@senpi/runtime 3.0.58 → 3.0.62

package/dist/deploy/job.d.ts

@@ -0,0 +1,199 @@
+import type { DeployEvent, DeployEventBody, DeployReport, JobPhase } from "./orchestrator.js";
+export type JobState = 
+/** `stopRequested` = the deadline watchdog has asked the run to stop at its next step boundary. */
+{
+    status: "running";
+    phase: JobPhase;
+    stopRequested: boolean;
+} | {
+    status: "done";
+    overall: DeployReport["overall"];
+}
+/**
+ * Stamped by `scanOnBoot`, and SYNTHESIZED by {@link DeployJobController.readJournal} for any
+ * journal with no terminal line — which is the same thing in almost every case, and not in one:
+ * `append` swallows write failures (see its doc), so a deploy that ran to `live` on a full or
+ * read-only volume never got its terminal line written and reads `interrupted` forever after.
+ * A live process still never produces this state for its OWN job — `status` answers from memory
+ * while the job is running.
+ */
+ | {
+    status: "interrupted";
+};
+export interface DeployJobMeta {
+    /** "dpl-" + 8 lowercase hex */
+    deployId: string;
+    packageId: string;
+    version: string;
+    packageDir: string;
+    budget?: number;
+    /** ISO */
+    startedAt: string;
+}
+export interface JobSnapshot {
+    meta: DeployJobMeta;
+    state: JobState;
+    /** tail, newest last (capped in memory; the journal holds the full history) */
+    events: DeployEvent[];
+    /** terminal jobs only */
+    report?: DeployReport;
+}
+/** What `run` is handed: its own id, narration in, the deadline stop out. Nothing else. */
+export interface JobHandle {
+    /** This job's id — the `senpi.deploy.id` span attribute the run's own spans carry. */
+    deployId: string;
+    emit(event: DeployEventBody): void;
+    shouldAbandon(): boolean;
+}
+export interface DeployJobControllerOptions {
+    deploysDir: string;
+    now(): number;
+    log(line: string): void;
+    /** journals retained by the boot scan; default 20 */
+    keep?: number;
+}
+/**
+ * H6: every MCP call a deploy makes is separately deadline-bounded. Owned here, beside the grace it
+ * determines, so the two can never be hand-synced apart; `register.ts` imports it for its own
+ * per-call signals.
+ */
+export declare const MCP_CALL_TIMEOUT_MS = 90000;
+/**
+ * How long the soft stop gets to land at a step boundary before the slot is taken back by force.
+ *
+ * DERIVED, never a bare number: force-terminate releases the single-flight slot while the abandoned
+ * run may still be waiting on a call. Sized past the per-call deadline so that by the time the slot
+ * frees, every call the abandoned run could still be awaiting has already been abandoned by its own
+ * deadline — a NEW deploy never starts its preflight/create while the old job is still parked on a
+ * money-moving call against the same funding waterfall. The headroom covers the abort landing and
+ * the step-boundary check that follows it.
+ *
+ * What this does NOT buy: a deadline bounds the WAIT, not the backend's work (`boundAwait` in
+ * `senpi/client.ts` — the gateway-injected MCP transport accepts no abort option). A create or fund
+ * this job stopped waiting on may still complete server-side after the slot has been handed on.
+ * What the grace guarantees is that the job is no longer *waiting* on a money-moving call when the
+ * slot comes back; the residue is reconciled by the next deploy, not prevented here.
+ *
+ * (This supersedes the plan's locked 60s: 60 < the locked 90s call timeout, so the two locked
+ * defaults were mutually inconsistent.)
+ */
+export declare const GRACE_MS: number;
+/**
+ * The single-flight slot is IN-MEMORY ONLY (`this.live`). It must never be persisted: an
+ * interrupted job belongs to a dead process and leaves the slot free by construction — persisting
+ * it would wedge every deploy on the box after one crash.
+ */
+export declare class DeployJobController {
+    private readonly deploysDir;
+    private readonly now;
+    private readonly log;
+    private readonly keep;
+    private live;
+    constructor(opts: DeployJobControllerOptions);
+    /** The running job's identity and progress, or null. The single-flight gate reads this. */
+    running(): (DeployJobMeta & {
+        phase: JobPhase;
+        stopRequested: boolean;
+    }) | null;
+    /**
+     * Claim the single job slot and fire `run` un-awaited.
+     *
+     * Single-flight is a money invariant, not a convenience: concurrent deploys
+     * share one funding waterfall, so two preflights can both pass while jointly
+     * overdrawing. Throws when a job is already running. The ordinary
+     * `E_DEPLOY_IN_PROGRESS` refusal comes from the gateway's own `running()`
+     * check BEFORE it gets here; this throw is the lost race between that check
+     * and this call, and the gateway catches it and renders the same refusal.
+     *
+     * `capMs` is the job's wall-clock cap (H6). Every MCP call the run makes is separately
+     * timeout-bounded, but a cap is what guarantees the slot comes back: one hung await used to hold
+     * it until the gateway restarted, and a boundary-honored stop flag never protected that case.
+     */
+    start(meta: Omit<DeployJobMeta, "deployId" | "startedAt">, capMs: number, run: (job: JobHandle) => Promise<DeployReport>): DeployJobMeta;
+    /**
+     * The running job (from memory) when it is the one being asked about — by id or by omission —
+     * else the newest journal, or the named one. Unknown id → null.
+     *
+     * The live check MUST come first even for an explicit id: a
+     * running job's journal has no terminal line yet, so falling through to {@link readJournal}
+     * would render it `interrupted` — a state only the boot scan may ever assign, and a flat lie
+     * about a job that is actively moving money.
+     */
+    status(deployId?: string): Promise<JobSnapshot | null>;
+    /**
+     * C2 carve-out: the ONE sanctioned journal read that feeds the orchestrator — and only as a
+     * LOOKUP KEY. Every id returned here is verified against the live backend (strategy_list
+     * strategyIds:[…]) before reconcile acts on it; the journal never decides anything.
+     *
+     * It exists because a create whose custom name the backend rejected lands under a
+     * backend-assigned name, which the reconcile name match can never find again: without the key,
+     * a re-run creates and funds a second wallet beside the first.
+     *
+     * Returns instance name → journaled created-strategy ids, newest journals first.
+     *
+     * `deployId` scopes the answer to ONE journal. Reconcile deliberately passes nothing: every
+     * journal of the package is a legitimate key source there, because any of them may hold the id
+     * of the wallet a re-run must adopt instead of funding a second one (D-9). The interrupted RENDER
+     * passes its own id, because it answers a narrower question — what did THIS job leave behind —
+     * and a still-live wallet from an earlier completed deploy is not that. Rendering it there would
+     * offer to close a strategy that is running exactly as intended.
+     */
+    priorCreatedStrategyIds(packageId: string, deployId?: string): Map<string, string[]>;
+    /**
+     * The second D-9 lookup input off the SAME create-key event: strategyId → the amount that create
+     * call asked the backend to fund.
+     *
+     * Narrower than {@link priorCreatedStrategyIds} in what it may do, and deliberately so. It feeds
+     * exactly one thing — the report's funded-vs-requested comparison — and only the REQUESTED half
+     * of it; the funded half is always re-read live from `strategy_list` on the current run. No
+     * orchestration branch reads it, so a stale, missing or wrong entry costs a warn, never an action.
+     *
+     * It exists because the ask lives only in the memory of the run that funded. A deploy that funds
+     * $60 of a $500 ask and dies before assembling its report resumes as an adoption, and without
+     * this the shortfall is simply never mentioned again.
+     *
+     * Newest journal wins on a repeated strategyId — the ask that most recently produced that wallet.
+     */
+    priorRequestedFunding(packageId: string): Map<string, number>;
+    /**
+     * Boot janitor: stamp every unterminated journal `interrupted`, then prune to
+     * the newest `keep`. Discovery is pull-based — the next `openclaw senpi deploy status`
+     * renders the interruption; nothing is resumed or notified here.
+     */
+    scanOnBoot(): Promise<void>;
+    private recordEvent;
+    /**
+     * Close a job out. The slot is released in `finally`: a journal-write failure is narration lost,
+     * never a wedged single-flight slot that would refuse every future deploy with a stale
+     * `E_DEPLOY_IN_PROGRESS`.
+     */
+    private terminate;
+    private journalPath;
+    /**
+     * Append one journal line. **Never throws**: the journal is narration, and the narration-only
+     * rule cuts both ways — a full or read-only state volume must not be able to change what a
+     * deploy does (or wedge its slot). A failed write is logged and the line is lost.
+     */
+    private append;
+    private journalIds;
+    private readLines;
+    /** Journals newest-first by header `startedAt` — the only ordering the controller trusts. */
+    private journalIdsNewestFirst;
+    private newestJournalId;
+    /**
+     * Journal → snapshot. A journal with no terminal line IS an interrupted job.
+     *
+     * The FIRST terminal line wins. That ordering is load-bearing: when the deadline watchdog
+     * force-terminates a wedged job, the zombie `run` promise may settle later and append a second
+     * terminal line — the watchdog's verdict is the true one, and reading the first keeps it.
+     */
+    private readJournal;
+    /** Retain the newest `keep` journals. Runs on every terminate and on boot, so a long-lived
+     * gateway does not grow `deploys/` without bound between restarts. Never throws.
+     *
+     * Unlocked by design: prune and every journal read are fully synchronous on one thread, so they
+     * cannot interleave in-process; a torn last line is already tolerated by `readLines`. Do not add
+     * locking without a cross-process caller. */
+    private prune;
+}
+//# sourceMappingURL=job.d.ts.map

