@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/payload/platform/services/claude-session-manager/dist/slice-memory-policy.d.ts

@@ -0,0 +1,150 @@
+import { type PtyCensusSnapshot, type Logger } from './pty-census.js';
+import { type SystemctlRunner } from './systemd-scope.js';
+import type { FsWatcher, SessionRow } from './fs-watcher.js';
+/** Reclaim an idle operator session when free RAM falls below this. Sits one
+ *  step above Task 600's MIN_ADMISSION_MB (4 GB) so reclaim precedes refusal:
+ *  recovering RAM is preferable to refusing work. A judgement call, not a
+ *  measurement. */
+export declare const RECLAIM_AT_KB: number;
+/** Free RAM the slice's MemoryHigh leaves for everything else. Also absorbs
+ *  the baseline's own imprecision (see resolveNonSessionBaselineKb). */
+export declare const THROTTLE_MARGIN_KB: number;
+/** Re-apply MemoryHigh only on a delta larger than this. Chosen to exceed the
+ *  baseline's imprecision so measurement noise cannot trigger a write. */
+export declare const HYSTERESIS_KB: number;
+/** Floor for the slice bound on a small host. Mirrors SLICE_MIN_HIGH_BYTES in
+ *  packages/create-maxy-code/src/port-resolution.ts. */
+export declare const SLICE_MIN_HIGH_KB: number;
+/** How long an operator session's transcript must have been static before it
+ *  is a reclaim candidate. Far below the 8.7 h floor of the measured idle
+ *  population, and long enough not to take a session an operator is mid-thought
+ *  on. A judgement call, not a measurement. */
+export declare const IDLE_TTL_MS: number;
+/** RAM held by everything that is neither a session nor free: the co-resident
+ *  Neo4j JVMs, Ollama, the brand servers, edge/manager, the OS.
+ *
+ *  TAKES THE SLICE'S anon, NOT ITS memory.current, and the distinction is the
+ *  whole correctness of this function. memory.current = anon + file + slab + …,
+ *  where `file` is page cache the kernel hands back under pressure — and
+ *  MemAvailable ALREADY counts that cache as available. Subtracting
+ *  memory.current from a MemAvailable-derived residual therefore subtracts the
+ *  slice's cache twice, UNDER-stating the baseline and so OVER-stating the
+ *  bound (high = total - baseline - margin). That is the unsafe direction: a
+ *  weaker throttle. Worse, it ratchets — slice cache growth raises sliceKb
+ *  while leaving sysAvailKb untouched, so the bound climbs monotonically back
+ *  toward the ~96%-of-RAM value this task exists to remove. anon has no such
+ *  overlap with MemAvailable, so none of that happens.
+ *
+ *  Measured on the laptop, 2026-07-17 (slice: current 7.94 GB, anon 5.61 GB,
+ *  file 1.16 GB, slab 0.99 GB; box: total 62.5 GiB, avail 38.3 GiB):
+ *    from anon           -> 18.97 GiB
+ *    from memory.current -> 16.8 GiB   (2.2 GB low — exactly file + slab)
+ *  The task measured Neo4j's four JVMs plus Ollama at ~19 GB independently, so
+ *  the anon form reproduces a figure derived a different way. That agreement is
+ *  the evidence for this formula; the memory.current form disagreed with it by
+ *  the precise size of the double-count.
+ *
+ *  Stable as sessions come and go: session anon growth consumes sysAvailKb and
+ *  raises sliceAnonKb by the same amount, so the baseline holds. Cache growth
+ *  moves neither. Only a real baseline change (a brand added, Ollama loading a
+ *  model) moves it — which is what should move it.
+ *
+ *  Still an estimate: slab is charged to the slice but counted here as
+ *  non-session, because MemAvailable counts only the reclaimable part of it.
+ *  That over-states the baseline slightly, making the bound SMALLER — this time
+ *  genuinely the safe direction, and THROTTLE_MARGIN_KB absorbs it. The reclaim
+ *  trigger reads sysAvailKb alone and needs none of this arithmetic. */
+export declare function resolveNonSessionBaselineKb(sysTotalKb: number, sysAvailKb: number, sliceAnonKb: number): number;
+/** The slice's soft ceiling: total RAM, less what non-session processes hold,
+ *  less a margin to leave free. Soft throughout — MemoryHigh throttles and
+ *  reclaims, never kills.
+ *
+ *  BE HONEST ABOUT WHAT THIS IS. On the non-floored branch it reduces:
+ *
+ *      high = T - max(0, T - A - anon) - M  =  A + anon - M
+ *
+ *  sysTotalKb cancels. The bound is therefore NOT "a share of total RAM" — it
+ *  is "what the slice's unreclaimable footprint is now, plus what is genuinely
+ *  free, less the margin", and it is identical on a 62 GB box and a 200 GB box
+ *  with the same A and anon. That is correct (A already encodes T, and the
+ *  question is how far the slice may grow from where it is), but the
+ *  total-minus-baseline SHAPE reads as though total RAM drives the answer, and
+ *  it does not. The two-function form is kept because the baseline is a real
+ *  quantity worth logging on its own — it is what the operator needs to see to
+ *  understand WHY the bound is what it is — not because total RAM is an input
+ *  in any meaningful sense.
