@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/src/openviking/index.ts

@@ -0,0 +1,119 @@
+// The OpenViking runtime: the server the daemon supervises inside
+// the container, on loopback :1933, plus its health gate and heartbeat block.
+// Nothing here is on a review round's critical path — see supervisor.ts.
+export { probeHealth, type FetchLike, type ProbeOptions } from "./health.js";
+export { ProcSampler, parseProcStat, type ProcStat, type ProcSamplerDeps } from "./proc.js";
+export {
+  OpenVikingSupervisor,
+  type Schedule,
+  type SpawnFn,
+  type SupervisedChild,
+  type SupervisorDeps,
+} from "./supervisor.js";
+export type {
+  Embedder,
+  LocalEmbedderStatus,
+  OpenVikingHealth,
+  OpenVikingStatus,
+  ProcSample,
+  ReembedJournalStatus,
+  ReembedNamespace,
+  ReembedStatus,
+} from "./types.js";
+// The local English embedder: the loopback service the server
+// embeds through, supervised beside it.
+export {
+  EMBEDDER_FAST_POLL_MS,
+  EMBEDDER_GATE_MAX_WAIT_MS,
+  LocalEmbedderSupervisor,
+  REMOTE_EMBEDDER_REASON,
+  localEmbedderArgv,
+  localEmbedderOffReason,
+  localEmbedderSpec,
+  memoryServing,
+  type LocalEmbedderDeps,
+  type LocalEmbedderSpec,
+} from "./embedder.js";
+// The embedder migration's daemon half: drives the script's
+// `resume` once /ready passes and folds the journal into the heartbeat.
+export {
+  REEMBED_POLL_MS,
+  REEMBED_RETRY_MS,
+  ReembedDriver,
+  loadReembedModule,
+  reembedNamespaces,
+  type OperatorReembedResult,
+  type ReembedDriverDeps,
+  type ReembedFetch,
+  type ReembedModule,
+  type ReindexOutcome,
+} from "./reembed.js";
+
+// The memory engine proper: the HTTP client, the `MemoryStore`
+// implementation over it, and the round path's `ContextAssembler`. Writes go
+// through `content/batch-write` exclusively — there is no `content/write`
+// wrapper anywhere below this barrel, by design.
+export {
+  DISABLED_MEMORY_POLICY,
+  OpenVikingClient,
+  QUOTA_CATEGORIES,
+  batchWriteLanded,
+  buildContextSearchBody,
+  isAuthFailure,
+  keyFromFile,
+  ovFailed,
+  type BatchWriteOperation,
+  type BatchWritePrecondition,
+  type BatchWriteRequest,
+  type BatchWriteResult,
+  type ContextSearchEntry,
+  type ContextSearchOptions,
+  type ContextSearchResult,
+  type HttpFetch,
+  type HttpResponse,
+  type KeyFileSource,
+  type KeySource,
+  type OpenVikingClientOptions,
+  type OvDirEntry,
+  type OvGap,
+  type OvFailure,
+  type OvOutcome,
+  type OvRequestRecord,
+  type OvSessionResult,
+  type TimeField,
+} from "./client.js";
+export {
+  DEFAULT_CATEGORY,
+  MANUAL_TAG,
+  OpenVikingStore,
+  PINNED_TAG,
+  RETIRED_TAG,
+  entryFrom,
+  openVikingStore,
+  renderEntryBody,
+  sha256Prefixed,
+  stampOf,
+  tagsOf,
+  tsFromModTime,
+  tsFromName,
+  validEntryId,
+  withTag,
+  withoutTag,
+  type MemorySweep,
+  type OpenVikingStoreOptions,
+} from "./store.js";
+export {
+  OpenVikingContextAssembler,
+  openVikingContextAssembler,
+  type OpenVikingContextOptions,
+} from "./context.js";
+// The authenticated probe and the boot provisioning report —
+// what the memory health monitor (src/memory/health.ts) is fed from.
+export {
+  classifyProbe,
+  credentialProbe,
+  probeKeyFrom,
+  type CredentialProbeOptions,
+  type ProbeKey,
+} from "./probe.js";
+export { provisionReportPath, provisionWake, readProvisionReport } from "./provisionreport.js";

package/src/openviking/lessonfind.ts

@@ -0,0 +1,92 @@
+// `LessonEngine` over OpenViking: the round's lesson prefetch
+// (src/lessonselect.ts) asks the server through this, and through nothing
+// else.
