@rubytech/create-sitedesk-code 0.1.612 → 0.1.614

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-delivery.js

@@ -0,0 +1,133 @@
+/**
+ * Task 2776 — establishing that a routine's turn actually reached the chat.
+ *
+ * The dispatch path cannot report this, and the line that claimed to was wrong.
+ * A scheduled dispatch is `role:'admin'`, and `TelegramGateway.sendOutbound` —
+ * the path that runs a reply closure inline — is the PUBLIC door's route and
+ * says so in its own comment. An admin turn's final text is delivered much
+ * later, by the native file follower's fan-out over `telegramFanTargets`. That
+ * send site holds no eventId and no runId, so it cannot name the run it belongs
+ * to, and threading run identity through the inject POST, the gateway, the PTY
+ * session and the transcript to reach it would be a change across four
+ * subsystems.
+ *
+ * What the send site DOES record is the session. The reply closure writes each
+ * outbound row with `sessionId` taken from the same value `schedule-inject`
+ * returns as `sessionKey`, and `recordRunSession` already persists that on the
+ * run. A run's deliveries are therefore recoverable by joining two records that
+ * are already on disk — no reproduction, no threading, and no later traffic
+ * required, which is what the standing check needs.
+ *
+ * Telegram only. WhatsApp resolves a phone rather than a bot and has no
+ * equivalent store to reconcile against; its runs are left alone rather than
+ * stamped null, because counting them would manufacture exactly the false
+ * silence this task removes.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { telegramStoreRoot } from "../../../../../lib/telegram-reach/dist/index.js";
+/**
+ * The rows belonging to one run: this session's, at or after the run started,
+ * and strictly before the ceiling.
+ *
+ * `to` is the NEXT run's `startedAt` on the same session, or null when this is
+ * the newest run there and the window is still open. Half-open at the top for
+ * the reason `promoteRoutineRuns` bounds its transcript window the same way:
+ * without it, run N's window would swallow every later run's output and both
+ * would be credited with one answer.
+ *
+ * The session match is what makes this an attribution rather than a guess.
+ * `adminSessionIdFor` puts every run for one destination in ONE conversation
+ * together with the operator's own messages, so a time window alone would credit
+ * a routine that has been dead for a week with whatever the operator was told.
+ *
+ * TWO known limits, stated rather than hidden.
+ *
+ * A send landing after the NEXT run has started is attributed to that next run.
+ * For a five-minute recurrence the window is five minutes, far longer than a
+ * turn's send takes.
+ *
+ * More importantly, the session is NOT a per-routine identity.
+ * `telegramAdminSessionId` hashes (accountId, chatId, botId), so two routines
+ * reporting to the same chat share one session and their runs interleave here.
+ * A message one of them sent after the other fired lands in the other's window
+ * and is credited to it, leaving the true sender recorded as silent. A store row
+ * carries no eventId, so nothing here can tell them apart —
+ * `promoteRoutineRuns` can, because a transcript carries the routine's own
+ * schedule marker, and no equivalent exists on the store side. Task 2779 holds
+ * the fix. Until then this is exact for an account whose destinations each have
+ * one routine, which is the measured case, and approximate otherwise.
+ *
+ * Pure — no IO — so the rule is testable without a filesystem or a graph, the
+ * same contract `classifyRunEvidence` states for itself.
+ */
+export function selectDeliveredRows(rows, sessionKey, from, to) {
+    return rows
+        .filter((r) => r.sessionId === sessionKey && r.createdAt >= from && (to === null || r.createdAt < to))
+        .sort((a, b) => (a.createdAt < b.createdAt ? -1 : a.createdAt > b.createdAt ? 1 : 0));
+}
+/**
+ * Every confirmed agent row this account holds for `destination`, across EVERY
+ * bot that has one.
+ *
+ * Not only the expected carrier's file, deliberately: a routine whose carrier
+ * moved still delivered to a real chat, on the wrong bot, and reading one file
+ * would record that as silence. The row id embeds the channel key, so the
+ * `deliveredMessageId` this produces names the bot that actually carried it —
+ * which is how a moved carrier becomes visible on the delivery itself.