+ *
+ *  Units: MemoryHigh acts on memory.current, while the baseline is derived from
+ *  anon. Deliberate, not an oversight — the bound must be reachable in
+ *  memory.current terms, but the HEADROOM it encodes is an anon question, since
+ *  only anon growth consumes MemAvailable.
+ *
+ *  What the kernel reclaims when the bound is crossed, exactly. The excess is
+ *      (anon + file + slab) - (A + anon - M)  =  (file + slab) - (A - M)
+ *  and the reclaimable cache on hand is (file + slab). So WHILE A >= M the
+ *  excess is always fully coverable from cache: the slice's cache is reclaimed,
+ *  which is what MemoryHigh is for, and no session is throttled. Below A = M
+ *  the bound falls under anon and the kernel does throttle the cohort's anon —
+ *  correct, and the designed third tier (recover at 8 GB free, refuse at 4 GB,
+ *  throttle here), but not free, so the qualifier matters. */
+export declare function resolveSliceMemoryHighKb(sysTotalKb: number, nonSessionKb: number, marginKb: number): number;
+/** True when the bound is worth writing: never applied, or moved by more than
+ *  HYSTERESIS_KB. The baseline is stable but not noise-free, and every
+ *  co-resident brand's daemon derives the SAME box-wide value, so without a
+ *  band four daemons would rewrite the same drop-in on every tick. */
+export declare function shouldApplyMemoryHigh(desiredKb: number, currentKb: number | null): boolean;
+/** The idle-oldest operator session, or null.
+ *
+ *  There is NO transcript check, and the inversion is the point. reaper.ts:63
+ *  refuses to reap anything with a transcript on disk, because for a specialist
+ *  a transcript means real work was done. Here the transcript is the
+ *  PRECONDITION that makes stopping safe: it is the durable artifact, and
+ *  `--resume <sessionId>` reconstitutes the session from it. Stopping an idle
+ *  operator session is not lossy — it trades RAM for resume latency.
+ *
+ *  "Idle" here means status:'idle' — NOT PRODUCING OUTPUT. It does NOT mean
+ *  detached, and these must not be conflated: an operator may be attached and
+ *  watching a session this returns. Under pressure that session can still be
+ *  taken. No attachment signal is consulted; the one that exists (Task 1705's
+ *  stream-lifecycle) lives in the UI server process, not this one. */
+export declare function selectVictim(rows: readonly SessionRow[], nowMs: number, idleTtlMs: number): SessionRow | null;
+export interface ReclaimLine {
+    sessionId: string;
+    /** The scope unit stopped, or 'none' when no tracker resolved. */
+    unit: string;
+    idleMs: number;
+    sysAvailKb: number;
+    thresholdKb: number;
+    /** Null renders as `unknown`, never 0 — see formatPtyCensus. */
+    sliceKb: number | null;
+}
+/** Pure — no I/O. Carries what happened AND the numbers that caused it, so an
+ *  auto-stop is as legible as an operator stop. */
+export declare function formatReclaim(a: ReclaimLine): string;
+/** Pure — no I/O. Pressure with no reclaimable session is a real state and must
+ *  not be silent; mirrors `[pty-cap] ... evicted=none`. */
+export declare function formatPressureNoVictim(sysAvailKb: number, thresholdKb: number): string;
+/** Pure — no I/O. Names the baseline so an operator can see WHY the bound is
+ *  what it is, not merely that it changed. */
+export declare function formatSliceHighApplied(baselineKb: number, highKb: number, previousKb: number | null): string;
+export interface SliceMemoryPolicy {
+    start(): void;
+    stop(): void;
+    /** Run one pass synchronously. Exposed for tests. */
+    tickOnce(): void;
+}
+export interface SliceMemoryPolicyDeps {
+    watcher: FsWatcher;
+    intervalMs: number;
+    killGraceMs: number;
+    logger: Logger;
+    /** Injectable clock for tests. Defaults to Date.now. */
+    now?: () => number;
+    /** Injectable measurement for tests. Defaults to the census collector, whose
+     *  reads this deliberately reuses rather than duplicating. */
+    collect?: () => PtyCensusSnapshot;
+    /** Injectable systemctl for tests. Defaults to spawnSync. */
+    runSystemctl?: SystemctlRunner;
+}
+export declare function createSliceMemoryPolicy(deps: SliceMemoryPolicyDeps): SliceMemoryPolicy;
+//# sourceMappingURL=slice-memory-policy.d.ts.map

package/payload/platform/services/claude-session-manager/dist/slice-memory-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slice-memory-policy.d.ts","sourceRoot":"","sources":["../src/slice-memory-policy.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5D;;;mBAGmB;AACnB,eAAO,MAAM,aAAa,QAAkB,CAAA;AAE5C;wEACwE;AACxE,eAAO,MAAM,kBAAkB,QAAkB,CAAA;AAEjD;0EAC0E;AAC1E,eAAO,MAAM,aAAa,QAAkB,CAAA;AAE5C;wDACwD;AACxD,eAAO,MAAM,iBAAiB,QAAkB,CAAA;AAEhD;;;+CAG+C;AAC/C,eAAO,MAAM,WAAW,QAAiB,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEAiCwE;AACxE,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DA+B8D;AAC9D,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED;;;sEAGsE;AACtE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAG1F;AAED;;;;;;;;;;;;;sEAasE;AACtE,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,UAAU,EAAE,EAC3B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,IAAI,CAUnB;AAMD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED;mDACmD;AACnD,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAMpD;AAED;2DAC2D;AAC3D,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;8CAC8C;AAC9C,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,CAKR;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,qDAAqD;IACrD,QAAQ,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,SAAS,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB;kEAC8D;IAC9D,OAAO,CAAC,EAAE,MAAM,iBAAiB,CAAA;IACjC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,eAAe,CAAA;CAC/B;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAoKtF"}

package/payload/platform/services/claude-session-manager/dist/slice-memory-policy.js

@@ -0,0 +1,333 @@
+// Task 1709 — operator sessions have no idle-stop path, and the slice
+// MemoryHigh cannot fire before the box thrashes.