+//
+// Each find is ONE `POST /api/v1/search/find` with `target_uri` set to the
+// area — `memories/experiences` for the round's one lesson find (its `limit`
+// sized from the store's count of the area, `corpusSize`),
+// `memories/finding-cases` for the main session — so the server ranks inside
+// the area instead of across the tree (vendored patch 0011 sends a session's
+// scoped search the same way). No `session_id` rides the body, so the server
+// runs no query expansion, and the route has no rewrite stage: the selection is a pure
+// function of the round order and the store, like every other read on the
+// round path. The retired list is the store's last completed sweep — it
+// never waits for a sweep inside the round's budget once one has completed.
+//
+// Its own client (`lessonFindClient`). The prefetch's finds run under the
+// round's hard budget (`[memory] shadow_budget_ms`, or `delivery_budget_ms`,
+// at most 2 s, when the round waits), not the client's own 10 s timeout — so
+// on a server that is merely slow (the one-thread embedder busy with case
+// writes) they are aborted at the deadline by design. Those aborts
+// are the shadow ledger's business (recorded on the round, logged once by the
+// selector), never the memory-health monitor's: through the daemon's shared
+// client each one would be a `failed`/`transport` request in the health window
+// and a counted `openviking_gap`, and a few rounds of them would read memory
+// DEGRADED — pausing the case writer, the feedback pump and the learner over
+// a probe that must change nothing live. So the lesson engine gets a client
+// with NO request observer and NO gap sink; the same key source (a 401 still
+// drops its cache), the same server, the daemon's log for a refusal.
+//
+// Total, like the client under it: a refused or dead server is
+// `{ ok: false, reason }`, never a throw.
+import type { FindHit, LessonEngine } from "../memory/selection.js";
+import { OpenVikingClient, type OpenVikingClientOptions } from "./client.js";
+import type { OpenVikingStore } from "./store.js";
+
+/** The options a lesson client may be built with — everything but the two
+ * observers the daemon's shared client carries. */
+export type LessonFindClientOptions = Omit<OpenVikingClientOptions, "onGap" | "onRequest">;
+
+/**
+ * The lesson prefetch's OWN client: no `onRequest` (the memory-health
+ * window), no `onGap` (the counted `openviking_gap`). A shadow find aborted at
+ * the round's budget therefore never reads as memory failing.
+ */
+export function lessonFindClient(opts: LessonFindClientOptions): OpenVikingClient {
+  // Copied without the two observers, so an options object that happens to
+  // carry one (a spread of the shared client's) still cannot pass it on.
+  const rest: OpenVikingClientOptions = { ...(opts as OpenVikingClientOptions) };
+  delete rest.onGap;
+  delete rest.onRequest;
+  return new OpenVikingClient(rest);
+}
+
+export function openVikingLessonEngine(
+  client: Pick<OpenVikingClient, "find" | "memoriesRoot">,
+  store: Pick<OpenVikingStore, "retiredUris"> & Partial<Pick<OpenVikingStore, "areaSize">>,
+): LessonEngine {
+  return {
+    // The lesson find's limit is sized from the store's own count
+    // of the area (its last sweep — no request, no wait); a store that cannot
+    // count says unknown, and the find asks for the ceiling.
+    corpusSize: (area) => {
+      try {
+        return store.areaSize ? store.areaSize(area) : null;
+      } catch {
+        return null;
+      }
+    },
+    root: () => client.memoriesRoot(),
+    async find(area, query, opts) {
+      try {
+        const res = await client.find(query, {
+          targetUri: `${client.memoriesRoot()}/${area}`,
+          limit: opts.limit,
+          timeoutMs: opts.timeoutMs,
+        });
+        if (!res.ok) return { ok: false, reason: `find ${res.code}: ${res.message}` };
+        const hits: FindHit[] = res.result.map((h) => ({
+          uri: h.uri,
+          score: h.score,
+          text: h.text,
+        }));
+        return { ok: true, hits };
+      } catch (err) {
+        return { ok: false, reason: String(err) };
+      }
+    },
+    // A failure rejects: the prefetch then records that the list did not
+    // arrive (the entries' own `#retired`/`#moved` headers still exclude).