+ *
+ * `origin: 'agent'` AND `fromMe: true` because the store holds the inbound side
+ * of the same conversation, and an inbound row is the operator talking, not the
+ * routine answering.
+ *
+ * Never throws: an absent directory, an unreadable file, a malformed line and a
+ * row missing the joined fields are each skipped, because this runs inside the
+ * reconcile sweep and a bookkeeping failure must never cost the tick.
+ */
+export function readAgentRowsForDestination(platformRoot, accountId, destination) {
+    const dir = join(telegramStoreRoot(platformRoot), accountId);
+    if (!existsSync(dir))
+        return [];
+    let names;
+    try {
+        // The `_` is part of the match, so chat 1311221864 does not also collect
+        // rows from chat 11311221864's file.
+        names = readdirSync(dir).filter((n) => n.endsWith(`_${destination}.jsonl`));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        let text;
+        try {
+            text = readFileSync(join(dir, name), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        for (const raw of text.split("\n")) {
+            const line = raw.trim();
+            if (line.length === 0)
+                continue;
+            let rec;
+            try {
+                rec = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (rec.origin !== "agent" || rec.fromMe !== true)
+                continue;
+            const { messageId, sessionId, createdAt, body } = rec;
+            if (typeof messageId !== "string" ||
+                typeof sessionId !== "string" ||
+                typeof createdAt !== "string") {
+                continue;
+            }
+            out.push({ messageId, sessionId, createdAt, body: typeof body === "string" ? body : "" });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=routine-delivery.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-delivery.js","sourceRoot":"","sources":["../../src/lib/routine-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAcpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAsB,EACtB,UAAkB,EAClB,IAAY,EACZ,EAAiB;IAEjB,OAAO,IAAI;SACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAC9F;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,yEAAyE;QACzE,qCAAqC;QACrC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,WAAW,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,IAAI,GAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAC5D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;YACtD,IACE,OAAO,SAAS,KAAK,QAAQ;gBAC7B,OAAO,SAAS,KAAK,QAAQ;gBAC7B,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-run.d.ts

@@ -1,4 +1,5 @@
 import type { Driver } from "neo4j-driver";
+import { type StoredAgentRow } from "./routine-delivery.js";
 /** Which dispatch loop opened the record. */
 export type RunKind = "recurring" | "one-time";
 /** The `chooseDispatchMode` result the record was opened for. */
@@ -23,6 +24,19 @@ export type RunMode = "agent" | "action" | "none";
 export type RunOutcome = "accepted" | "failed" | "no-destination" | "gated";
 /** Records are kept for 30 days. A quarter-hourly routine settles at ~2,900 per account. */
 export declare const RETENTION_DAYS = 30;
+/**
+ * Task 2776 — the window BOTH delivery controls work over.
+ *
+ * One constant because the two must not drift: if `reconcileRoutineDelivery`
+ * looked over a shorter window than `routineDeliveryCensus`, the census would
+ * report as silent a run the reconciliation had already stopped trying to
+ * stamp — an alarm about the checker rather than about the routine.
+ *
+ * It is also what makes the change forward-only without a migration: runs
+ * recorded before this shipped leave the window within a day, so nothing needs
+ * backfilling and nothing is backfilled.
+ */
+export declare const DELIVERY_WINDOW_HOURS = 24;
 /**
  * How long an `open` record may live before it counts as an orphan. This is
  * `DISPATCH_TIMEOUT_MS` from check-due-events, the hard ceiling on the dispatch
@@ -133,18 +147,6 @@ export declare function classifyRunEvidence(window: string, eventId: string): "n
  *  characters holds every real message and bounds the node, the JSON the admin
  *  route serves and the CSV cell together. */
 export declare const OUTPUT_EXCERPT_CAP = 2000;
-/**
- * The delivered text inside one run's transcript window, or null when the run
- * delivered nothing. Pure, so the rule is testable without a filesystem or a
- * graph, exactly like `classifyRunEvidence` above.