+//
+// Two gaps, one consequence. reaper.ts:59 returns false unless agent !== null
+// and :63 returns false if a transcript exists, so it reaps only specialists
+// that never wrote one; the specialist LRU (pty-spawner.ts:1224) is likewise
+// specialist-only and checkSlotsAndMaybeEvict returns early for any
+// non-specialist spawn. An operator session is reaped by nothing and evicted
+// by nothing. Meanwhile the installer sized the slice's MemoryHigh at total
+// RAM minus a FIXED 2.7 GiB floor — a floor scoped to ONE brand's "neo4j +
+// brand server + edge/manager/chrome". Four co-resident brands run four Neo4j
+// JVMs plus Ollama, so the real non-session baseline is ~19-21 GB and the
+// bound landed at ~96% of total RAM, where the session cohort can never reach
+// it.
+//
+// The floor could not have been a better constant: the installer does not
+// configure Neo4j's heap, and Neo4j's own default sizing scales with host RAM.
+// The baseline is a function of host RAM AND co-resident brand count, so it is
+// knowable only by measurement. Hence: measure, do not guess.
+//
+// THE TRIGGER IS MemAvailable, NOT THE SLICE. /proc/meminfo's MemAvailable is
+// already box-wide and already correct (Task 1707 certifies sysAvailMb /
+// sysTotalMb; Task 600's admission gate already trusts it). Because the signal
+// is box-wide, the aggregate bound holds across all four co-resident brands
+// with NO cross-daemon coordination and NO shared state — brand isolation is
+// untouched. The failure the aggregate bound must avoid is a per-daemon COUNT
+// cap (RC_DAEMON_CAPACITY=10) being structurally unable to express a shared RAM
+// constraint; a box-wide RAM signal does express it.
+//
+// Ordering against the existing gates, deliberate:
+//   sysAvail < RECLAIM_AT (8G)       -> reclaim idle-oldest operator session
+//   memAvail < MIN_ADMISSION_MB (4G) -> refuse new specialists (Task 600)
+//   slice    > MemoryHigh            -> kernel throttles the cohort
+// Recover, then refuse, then throttle.
+//
+// Shape mirrors pty-census.ts / session-cap-audit.ts: PURE derivations + PURE
+// formatters (no I/O, unit-tested) + an impure collector + a start/stop factory
+// whose setInterval is unref'd and cleared on shutdown.
+import { collectPtyCensus } from './pty-census.js';
+import { CLAUDE_PTYS_SLICE, scopeUnitName, defaultSystemctlRunner, } from './systemd-scope.js';
+import { stopSession, getPtyTrackerForTests } from './pty-spawner.js';
+/** Reclaim an idle operator session when free RAM falls below this. Sits one
+ *  step above Task 600's MIN_ADMISSION_MB (4 GB) so reclaim precedes refusal:
+ *  recovering RAM is preferable to refusing work. A judgement call, not a
+ *  measurement. */
+export const RECLAIM_AT_KB = 8 * 1024 * 1024;
+/** Free RAM the slice's MemoryHigh leaves for everything else. Also absorbs
+ *  the baseline's own imprecision (see resolveNonSessionBaselineKb). */
+export const THROTTLE_MARGIN_KB = 4 * 1024 * 1024;
+/** Re-apply MemoryHigh only on a delta larger than this. Chosen to exceed the
+ *  baseline's imprecision so measurement noise cannot trigger a write. */
+export const HYSTERESIS_KB = 2 * 1024 * 1024;
+/** Floor for the slice bound on a small host. Mirrors SLICE_MIN_HIGH_BYTES in
+ *  packages/create-maxy-code/src/port-resolution.ts. */
+export const SLICE_MIN_HIGH_KB = 2 * 1024 * 1024;
+/** How long an operator session's transcript must have been static before it
+ *  is a reclaim candidate. Far below the 8.7 h floor of the measured idle
+ *  population, and long enough not to take a session an operator is mid-thought
+ *  on. A judgement call, not a measurement. */
+export const IDLE_TTL_MS = 30 * 60 * 1000;
+/** RAM held by everything that is neither a session nor free: the co-resident
+ *  Neo4j JVMs, Ollama, the brand servers, edge/manager, the OS.