+    retiredUris: () => store.retiredUris(),
+  };
+}

package/src/openviking/probe.ts

@@ -0,0 +1,129 @@
+// The authenticated memory probe.
+//
+// `health.ts` beside this file asks `/health` and `/ready`, and both are
+// unauthenticated: they say "ready" while a refused key fails every read and
+// every write. A server that is up is not a memory that works. This probe asks
+// the question that matters — "does THIS key list THIS user's memories root?" —
+// and answers it for one credential at a time, so the daemon's key and the
+// `ovcli.conf` the sessions are handed are judged separately (either can fail
+// while the other works).
+//
+// Total by construction, like every call in this directory: a dead server, a
+// missing key or a garbage body is a classified answer, never a throw.
+import type { ProbeAnswer, ProbeResult } from "../memory/health.js";
+import type { readOvcliKey } from "../memory/ovsession.js";
+import {
+  OpenVikingClient,
+  isAuthFailure,
+  isNotFound,
+  type HttpFetch,
+  type KeySource,
+} from "./client.js";
+
+/** Where a probe's key comes from — the credential reader's own answer
+ * (`readOvcliKey`), one declaration. `absent` (no credential file at all —
+ * e.g. no session has been born yet to need one) is reported as such and is
+ * never a failure; `unreadable` is (a session handed a torn file runs
+ * keyless). */
+export type ProbeKey = ReturnType<typeof readOvcliKey>;
+
+export interface CredentialProbeOptions {
+  baseUrl: string;
+  /** The OpenViking user whose memories root is listed. */
+  user: string;
+  account?: string;
+  /** Read on EVERY probe — the daemon's `keyFromFile` source, or a fresh read
+   * of the sessions' `ovcli.conf`. */
+  key: () => ProbeKey;
+  timeoutMs: number;
+  fetchFn?: HttpFetch;
+  clock?: () => number;
+}
+
+/** A plain key source as a probe key: `null`/empty is "no key", never absent. */
+export function probeKeyFrom(source: KeySource): () => ProbeKey {
+  return () => {
+    const value = typeof source === "function" ? source() : source;
+    return { state: "key", key: value ?? "" };
+  };
+}
+
+/**
+ * Classify one listing answer. Exported so the classification is testable
+ * without a fetch:
+ *
+ *   * 2xx → `ok`;
+ *   * `NOT_FOUND` with a key → `ok` too: the server authenticates before it
+ *     resolves a path, so that envelope proves the key works and only says nothing has
+ *     created the root yet (a fresh server: empty is not degraded);
+ *   * 401/403, an auth code or "Invalid API Key" → `auth_failed`;
+ *   * `no_key` (nothing to send) → `no_key`;
+ *   * no answer at all → `unreachable`;
+ *   * anything else (5xx, 422, a body that is not an envelope) → `error`.
+ */
+export function classifyProbe(
+  ok: boolean,
+  status: number,
+  code: string,
+  message: string,
+): ProbeResult {
+  if (ok) return "ok";
+  if (code === "no_key") return "no_key";
+  if (isAuthFailure(status, code, message)) return "auth_failed";
+  if (isNotFound(status, code)) return "ok";
+  if (status === 0) return "unreachable";
+  return "error";
+}
+
+/**
+ * One credential's probe: `fs/ls` of `viking://user/<user>/memories` with that
+ * credential's key, classified. The client is built per call on purpose — a
+ * probe must not share a key cache, a gap sink or a request counter with the
+ * code it is checking (its own requests are counted by the monitor as `probe`).
+ */
+export function credentialProbe(opts: CredentialProbeOptions): () => Promise<ProbeAnswer> {
+  const clock = opts.clock ?? Date.now;
+  return async () => {
+    const k = opts.key();
+    if (k.state === "absent") {
+      return { result: "absent", status: 0, code: "absent", ms: 0, detail: "no credential file" };
+    }
+    if (k.state === "unreadable") {
+      return { result: "no_key", status: 0, code: "unreadable", ms: 0, detail: k.detail };
+    }
+    if (k.key.trim() === "") {
+      return { result: "no_key", status: 0, code: "no_key", ms: 0, detail: "no key in it" };
+    }
+    const client = new OpenVikingClient({
+      baseUrl: opts.baseUrl,
+      apiKey: k.key,
+      user: opts.user,
+      ...(opts.account ? { account: opts.account } : {}),
+      timeoutMs: opts.timeoutMs,
+      ...(opts.fetchFn ? { fetchFn: opts.fetchFn } : {}),
+    });
+    const started = clock();
+    let res: Awaited<ReturnType<OpenVikingClient["ls"]>>;
+    try {
+      res = await client.ls(client.memoriesRoot());
+    } catch (err) {
+      // `ls` is total; a caller-supplied fetch seam need not be.