- *
- * Null is not a failure. A routine that only writes to the calendar finishes
- * having sent nothing, and `finished` with no excerpt is the honest reading of
- * that; the run surfaces say so in those words. A malformed line is skipped
- * rather than thrown on — the window is a byte range of a file being appended
- * to, so a partial trailing line is normal.
- */
-export declare function extractDeliveredText(window: string): string | null;
 /**
  * Promote `accepted` and `started` records from evidence in the transcript.
  *
@@ -219,4 +221,57 @@ export declare function auditRunsWithoutOutput(driver: Driver, accountId: string
  * nothing watching it. Emitted every tick including zero.
  */
 export declare function auditRunCensus(driver: Driver, accountId: string): Promise<void>;
+/**
+ * Task 2776 — stamp each telegram run with the send that reached the chat, and
+ * with the text of it.
+ *
+ * Runs AFTER `promoteRoutineRuns` and separately from it. Promotion acts on a
+ * status transition, and the send lands at about the same instant as the
+ * assistant row that triggers it, so stamping inside that transition would race
+ * and record a false silence.
+ *
+ * No status filter, deliberately: a run can deliver while still `accepted`,
+ * before promotion has seen its assistant row, and filtering to `finished` would
+ * read that as silence. Rows already carrying a `deliveredMessageId` are skipped
+ * in JS rather than in Cypher because every run on a session is needed to
+ * compute the next one's ceiling — the same reason `promoteRoutineRuns` selects
+ * them all. That skip is what makes the pass idempotent, so a delivery arriving
+ * after promotion is picked up on a later tick.
+ *
+ * Telegram only. A WhatsApp run has no equivalent store to reconcile against and
+ * is left alone rather than stamped null-and-counted, which would manufacture
+ * exactly the false silence this task removes.
+ *
+ * Never throws (honours the sweep contract).
+ */
+export declare function reconcileRoutineDelivery(driver: Driver, accountId: string, platformRoot: string, nowMs: number, deps?: {
+    readRows?: (root: string, acct: string, dest: string) => StoredAgentRow[];
+}): Promise<{
+    stamped: number;
+}>;
+/**
+ * Task 2776 — the standing reconciliation: accepted wakes against runs that
+ * carry a delivery, over a rolling window.
+ *
+ * This is the control the defect needed and did not have. A wake that produced
+ * no message emits nothing, and re-firing the routine does not surface it, so
+ * only a periodic comparison of expected against actual can see it — the same
+ * reasoning `auditRunsWithoutOutput` states for itself.
+ *
+ * `silent` is NOT an error on its own: a routine told to report only when
+ * something is new is silent by design. So the line NAMES the events
+ * contributing to it rather than alarming on the count, and an event silent
+ * across every accepted wake for a full window is the shape worth reading.
+ *
+ * The window also carries the forward-only rule. Runs recorded before this
+ * shipped fall out of a 24-hour window within a day, so nothing needs
+ * backfilling and nothing is backfilled.
+ *
+ * Telegram only, matching `reconcileRoutineDelivery`: a WhatsApp run can never
+ * be stamped, so counting it would report every one of them as silent forever.
+ *
+ * Emitted every sweep including zero, because a check that is silent when
+ * healthy cannot be told apart from one that stopped running. Never throws.