+ *
+ *  TAKES THE SLICE'S anon, NOT ITS memory.current, and the distinction is the
+ *  whole correctness of this function. memory.current = anon + file + slab + …,
+ *  where `file` is page cache the kernel hands back under pressure — and
+ *  MemAvailable ALREADY counts that cache as available. Subtracting
+ *  memory.current from a MemAvailable-derived residual therefore subtracts the
+ *  slice's cache twice, UNDER-stating the baseline and so OVER-stating the
+ *  bound (high = total - baseline - margin). That is the unsafe direction: a
+ *  weaker throttle. Worse, it ratchets — slice cache growth raises sliceKb
+ *  while leaving sysAvailKb untouched, so the bound climbs monotonically back
+ *  toward the ~96%-of-RAM value this task exists to remove. anon has no such
+ *  overlap with MemAvailable, so none of that happens.
+ *
+ *  Measured on the laptop, 2026-07-17 (slice: current 7.94 GB, anon 5.61 GB,
+ *  file 1.16 GB, slab 0.99 GB; box: total 62.5 GiB, avail 38.3 GiB):
+ *    from anon           -> 18.97 GiB
+ *    from memory.current -> 16.8 GiB   (2.2 GB low — exactly file + slab)
+ *  The task measured Neo4j's four JVMs plus Ollama at ~19 GB independently, so
+ *  the anon form reproduces a figure derived a different way. That agreement is
+ *  the evidence for this formula; the memory.current form disagreed with it by
+ *  the precise size of the double-count.
+ *
+ *  Stable as sessions come and go: session anon growth consumes sysAvailKb and
+ *  raises sliceAnonKb by the same amount, so the baseline holds. Cache growth
+ *  moves neither. Only a real baseline change (a brand added, Ollama loading a
+ *  model) moves it — which is what should move it.
+ *
+ *  Still an estimate: slab is charged to the slice but counted here as
+ *  non-session, because MemAvailable counts only the reclaimable part of it.
+ *  That over-states the baseline slightly, making the bound SMALLER — this time
+ *  genuinely the safe direction, and THROTTLE_MARGIN_KB absorbs it. The reclaim
+ *  trigger reads sysAvailKb alone and needs none of this arithmetic. */
+export function resolveNonSessionBaselineKb(sysTotalKb, sysAvailKb, sliceAnonKb) {
+    return Math.max(0, sysTotalKb - sysAvailKb - sliceAnonKb);
+}
+/** The slice's soft ceiling: total RAM, less what non-session processes hold,
+ *  less a margin to leave free. Soft throughout — MemoryHigh throttles and
+ *  reclaims, never kills.
+ *
+ *  BE HONEST ABOUT WHAT THIS IS. On the non-floored branch it reduces:
+ *
+ *      high = T - max(0, T - A - anon) - M  =  A + anon - M
+ *
+ *  sysTotalKb cancels. The bound is therefore NOT "a share of total RAM" — it
+ *  is "what the slice's unreclaimable footprint is now, plus what is genuinely
+ *  free, less the margin", and it is identical on a 62 GB box and a 200 GB box
+ *  with the same A and anon. That is correct (A already encodes T, and the
+ *  question is how far the slice may grow from where it is), but the
+ *  total-minus-baseline SHAPE reads as though total RAM drives the answer, and
+ *  it does not. The two-function form is kept because the baseline is a real
+ *  quantity worth logging on its own — it is what the operator needs to see to
+ *  understand WHY the bound is what it is — not because total RAM is an input
+ *  in any meaningful sense.
+ *
+ *  Units: MemoryHigh acts on memory.current, while the baseline is derived from
+ *  anon. Deliberate, not an oversight — the bound must be reachable in
+ *  memory.current terms, but the HEADROOM it encodes is an anon question, since
+ *  only anon growth consumes MemAvailable.
+ *
+ *  What the kernel reclaims when the bound is crossed, exactly. The excess is
+ *      (anon + file + slab) - (A + anon - M)  =  (file + slab) - (A - M)
+ *  and the reclaimable cache on hand is (file + slab). So WHILE A >= M the
+ *  excess is always fully coverable from cache: the slice's cache is reclaimed,
+ *  which is what MemoryHigh is for, and no session is throttled. Below A = M
+ *  the bound falls under anon and the kernel does throttle the cohort's anon —
+ *  correct, and the designed third tier (recover at 8 GB free, refuse at 4 GB,
+ *  throttle here), but not free, so the qualifier matters. */
+export function resolveSliceMemoryHighKb(sysTotalKb, nonSessionKb, marginKb) {
+    return Math.max(SLICE_MIN_HIGH_KB, sysTotalKb - nonSessionKb - marginKb);
+}
+/** True when the bound is worth writing: never applied, or moved by more than
+ *  HYSTERESIS_KB. The baseline is stable but not noise-free, and every
+ *  co-resident brand's daemon derives the SAME box-wide value, so without a
+ *  band four daemons would rewrite the same drop-in on every tick. */
+export function shouldApplyMemoryHigh(desiredKb, currentKb) {
+    if (currentKb === null)
+        return true;
+    return Math.abs(desiredKb - currentKb) > HYSTERESIS_KB;
+}
+/** The idle-oldest operator session, or null.