+      return {
+        result: "unreachable",
+        status: 0,
+        code: "transport",
+        ms: clock() - started,
+        detail: err instanceof Error ? err.message : String(err),
+      };
+    }
+    const ms = clock() - started;
+    if (res.ok) return { result: "ok", status: res.status, code: "", ms };
+    return {
+      result: classifyProbe(false, res.status, res.code, res.message),
+      status: res.status,
+      code: res.code,
+      ms,
+      detail: res.message,
+    };
+  };
+}

package/src/openviking/proc.ts

@@ -0,0 +1,110 @@
+// RSS + CPU sampling for the supervised OpenViking process.
+//
+// CPU is the cost to watch, not RAM: the server measured about 400 MiB idle /
+// 460 MiB warm against an 8 GiB container, but ~1.6 core-seconds per ~500 B
+// write on a 2-core quota. So the heartbeat carries both, and CPU is a RATE — which
+// needs two samples, hence the small stateful sampler rather than a pure read.
+//
+// Monitoring only: there is deliberately no RSS watchdog and no auto-restart
+// on a memory budget; do not add one under another name.
+import { readFileSync } from "node:fs";
+import type { ProcSample } from "./types.js";
+
+/** Linux USER_HZ. Fixed at 100 on every architecture Docker runs here. */
+const TICKS_PER_SEC = 100;
+/** Page size behind `/proc/<pid>/stat` field 24 (rss, in pages). */
+const PAGE_BYTES = 4096;
+
+export interface ProcStat {
+  utimeTicks: number;
+  stimeTicks: number;
+  rssPages: number;
+}
+
+/**
+ * Parse `/proc/<pid>/stat`.
+ *
+ * Field 2 (`comm`) is the executable name in parentheses and may contain
+ * spaces and parentheses, which is why this splits after the LAST `)` instead
+ * of tokenising the whole line — the classic way this parse goes wrong.
+ * Fields are 1-based per proc(5): 14 utime, 15 stime, 24 rss (pages).
+ */
+export function parseProcStat(raw: string): ProcStat | undefined {
+  const close = raw.lastIndexOf(")");
+  if (close < 0) return undefined;
+  // After the closing paren comes " S 4 5 …": rest[0] is field 3 (state).
+  const rest = raw
+    .slice(close + 1)
+    .trim()
+    .split(/\s+/);
+  const field = (n: number): number => Number(rest[n - 3]);
+  const utimeTicks = field(14);
+  const stimeTicks = field(15);
+  const rssPages = field(24);
+  if (![utimeTicks, stimeTicks, rssPages].every((n) => Number.isFinite(n))) return undefined;
+  return { utimeTicks, stimeTicks, rssPages };
+}
+
+export interface ProcSamplerDeps {
+  /** Test seam. Default reads `/proc/<pid>/stat`; anything unreadable (a dead
+   * pid, a non-Linux dev box) yields undefined, never a throw. */
+  readStat?: (pid: number) => string | undefined;
+  now?: () => number;
+}
+
+/**
+ * Stateful `/proc` sampler: RSS straight off the read, CPU as a delta against
+ * the previous sample of the SAME pid. A pid change (i.e. a restart) resets the
+ * baseline, so a fresh child never inherits the dead one's tick counter.
+ */
+export class ProcSampler {
+  private readonly readStat: (pid: number) => string | undefined;
+  private readonly now: () => number;
+  private prev: { pid: number; ticks: number; at: number } | null = null;
+
+  constructor(deps: ProcSamplerDeps = {}) {
+    this.readStat =
+      deps.readStat ??