+ */
+export declare function routineDeliveryCensus(driver: Driver, accountId: string, nowMs: number, windowHours?: number): Promise<void>;
 //# sourceMappingURL=routine-run.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routine-run.d.ts","sourceRoot":"","sources":["../../src/lib/routine-run.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,6CAA6C;AAC7C,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;AAE/C,iEAAiE;AACjE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAE5E,4FAA4F;AAC5F,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,eAAe,SAAU,CAAC;AAEvC,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYlD;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoDhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGpG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,GAAG,IAAI,CAsBtG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAKpG;AAED;;8CAE8C;AAC9C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAuBvC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5E,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAClD,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkGhD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,aAAa,GAAE,MAAuB,GACrC,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BrG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7F;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BrF"}
+{"version":3,"file":"routine-run.d.ts","sourceRoot":"","sources":["../../src/lib/routine-run.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,6CAA6C;AAC7C,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;AAE/C,iEAAiE;AACjE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAE5E,4FAA4F;AAC5F,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,eAAe,SAAU,CAAC;AAEvC,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYlD;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyDhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGpG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,GAAG,IAAI,CAsBtG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAKpG;AAED;;8CAE8C;AAC9C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAgBvC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5E,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAClD,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoGhD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,aAAa,GAAE,MAAuB,GACrC,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BrG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7F;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BrF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,cAAc,EAAE,CAAC;CACtE,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyG9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,MAA8B,GAC1C,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-run.js

@@ -18,8 +18,22 @@
 import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readdirSync, readSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { readAgentRowsForDestination, selectDeliveredRows, } from "./routine-delivery.js";
 /** Records are kept for 30 days. A quarter-hourly routine settles at ~2,900 per account. */
 export const RETENTION_DAYS = 30;
+/**
+ * Task 2776 — the window BOTH delivery controls work over.
+ *
+ * One constant because the two must not drift: if `reconcileRoutineDelivery`
+ * looked over a shorter window than `routineDeliveryCensus`, the census would
+ * report as silent a run the reconciliation had already stopped trying to
+ * stamp — an alarm about the checker rather than about the routine.
+ *
+ * It is also what makes the change forward-only without a migration: runs
+ * recorded before this shipped leave the window within a day, so nothing needs
+ * backfilling and nothing is backfilled.
+ */
+export const DELIVERY_WINDOW_HOURS = 24;
 /**
  * How long an `open` record may live before it counts as an orphan. This is
  * `DISPATCH_TIMEOUT_MS` from check-due-events, the hard ceiling on the dispatch
@@ -71,6 +85,11 @@ export async function openRoutineRun(driver, input) {
                 sessionKey: null,
                 transcriptOffset: null,
                 bounded: false,
+                // Task 2776 — the store row id of the message that reached the chat,
+                // stamped later by `reconcileRoutineDelivery`. Null here and null
+                // forever on a run that sent nothing, which is the property that
+                // separates a quiet routine from a broken one.
+                deliveredMessageId: null,
                 error: null,
             },
         });
@@ -287,66 +306,19 @@ export function classifyRunEvidence(window, eventId) {
  *  characters holds every real message and bounds the node, the JSON the admin
  *  route serves and the CSV cell together. */
 export const OUTPUT_EXCERPT_CAP = 2000;
-/**
- * The tool calls whose `input.text` IS the message the recipient saw.
- *
- * Deliberately a second copy of the reader's constants
- * (`platform/ui/app/lib/reader/parse-transcript.ts:147-168`): `platform/plugins`
- * must never import from `platform/ui`, exactly as `mapRun` in
- * `platform/ui/server/routes/admin/routines.ts` restates this module's own
- * projection across the same boundary.
- *
- * Reading the assistant's `text` blocks instead would store the agent's internal
- * narration — the reader classifies those as `agent-text` and never as anything
- * delivered — and present it as the message that was sent.
- */
-const DELIVERY_TOOLS = new Set([
-    "mcp__whatsapp-channel__reply",
-    "mcp__channel__reply",
-    "mcp__webchat-channel__reply",
-    "mcp__whatsapp-channel__send-to-party",
-    "mcp__channel__send-to-party",
-]);
-/**
- * The delivered text inside one run's transcript window, or null when the run
- * delivered nothing. Pure, so the rule is testable without a filesystem or a
- * graph, exactly like `classifyRunEvidence` above.
- *
- * Null is not a failure. A routine that only writes to the calendar finishes
- * having sent nothing, and `finished` with no excerpt is the honest reading of
- * that; the run surfaces say so in those words. A malformed line is skipped
- * rather than thrown on — the window is a byte range of a file being appended
- * to, so a partial trailing line is normal.