+ *
+ *  There is NO transcript check, and the inversion is the point. reaper.ts:63
+ *  refuses to reap anything with a transcript on disk, because for a specialist
+ *  a transcript means real work was done. Here the transcript is the
+ *  PRECONDITION that makes stopping safe: it is the durable artifact, and
+ *  `--resume <sessionId>` reconstitutes the session from it. Stopping an idle
+ *  operator session is not lossy — it trades RAM for resume latency.
+ *
+ *  "Idle" here means status:'idle' — NOT PRODUCING OUTPUT. It does NOT mean
+ *  detached, and these must not be conflated: an operator may be attached and
+ *  watching a session this returns. Under pressure that session can still be
+ *  taken. No attachment signal is consulted; the one that exists (Task 1705's
+ *  stream-lifecycle) lives in the UI server process, not this one. */
+export function selectVictim(rows, nowMs, idleTtlMs) {
+    const candidates = rows.filter((r) => r.agent === null &&
+        r.state === 'live' &&
+        r.status === 'idle' &&
+        nowMs - r.updatedAt > idleTtlMs);
+    if (candidates.length === 0)
+        return null;
+    return candidates.reduce((oldest, r) => (r.updatedAt < oldest.updatedAt ? r : oldest));
+}
+const TAG = '[session-reclaim]';
+const kbToMb = (kb) => Math.round(kb / 1024);
+/** Pure — no I/O. Carries what happened AND the numbers that caused it, so an
+ *  auto-stop is as legible as an operator stop. */
+export function formatReclaim(a) {
+    return (`${TAG} reclaimed sessionId=${a.sessionId} unit=${a.unit} idle-ms=${a.idleMs} ` +
+        `memAvailMb=${kbToMb(a.sysAvailKb)} thresholdMb=${kbToMb(a.thresholdKb)} ` +
+        `sliceMb=${a.sliceKb === null ? 'unknown' : kbToMb(a.sliceKb)} reason=memory-pressure`);
+}
+/** Pure — no I/O. Pressure with no reclaimable session is a real state and must
+ *  not be silent; mirrors `[pty-cap] ... evicted=none`. */
+export function formatPressureNoVictim(sysAvailKb, thresholdKb) {
+    return `${TAG} pressure memAvailMb=${kbToMb(sysAvailKb)} thresholdMb=${kbToMb(thresholdKb)} victim=none`;
+}
+/** Pure — no I/O. Names the baseline so an operator can see WHY the bound is
+ *  what it is, not merely that it changed. */
+export function formatSliceHighApplied(baselineKb, highKb, previousKb) {
+    return (`${TAG} slice-high-applied baselineMb=${kbToMb(baselineKb)} highMb=${kbToMb(highKb)} ` +
+        `previousMb=${previousKb === null ? 'none' : kbToMb(previousKb)}`);
+}
+export function createSliceMemoryPolicy(deps) {
+    const now = deps.now ?? (() => Date.now());
+    const collect = deps.collect ?? (() => collectPtyCensus());
+    const runSystemctl = deps.runSystemctl ?? defaultSystemctlRunner;
+    let timer = null;
+    function sizeBound(snap) {
+        // sliceAnonKb null: no live scope resolved the slice path, or the memory
+        // cgroup controller is disabled — where MemoryHigh is a silent no-op
+        // regardless. Skip sizing; reclaim below still runs on sysAvailKb alone.
+        if (snap.sliceAnonKb === null)
+            return;
+        const baselineKb = resolveNonSessionBaselineKb(snap.sysTotalKb, snap.sysAvailKb, snap.sliceAnonKb);
+        const desiredKb = resolveSliceMemoryHighKb(snap.sysTotalKb, baselineKb, THROTTLE_MARGIN_KB);
+        // Compare against the bound ACTUALLY IN FORCE (read from the slice's
+        // memory.high), never against what this process remembers writing. Four
+        // co-resident brands write this one file, each on its own tick phase and
+        // from its own sysAvailKb sample, so they derive different values and
+        // last-writer-wins. A process trusting its own memory would believe a value
+        // a sibling has already replaced, and would then decline to re-apply
+        // because its own delta looked small. Reading reality also makes
+        // previousMb= truthful: it is what this write replaced, not what this
+        // process hoped was there.
+        if (!shouldApplyMemoryHigh(desiredKb, snap.sliceHighKb))
+            return;
+        const r = runSystemctl([
+            '--user',
+            'set-property',
+            CLAUDE_PTYS_SLICE,
+            `MemoryHigh=${kbToMb(desiredKb)}M`,
+        ]);
+        if (r.exitCode !== 0) {
+            // Never discard the error body — it is the only account of why the bound
+            // this task exists to fix is not in force.