+      ((pid: number): string | undefined => {
+        try {
+          return readFileSync(`/proc/${pid}/stat`, "utf8");
+        } catch {
+          return undefined;
+        }
+      });
+    this.now = deps.now ?? (() => Date.now());
+  }
+
+  /** Never throws; undefined simply means "no numbers this tick". */
+  sample(pid: number): ProcSample | undefined {
+    let stat: ProcStat | undefined;
+    try {
+      const raw = this.readStat(pid);
+      stat = raw ? parseProcStat(raw) : undefined;
+    } catch {
+      stat = undefined;
+    }
+    if (!stat) {
+      this.prev = null;
+      return undefined;
+    }
+    const at = this.now();
+    const ticks = stat.utimeTicks + stat.stimeTicks;
+    const prev = this.prev;
+    this.prev = { pid, ticks, at };
+
+    const out: ProcSample = { rss_bytes: stat.rssPages * PAGE_BYTES };
+    if (prev && prev.pid === pid && at > prev.at) {
+      const coreSeconds = (ticks - prev.ticks) / TICKS_PER_SEC;
+      const wallSeconds = (at - prev.at) / 1000;
+      // Counters are monotonic; a negative delta means the pid was recycled.
+      if (coreSeconds >= 0) out.cpu_pct = Math.round((coreSeconds / wallSeconds) * 1000) / 10;
+    }
+    return out;
+  }
+
+  /** Drop the baseline (called on every respawn). */
+  reset(): void {
+    this.prev = null;
+  }
+}

package/src/openviking/provisionreport.ts

@@ -0,0 +1,160 @@
+// The boot provisioning report, read by the daemon.
+//
+// `scripts/openviking-provision.mjs` runs in the entrypoint before the daemon
+// exists. What it finds — a reviewer key that does not authenticate, a user it
+// could not create, a user it had to CREATE (which means the server lost it —
+// the key the server minted for the new user is discarded, by design, so every
+// distributed copy of the old key is now wrong) — must reach a person, and
+// nobody reads a boot log. So the script writes
+// `state/openviking/provision.json`; the daemon reads it once at boot, puts it
+// in status.json `memory.provision`, and wakes `memory_provision_failed` when
+// it says anything is wrong. The "never mint, never rotate" rule holds:
+// a recreated user is SURFACED, loudly, never repaired here.
+//
+// The report carries no key — the script never writes one anywhere.
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { MEMORY_WAKE, type ProvisionSummary } from "../memory/health.js";
+
+/** Where the script writes its report, relative to the sandbox root (the
+ * script resolves the same path from its own location — see
+ * `provisionReportPath` in `scripts/openviking-provision.mjs`). */
+export function provisionReportPath(root: string): string {
+  return join(root, "state", "openviking", "provision.json");
+}
+
+function strings(v: unknown): string[] {
+  return Array.isArray(v) ? v.filter((x): x is string => typeof x === "string") : [];
+}
+
+/** A file that could not be READ still has an identity: what stat says, or
+ * the error itself — so the once-per-report mark holds for it too. */
+function unreadIdentity(path: string, err: unknown): string {
+  try {
+    const st = statSync(path);
+    return `stat:${st.ino}:${st.size}:${st.mtimeMs}`;
+  } catch {
+    return `error:${(err as NodeJS.ErrnoException).code ?? "unknown"}`;
+  }
+}
+
+/** Read and classify the report. Total: a missing file is `absent`, a file
+ * that is not a report is `unreadable` — never a throw, never "ok". Every
+ * report that exists carries an `id` (a fingerprint of its bytes), which is
+ * what makes the wake fire ONCE per report — a file with no parseable `at`
+ * included, which would otherwise wake again on every daemon restart. */
+export function readProvisionReport(path: string): ProvisionSummary {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "ENOENT"
+      ? { state: "absent" }
+      : {
+          state: "unreadable",
+          id: unreadIdentity(path, err),
+          errors: [String((err as Error).message ?? err)],
+        };
+  }
+  const id = `sha256:${createHash("sha256").update(raw).digest("hex").slice(0, 16)}`;
+  let body: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("not an object");
+    body = parsed as Record<string, unknown>;
+  } catch (err) {
+    return { state: "unreadable", id, errors: [`provision.json is not a report: ${String(err)}`] };
+  }
+  if (typeof body["ok"] !== "boolean") {
+    return { state: "unreadable", id, errors: ["provision.json carries no ok verdict"] };
+  }
+  return {
+    state: body["ok"] === true ? "ok" : "failed",
+    id,
+    ...(typeof body["at"] === "string" ? { at: body["at"] } : {}),
+    created: strings(body["created"]),
+    failed: strings(body["failed"]),
+    ...(typeof body["reviewer"] === "string" ? { reviewer: body["reviewer"] } : {}),
+    errors: strings(body["errors"]),
+  };
+}
+
+/**
+ * The wake a report calls for, or null. Wakes on a failed report, an
+ * unreadable one, and — even when the report says ok — on any user the boot
+ * had to CREATE: on a running install a user only goes missing when the store
+ * lost it, and the server's fresh key for it was discarded (never replace a
+ * distributed key), so whoever holds the old key is now locked out.