- */
-export function extractDeliveredText(window) {
-    const parts = [];
-    for (const raw of window.split("\n")) {
-        const line = raw.trim();
-        if (line.length === 0)
-            continue;
-        let rec;
-        try {
-            rec = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        const r = rec;
-        if (r?.type !== "assistant" || !Array.isArray(r.message?.content))
-            continue;
-        for (const block of r.message.content) {
-            const b = block;
-            if (b?.type !== "tool_use" || typeof b.name !== "string" || !DELIVERY_TOOLS.has(b.name))
-                continue;
-            const text = b.input?.text;
-            if (typeof text === "string" && text.trim().length > 0)
-                parts.push(text);
-        }
-    }
-    if (parts.length === 0)
-        return null;
-    return parts.join("\n\n").slice(0, OUTPUT_EXCERPT_CAP);
-}
+// Task 2776 — `DELIVERY_TOOLS` and `extractDeliveredText` are GONE.
+//
+// They scanned a run's transcript window for the channel reply tools
+// (`mcp__channel__reply` and siblings). Task 2078 retired every one of them: the
+// turn's own final text is the delivery on all four doors now, and nothing live
+// emits those tool calls. So the scan matched nothing, `outputExcerpt` was null
+// on every modern run, and `auditRunsWithoutOutput` reported `missing` equal to
+// `finished` forever — a control pinned at its alarm value, which reads as noise
+// rather than as the signal it was built to be.
+//
+// The excerpt now comes from the outbound store rows `reconcileRoutineDelivery`
+// finds below: the text the recipient actually received, from the only record
+// that exists because a send was confirmed.
 /**
  * Promote `accepted` and `started` records from evidence in the transcript.
  *
@@ -413,27 +385,32 @@ export async function promoteRoutineRuns(driver, accountId, deps = {}) {
             const produced = evidence === "finished";
             if (next === status)
                 continue;
-            // Task 2359 — captured on the finished transition only. A `started` run
-            // has produced nothing yet, and a run already at `finished` never reaches
-            // here (the `next === status` guard above), so the window is read for its
-            // text exactly once per run.
-            const excerpt = produced ? extractDeliveredText(win) : null;
+            // Task 2776 — the excerpt is no longer written here. It was read from the
+            // transcript by `extractDeliveredText`, which scanned for reply tools Task
+            // 2078 retired and so stored null on every modern run. The text the
+            // recipient received is the outbound store row, stamped by
+            // `reconcileRoutineDelivery` on the same pass that records WHICH message
+            // reached the chat — after this one, because a send lands at about the
+            // same moment as the assistant row that triggers `finished` here.
+            //
+            // This function now establishes status alone, which is all a transcript
+            // can honestly answer.
             const now = new Date().toISOString();
             const w = driver.session();
             try {
                 await w.run(`MATCH (r:RoutineRun {runId: $runId})
            SET r.status = $status,
-               r.finishedAt = $finishedAt,
-               r.outputExcerpt = $outputExcerpt`, { runId, status: next, finishedAt: produced ? now : null, outputExcerpt: excerpt });
+               r.finishedAt = $finishedAt`, { runId, status: next, finishedAt: produced ? now : null });
                 if (produced)
                     finished++;
                 else
                     started++;
-                // outputChars is the measured length of what was stored, not a claim
-                // that capture ran: `outputChars=0` on `status=finished` is the
-                // signature of a run that finished having sent nothing, or of
-                // extraction having gone blind.
-                console.error(`[routine-run] op=promote runId=${runId} status=${next} outputChars=${excerpt?.length ?? 0}`);
+                // Task 2776 — `outputChars` is gone from this line. It reported the
+                // length of an excerpt this function no longer captures, so keeping it
+                // would print `outputChars=0` on every promotion and read as a run that
+                // sent nothing. What was sent is named on `op=routine-delivered`, by the
+                // pass that actually knows.
+                console.error(`[routine-run] op=promote runId=${runId} status=${next}`);
             }
             finally {
                 try {
@@ -644,4 +621,181 @@ export async function auditRunCensus(driver, accountId) {
         }
     }
 }
+/**
+ * Task 2776 — stamp each telegram run with the send that reached the chat, and
+ * with the text of it.
+ *
+ * Runs AFTER `promoteRoutineRuns` and separately from it. Promotion acts on a
+ * status transition, and the send lands at about the same instant as the
+ * assistant row that triggers it, so stamping inside that transition would race
+ * and record a false silence.