+            deps.logger(`${TAG} op=slice-high-failed exitCode=${r.exitCode} stderr=${r.stderr.trim()}`);
+            return;
+        }
+        deps.logger(formatSliceHighApplied(baselineKb, desiredKb, snap.sliceHighKb));
+    }
+    function reclaim(snap) {
+        if (snap.sysAvailKb >= RECLAIM_AT_KB)
+            return;
+        const victim = selectVictim(deps.watcher.all(), now(), IDLE_TTL_MS);
+        if (!victim) {
+            deps.logger(formatPressureNoVictim(snap.sysAvailKb, RECLAIM_AT_KB));
+            return;
+        }
+        // The scope token can come from either of two places, and passing only the
+        // tracker is how a reclaim silently does nothing. A session spawned by THIS
+        // manager is in the module-scoped livePtys map. A session that survived a
+        // manager restart is not — it was reattached to its SessionRow by the
+        // boot-seed, and its token lives on the row. stopSession takes the row
+        // token as a fallback, but ONLY if the caller supplies it; without it, a
+        // tracker miss returns no-store-entry immediately, issuing no systemctl
+        // call and logging nothing at all.
+        const tracker = getPtyTrackerForTests(victim.sessionId);
+        const token = tracker ? tracker.scopeUnitToken : victim.scopeUnitToken;
+        const unit = token === null ? 'none' : scopeUnitName(token);
+        const idleMs = now() - victim.updatedAt;
+        // Same stop path as the reaper, operator stop and the specialist LRU:
+        // systemctl stop of the scope unit, with in-cgroup SIGTERM->SIGKILL
+        // escalation bounded by TimeoutStopSec. Async by design — the tick stays
+        // synchronous and the fs-watcher drops the row when the PID file goes — so
+        // the outcome is reported when it lands rather than awaited here.
+        void stopSession({
+            killGraceMs: deps.killGraceMs,
+            logger: deps.logger,
+            runSystemctl: deps.runSystemctl,
+            rowScopeUnitToken: victim.scopeUnitToken,
+            rowPid: victim.pid,
+        }, victim.sessionId)
+            .then((outcome) => {
+            // A reclaim that stopped nothing is not a reclaim. no-store-entry means
+            // neither a tracker nor a row token resolved, so no signal was ever
+            // sent and the RAM this line claims to have recovered is still held.
+            // Logging `reclaimed` for it would be a success claim for a no-op —
+            // the same class of error as reading "returned" as "succeeded".
+            if (outcome.path === 'no-store-entry') {
+                deps.logger(`${TAG} op=reclaim-no-op sessionId=${victim.sessionId} reason=no-scope-resolved ` +
+                    `memAvailMb=${kbToMb(snap.sysAvailKb)} note=ram-still-held`);
+                return;
+            }
+            deps.logger(formatReclaim({
+                sessionId: victim.sessionId,
+                unit,
+                idleMs,
+                sysAvailKb: snap.sysAvailKb,
+                thresholdKb: RECLAIM_AT_KB,
+                sliceKb: snap.sliceKb,
+            }));
+        })
+            .catch((err) => {
+            deps.logger(`${TAG} op=reclaim-failed sessionId=${victim.sessionId} ` +
+                `message=${err instanceof Error ? err.message : String(err)}`);
+        });
+    }
+    function tickOnce() {
+        const snap = collect();
+        // A TICK THAT CANNOT MEASURE MUST NOT ACT.
+        //
+        // readMeminfoKb yields 0 for a missing field, and its two fallbacks are
+        // INDEPENDENT — MemTotal parsing while MemAvailable does not gives a
+        // positive sysTotalKb beside a sysAvailKb of 0. Both fields must therefore
+        // be checked, not just the one:
+        //
+        //   * no /proc at all (darwin, any non-Linux): both read 0.
+        //   * /proc/meminfo unreadable: both read 0.
+        //   * MemAvailable absent (kernels < 3.14, some container /proc
+        //     presentations) while MemTotal is present: sysAvailKb alone reads 0.
+        //
+        // In every case 0 means UNMEASURED, never "no free RAM" — but the pressure
+        // test reads `0 < RECLAIM_AT_KB` as true, so an unguarded tick would stop
+        // every idle operator session, once a minute, on a box under no pressure
+        // whatsoever. A real Linux host reports a positive MemTotal always, and a
+        // positive MemAvailable even under genuine pressure (it is an estimate that
+        // includes reclaimable cache, and reaches exactly 0 only when the box is
+        // already dead), so this costs no true positives.