+ */
+export function provisionWake(
+  s: ProvisionSummary,
+): { kind: string; detail: string; message: string } | null {
+  if (s.state === "absent") return null;
+  const created = s.created ?? [];
+  if (s.state === "ok" && created.length === 0) return null;
+  const errors = s.errors ?? [];
+  const what =
+    s.state === "unreadable"
+      ? "the boot provisioning report could not be read"
+      : s.state === "failed"
+        ? "boot provisioning FAILED"
+        : `boot provisioning had to CREATE ${created.join(", ")}`;
+  const detail = [
+    what,
+    ...(created.length > 0 && s.state !== "ok" ? [`created: ${created.join(", ")}`] : []),
+    ...((s.failed ?? []).length > 0 ? [`not ensured: ${s.failed!.join(", ")}`] : []),
+    ...(s.reviewer && s.reviewer !== "reach" ? [`reviewer key: ${s.reviewer}`] : []),
+    ...errors.slice(0, 4),
+  ].join("; ");
+  return {
+    kind: MEMORY_WAKE.provision,
+    detail,
+    message: [
+      `MEMORY PROVISIONING — ${what}${s.at ? ` (report ${s.at})` : ""}.`,
+      ...errors.slice(0, 6).map((e) => `  ${e}`),
+      ...(created.length > 0
+        ? [
+            `A user that had to be created (${created.join(", ")}) means the server lost it: the key it minted for the new user was discarded on purpose (keys are never rotated from here), so every distributed copy of the OLD key no longer authenticates. Re-mint and re-distribute through the onboarding memory step (docs/companion-memory-access.md) — on a first install this is expected once.`,
+          ]
+        : []),
+      "Rounds are not blocked; memory degrades until this is fixed. The report rides status.json `memory.provision`.",
+    ].join("\n"),
+  };
+}
+
+/** The event that marks a report as already woken on (its payload's `id`). */
+export const PROVISION_WOKEN_EVENT = "memory_provision_woken";
+
+/** The slice of `StateStore` the boot step writes through — structural, so
+ * the step is tested against a real `StateStore(":memory:")`. */
+export interface ProvisionWakeStore {
+  logAnomaly(
+    kind: string,
+    pr: number | null,
+    roundNo: number | null,
+    detail: string,
+    injectMessage?: string,
+  ): void;
+  logEvent(kind: string, pr: number | null, payload?: unknown): void;
+  lastEventPayload(kind: string): Record<string, unknown> | null;
+}
+
+/**
+ * The daemon's boot step over this boot's report: raise `memory_provision_failed`
+ * through the anomaly funnel when the report calls for it — ONCE per report.
+ * The report's `id` is the key (its timestamp is not enough: a file that cannot
+ * be parsed has none), recorded in `memory_provision_woken`, so a daemon
+ * restart inside the same container never repeats a wake for the same file.
+ * Returns whether it woke.
+ */
+export function raiseProvisionWake(store: ProvisionWakeStore, s: ProvisionSummary): boolean {
+  const wake = provisionWake(s);
+  if (!wake) return false;
+  const key = s.id ?? s.at ?? null;
+  if (key !== null && store.lastEventPayload(PROVISION_WOKEN_EVENT)?.["id"] === key) return false;
+  store.logAnomaly(wake.kind, null, null, wake.detail, wake.message);
+  store.logEvent(PROVISION_WOKEN_EVENT, null, { id: key, at: s.at ?? null, state: s.state });
+  return true;
+}