+ *
+ * No status filter, deliberately: a run can deliver while still `accepted`,
+ * before promotion has seen its assistant row, and filtering to `finished` would
+ * read that as silence. Rows already carrying a `deliveredMessageId` are skipped
+ * in JS rather than in Cypher because every run on a session is needed to
+ * compute the next one's ceiling — the same reason `promoteRoutineRuns` selects
+ * them all. That skip is what makes the pass idempotent, so a delivery arriving
+ * after promotion is picked up on a later tick.
+ *
+ * Telegram only. A WhatsApp run has no equivalent store to reconcile against and
+ * is left alone rather than stamped null-and-counted, which would manufacture
+ * exactly the false silence this task removes.
+ *
+ * Never throws (honours the sweep contract).
+ */
+export async function reconcileRoutineDelivery(driver, accountId, platformRoot, nowMs, deps = {}) {
+    const readRows = deps.readRows ?? readAgentRowsForDestination;
+    const since = new Date(nowMs - DELIVERY_WINDOW_HOURS * 60 * 60 * 1000).toISOString();
+    let stamped = 0;
+    // One read per DESTINATION, not per run. Every run against one chat shares a
+    // destination, so reading inside the loop parsed the same files once per run
+    // and discarded all but one result. The files cannot change within a pass.
+    const rowCache = new Map();
+    const rowsFor = (dest) => {
+        const hit = rowCache.get(dest);
+        if (hit !== undefined)
+            return hit;
+        const read = readRows(platformRoot, accountId, dest);
+        rowCache.set(dest, read);
+        return read;
+    };
+    const session = driver.session();
+    try {
+        // Bounded by the SAME window as the census, deliberately. Unbounded, this
+        // stamped every telegram run in the 30-day retention on the first tick after
+        // upgrade — the backfill this task's scope boundaries exclude — and never
+        // settled: a run that legitimately delivered nothing stays unstamped, so it
+        // was re-examined on every 120-second tick for as long as it survived.
+        //
+        // The window must never be SHORTER than the census's, or the census would
+        // report as silent a run this pass had already stopped trying to stamp. One
+        // constant serves both so they cannot drift.
+        const res = await session.run(`MATCH (r:RoutineRun)
+       WHERE r.accountId = $accountId
+         AND r.target STARTS WITH 'telegram:'
+         AND r.sessionKey IS NOT NULL
+         AND r.startedAt >= $since
+       RETURN r.runId AS runId, r.sessionKey AS sessionKey, r.target AS target,
+              r.eventId AS eventId, r.startedAt AS startedAt,
+              r.deliveredMessageId AS deliveredMessageId
+       ORDER BY r.sessionKey, r.startedAt`, { accountId, since });
+        const rows = res.records.map((rec) => ({
+            runId: rec.get("runId"),
+            sessionKey: rec.get("sessionKey"),
+            destination: rec.get("target").slice("telegram:".length),
+            eventId: rec.get("eventId"),
+            startedAt: rec.get("startedAt"),
+            delivered: (rec.get("deliveredMessageId") ?? null),
+        }));
+        for (let i = 0; i < rows.length; i++) {
+            const row = rows[i];
+            if (row.delivered !== null)
+                continue;
+            // The ceiling is the next run's start in the SAME conversation. Null means
+            // this is the newest run there and its window is still open, so a slow
+            // turn is still attributed rather than read as silence.
+            const succ = rows[i + 1];
+            const ceiling = succ && succ.sessionKey === row.sessionKey ? succ.startedAt : null;
+            const found = selectDeliveredRows(rowsFor(row.destination), row.sessionKey, row.startedAt, ceiling);
+            if (found.length === 0)
+                continue;
+            const excerpt = found.map((r) => r.body).join("\n\n").slice(0, OUTPUT_EXCERPT_CAP);
+            const w = driver.session();
+            try {
+                await w.run(`MATCH (r:RoutineRun {runId: $runId})
+           SET r.deliveredMessageId = $deliveredMessageId,
+               r.outputExcerpt = $outputExcerpt`, { runId: row.runId, deliveredMessageId: found[0].messageId, outputExcerpt: excerpt });
+                stamped++;
+                // The carrier comes off the row id (`telegram:<acct>:<botId>:<chat>:out:<iso>`)
+                // rather than from the event, so this names the bot that ACTUALLY carried
+                // the message. A routine whose carrier moved shows a botId here that
+                // differs from the one it named — the wrong-bot case made visible on the
+                // delivery itself rather than inferred afterwards.