+        if (snap.sysTotalKb <= 0 || snap.sysAvailKb <= 0) {
+            deps.logger(`${TAG} op=tick-unmeasurable sysTotalKb=${snap.sysTotalKb} sysAvailKb=${snap.sysAvailKb} action=none`);
+            return;
+        }
+        sizeBound(snap);
+        reclaim(snap);
+    }
+    return {
+        tickOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                try {
+                    tickOnce();
+                }
+                catch (err) {
+                    deps.logger(`${TAG} op=tick-failed message=${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, deps.intervalMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            deps.logger(`${TAG} op=policy-started intervalMs=${deps.intervalMs} reclaimAtMb=${kbToMb(RECLAIM_AT_KB)} idleTtlMs=${IDLE_TTL_MS}`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=slice-memory-policy.js.map

package/payload/platform/services/claude-session-manager/dist/slice-memory-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slice-memory-policy.js","sourceRoot":"","sources":["../src/slice-memory-policy.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,kDAAkD;AAClD,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AACpE,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM;AACN,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,qDAAqD;AACrD,EAAE;AACF,mDAAmD;AACnD,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,uCAAuC;AACvC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,wDAAwD;AAExD,OAAO,EAAE,gBAAgB,EAAuC,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAGrE;;;mBAGmB;AACnB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAE5C;wEACwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAE5C;wDACwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEhD;;;+CAG+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wEAiCwE;AACxE,MAAM,UAAU,2BAA2B,CACzC,UAAkB,EAClB,UAAkB,EAClB,WAAmB;IAEnB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DA+B8D;AAC9D,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC,CAAA;AAC1E,CAAC;AAED;;;sEAGsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,SAAwB;IAC/E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,aAAa,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;;;sEAasE;AACtE,MAAM,UAAU,YAAY,CAC1B,IAA2B,EAC3B,KAAa,EACb,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,KAAK,IAAI;QAChB,CAAC,CAAC,KAAK,KAAK,MAAM;QAClB,CAAC,CAAC,MAAM,KAAK,MAAM;QACnB,KAAK,GAAG,CAAC,CAAC,SAAS,GAAG,SAAS,CAClC,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,GAAG,GAAG,mBAAmB,CAAA;AAE/B,MAAM,MAAM,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AAa5D;mDACmD;AACnD,MAAM,UAAU,aAAa,CAAC,CAAc;IAC1C,OAAO,CACL,GAAG,GAAG,wBAAwB,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,GAAG;QAC/E,cAAc,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG;QAC1E,WAAW,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CACvF,CAAA;AACH,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,WAAmB;IAC5E,OAAO,GAAG,GAAG,wBAAwB,MAAM,CAAC,UAAU,CAAC,gBAAgB,MAAM,CAAC,WAAW,CAAC,cAAc,CAAA;AAC1G,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,MAAc,EACd,UAAyB;IAEzB,OAAO,CACL,GAAG,GAAG,kCAAkC,MAAM,CAAC,UAAU,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG;QACtF,cAAc,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAClE,CAAA;AACH,CAAC;AAuBD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAA;IAChE,IAAI,KAAK,GAA0B,IAAI,CAAA;IAEvC,SAAS,SAAS,CAAC,IAAuB;QACxC,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAM;QACrC,MAAM,UAAU,GAAG,2BAA2B,CAC5C,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,WAAW,CACjB,CAAA;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAC3F,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,qEAAqE;QACrE,iEAAiE;QACjE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;YAAE,OAAM;QAC/D,MAAM,CAAC,GAAG,YAAY,CAAC;YACrB,QAAQ;YACR,cAAc;YACd,iBAAiB;YACjB,cAAc,MAAM,CAAC,SAAS,CAAC,GAAG;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,yEAAyE;YACzE,2CAA2C;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC3F,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9E,CAAC;IAED,SAAS,OAAO,CAAC,IAAuB;QACtC,IAAI,IAAI,CAAC,UAAU,IAAI,aAAa;YAAE,OAAM;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAA;QACtE,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAA;QACvC,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,KAAK,WAAW,CACd;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,MAAM,CAAC,cAAc;YACxC,MAAM,EAAE,MAAM,CAAC,GAAG;SACnB,EACD,MAAM,CAAC,SAAS,CACjB;aACE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,+BAA+B,MAAM,CAAC,SAAS,4BAA4B;oBAC/E,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAC9D,CAAA;gBACD,OAAM;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CACT,aAAa,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI;gBACJ,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CACH,CAAA;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,gCAAgC,MAAM,CAAC,SAAS,GAAG;gBACvD,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChE,CAAA;QACH,CAAC,CAAC,CAAA;IACN,CAAC;IAED,SAAS,QAAQ;QACf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;QACtB,2CAA2C;QAC3C,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,EAAE;QACF,4DAA4D;QAC5D,6CAA6C;QAC7C,gEAAgE;QAChE,0EAA0E;QAC1E,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,kDAAkD;QAClD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,oCAAoC,IAAI,CAAC,UAAU,eAAe,IAAI,CAAC,UAAU,cAAc,CACtG,CAAA;YACD,OAAM;QACR,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAA;QACf,OAAO,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,IAAI,CAAC;oBACH,QAAQ,EAAE,CAAA;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpF,CAAA;gBACH,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACpD,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,iCAAiC,IAAI,CAAC,UAAU,gBAAgB,MAAM,CAAC,aAAa,CAAC,cAAc,WAAW,EAAE,CACvH,CAAA;QACH,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/start-counter.d.ts

@@ -0,0 +1,10 @@
+export interface StartCounterDeps {
+    accountId?: string;
+    tmpDir?: string;
+    existsSync?: (p: string) => boolean;
+    readFileSync?: (p: string, enc: 'utf8') => string;
+    writeFileSync?: (p: string, d: string, enc: 'utf8') => void;
+    log?: (line: string) => void;
+}
+export declare function bumpStartCounter(deps?: StartCounterDeps): void;
+//# sourceMappingURL=start-counter.d.ts.map

package/payload/platform/services/claude-session-manager/dist/start-counter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-counter.d.ts","sourceRoot":"","sources":["../src/start-counter.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;IACnC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IACjD,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,gBAAqB,GAAG,IAAI,CAiClE"}

package/payload/platform/services/claude-session-manager/dist/start-counter.js

@@ -0,0 +1,55 @@
+// Task 1706 — the manager's boot boundary.
