2), this.onSyncIssue?.(message2));
@@ -77994,6 +78201,7 @@ var WorkspaceTerminalCoordinator = class {
   async sendOutbox(row3) {
     for (let attempt = 1; attempt <= 2; attempt += 1)
       try {
+        if (await this.settleQuarantined(row3.nonce, row3.sessionGenerationId, row3.inputHash)) return;
         let target2 = this.outboxPath(row3.nonce, row3.sessionGenerationId), current = validateOutboxLocation(await this.readJson(target2), row3.sessionGenerationId, target2), { syncProtocol: priorProtocol, ...original } = row3, { syncProtocol: currentProtocol, ...persisted } = current;
         if (canonicalJson3(original) !== canonicalJson3(persisted) || priorProtocol === "SYNC_V2" && currentProtocol !== "SYNC_V2")
           throw new Error("WorkspaceTerminalCoordinator: outbox identity or protocol changed");

package/dist/orchestration-shell/workspace-terminal-coordinator.d.ts

@@ -107,8 +107,11 @@ export declare class WorkspaceTerminalCoordinator implements WorkspaceOutcomeSin
     private prepareExactInput;
     private promoteDraftToOutbox;
     private flushTerminalIntent;
+    private syncSettlementDirectory;
+    private persistSettlementMarker;
     private acknowledge;
     private quarantine;
+    private settleQuarantined;
     private reportSyncIssue;
     private sendOutbox;
     /** Reconcile terminal receipts first, then replay exact encrypted bytes. */

package/dist/tool-activity/replay-cursor.d.ts

@@ -1,3 +1,4 @@
+import type { DesktopSyncSourceAnchor } from '../appsync/sync-source-cursor';
 import { z } from 'zod';
 import type { Logger } from '../logger';
 /** Keep every ordinary replay read comfortably below Node/Buffer's platform limits. */
@@ -67,6 +68,10 @@ export interface ToolReplayInitialBoundary {
     };
     size: number;
 }
+/** The ordinary source has validated this descriptor/anchor before tool replay. */
+export interface ToolReplayVerifiedBoundary extends ToolReplayInitialBoundary {
+    anchor: DesktopSyncSourceAnchor | null;
+}
 /** Capture a native boundary synchronously before lifecycle/cloud awaits.
  * Existing partial records remain unread. Memory and reverse lookup are bounded. */
 export declare function captureToolReplayBoundary(filePath: string, initialOffset?: number): ToolReplayInitialBoundary;
@@ -146,6 +151,11 @@ export declare class ToolReplayCursor {
     load(initialBoundary?: ToolReplayInitialBoundary, requireExisting?: boolean): Promise<void>;
     /** The current durable checkpoint (0 when fresh). */
     byteOffset(): number;
+    needsVerifiedRebase(boundary: ToolReplayVerifiedBoundary): boolean;
+    private verifyBoundary;
+    /** Only a recognized nonzero source recovery may replace file coordinates.
+     * Caller seals in-memory tools first; ledger and admitted outbox stay intact. */
+    adoptVerifiedBoundary(boundary: ToolReplayVerifiedBoundary): Promise<void>;
     /**
      * Read + byte-frame ONE BOUNDED transcript batch from the durable checkpoint
      * (or 0 after a rotation). PURE — persists nothing. File positions are ordinary
@@ -159,7 +169,7 @@ export declare class ToolReplayCursor {
      * unbounded while one malformed/huge JSONL RECORD has a controlled bound.
      * The trailing partial is returned as `carryover` and re-read next cycle.
      */
-    readFrames(): Promise<ReadFramesResult>;
+    readFrames(verifiedBoundary?: ToolReplayVerifiedBoundary): Promise<ReadFramesResult>;
     /**
      * Advance the durable checkpoint over a contiguous durably-outboxed prefix
      * (§4.5) and persist atomically. FORWARD-ONLY **within the same file**: a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.78",
+  "version": "2.0.80",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",