+                const botId = found[0].messageId.split(":")[2] ?? "-";
+                console.error(`[schedule-dispatch] op=routine-delivered event=${row.eventId} run=${row.runId} ` +
+                    `botId=${botId} chatId=${row.destination} messageId=${found[0].messageId} ` +
+                    `rows=${found.length} chars=${excerpt.length}`);
+            }
+            finally {
+                try {
+                    await w.close();
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    catch (err) {
+        console.error(`[routine-run] op=delivery-reconcile-error acct=${accountId.slice(0, 8)} ` +
+            `detail=${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        try {
+            await session.close();
+        }
+        catch {
+            // ignore
+        }
+    }
+    return { stamped };
+}
+/**
+ * Task 2776 — the standing reconciliation: accepted wakes against runs that
+ * carry a delivery, over a rolling window.
+ *
+ * This is the control the defect needed and did not have. A wake that produced
+ * no message emits nothing, and re-firing the routine does not surface it, so
+ * only a periodic comparison of expected against actual can see it — the same
+ * reasoning `auditRunsWithoutOutput` states for itself.
+ *
+ * `silent` is NOT an error on its own: a routine told to report only when
+ * something is new is silent by design. So the line NAMES the events
+ * contributing to it rather than alarming on the count, and an event silent
+ * across every accepted wake for a full window is the shape worth reading.
+ *
+ * The window also carries the forward-only rule. Runs recorded before this
+ * shipped fall out of a 24-hour window within a day, so nothing needs
+ * backfilling and nothing is backfilled.
+ *
+ * Telegram only, matching `reconcileRoutineDelivery`: a WhatsApp run can never
+ * be stamped, so counting it would report every one of them as silent forever.
+ *
+ * Emitted every sweep including zero, because a check that is silent when
+ * healthy cannot be told apart from one that stopped running. Never throws.
+ */
+export async function routineDeliveryCensus(driver, accountId, nowMs, windowHours = DELIVERY_WINDOW_HOURS) {
+    const since = new Date(nowMs - windowHours * 60 * 60 * 1000).toISOString();
+    const session = driver.session();
+    try {
+        const res = await session.run(`MATCH (r:RoutineRun)
+       WHERE r.accountId = $accountId
+         AND r.target STARTS WITH 'telegram:'
+         AND r.dispatchResult = 'accepted'
+         AND r.startedAt >= $since
+       RETURN count(r) AS accepted,
+              count(r.deliveredMessageId) AS delivered,
+              collect(DISTINCT CASE WHEN r.deliveredMessageId IS NULL THEN r.eventId END) AS silentEvents`, { accountId, since });
+        const rec = res.records[0];
+        const accepted = toNumber(rec?.get("accepted")) ?? 0;
+        const delivered = toNumber(rec?.get("delivered")) ?? 0;
+        const silentEvents = (rec?.get("silentEvents") ?? []).filter((e) => typeof e === "string");
+        const head = `[routine-delivery-census] accountId=${accountId.slice(0, 8)} accepted=${accepted} ` +
+            `delivered=${delivered} silent=${accepted - delivered} window=${windowHours}h`;
+        console.error(silentEvents.length > 0 ? `${head} silent-events=[${silentEvents.join(",")}]` : head);
+    }
+    catch (err) {
+        console.error(`[routine-delivery-census] op=routine-delivery-census-error acct=${accountId.slice(0, 8)} ` +
+            `detail=${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        try {
+            await session.close();
+        }
+        catch {
+            // ignore
+        }
+    }
+}
 //# sourceMappingURL=routine-run.js.map