+//
+// server.log is appended to by TWO systemd units: the UI process and this one.
+// The UI stamps a counted start line at every boot (platform/ui/server-init.cjs:79)
+// — 151 of them in sitedesk-code's server.log. This process stamped none, yet it
+// is the one that emits [wa-stream], [claude-session-manager], [webchat-session]
+// and most of the file's volume. So a question like "how many streams are armed
+// right now?" could not be scoped to the live process from the log alone, and
+// Task 1705's investigation had to recover the process start time from `ps` —
+// after first publishing a confidently-wrong answer from unscoped counts.
+//
+// The counter lives in /tmp keyed on ACCOUNT_ID, exactly as server-init.cjs does:
+// /tmp clears on reboot, so a clean reboot starts fresh while a restart loop
+// keeps the same /tmp and shows count>1. The key is DISTINCT from the UI's
+// (`server-init-` vs `session-manager-`) — a shared path would make two
+// co-resident processes clobber each other's counts.
+//
+// The line is emitted via console.error so the Task 666 timestamp sink stamps it;
+// install-log-sink.js must be imported before this runs.
+import { existsSync as fsExistsSync, readFileSync as fsReadFileSync, writeFileSync as fsWriteFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function bumpStartCounter(deps = {}) {
+    const accountId = deps.accountId ?? process.env.ACCOUNT_ID ?? 'default';
+    const tmpDir = deps.tmpDir ?? '/tmp';
+    const existsSync = deps.existsSync ?? fsExistsSync;
+    const readFileSync = deps.readFileSync ?? fsReadFileSync;
+    const writeFileSync = deps.writeFileSync ?? fsWriteFileSync;
+    const log = deps.log ?? ((line) => console.error(line));
+    const counterPath = join(tmpDir, `session-manager-${accountId}-restart.count`);
+    let prior = 0;
+    if (existsSync(counterPath)) {
+        try {
+            const parsed = Number.parseInt(readFileSync(counterPath, 'utf8').trim(), 10);
+            if (Number.isFinite(parsed) && parsed >= 0)
+                prior = parsed;
+        }
+        catch {
+            // Unreadable counter — treat as 0. The start line still emits, which is
+            // the load-bearing half: a boot boundary with a wrong count still scopes
+            // a query, but no boundary at all sends the reader back to `ps`.
+        }
+    }
+    const next = prior + 1;
+    try {
+        writeFileSync(counterPath, String(next), 'utf8');
+    }
+    catch (err) {
+        // Counter persistence is best-effort; never let it swallow the start line.
+        // The error body is named, never discarded — an unwritable /tmp is exactly
+        // the condition that would silently reset every count to 1 forever.
+        log(`[claude-session-manager] start-counter-write-failed path=${counterPath} err=${err instanceof Error ? err.message : String(err)}`);
+    }
+    log(`[claude-session-manager] start count=${next} account=${accountId} counter-path=${counterPath}`);
+}
+//# sourceMappingURL=start-counter.js.map

package/payload/platform/services/claude-session-manager/dist/start-counter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-counter.js","sourceRoot":"","sources":["../src/start-counter.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,2EAA2E;AAC3E,wEAAwE;AACxE,qDAAqD;AACrD,EAAE;AACF,kFAAkF;AAClF,yDAAyD;AAEzD,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,YAAY,IAAI,cAAc,EAAE,aAAa,IAAI,eAAe,EAAE,MAAM,SAAS,CAAA;AACtH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAWhC,MAAM,UAAU,gBAAgB,CAAC,OAAyB,EAAE;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAA;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAA;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAA;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAK,cAAqD,CAAA;IAChG,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAK,eAA+D,CAAA;IAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAE/D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,SAAS,gBAAgB,CAAC,CAAA;IAE9E,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAA;IACtB,IAAI,CAAC;QACH,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,2EAA2E;QAC3E,oEAAoE;QACpE,GAAG,CAAC,4DAA4D,WAAW,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxI,CAAC;IAED,GAAG,CAAC,wCAAwC,IAAI,YAAY,SAAS,iBAAiB,WAAW,EAAE,CAAC,CAAA;AACtG,CAAC"}