package/dist/deploy/job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job.d.ts","sourceRoot":"","sources":["../../src/deploy/job.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAsB9F,MAAM,MAAM,QAAQ;AAClB,mGAAmG;AACjG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAA;CAAE;AACtD;;;;;;;GAOG;GACD;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAE9B,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU;IACV,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,+EAA+E;IAC/E,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,yBAAyB;IACzB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,aAAa,IAAI,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,IAAI,MAAM,CAAC;IACd,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA6BD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,QAAQ,QAA+B,CAAC;AAErD;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyB;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,IAAI,CAAwB;gBAExB,IAAI,EAAE,0BAA0B;IAO5C,2FAA2F;IAC3F,OAAO,IAAI,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI;IAK/E;;;;;;;;;;;;;OAaG;IACH,KAAK,CACH,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,WAAW,CAAC,EACnD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,GAC7C,aAAa;IAuFhB;;;;;;;;OAQG;IACG,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAiB5D;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAuBpF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAkB7D;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IA8BjB,OAAO,CAAC,WAAW;IAInB;;;;OAIG;IACH,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,SAAS;IAejB,6FAA6F;IAC7F,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAsBnB;;;;;iDAK6C;IAC7C,OAAO,CAAC,KAAK;CAQd"}

package/dist/deploy/job.js

@@ -0,0 +1,463 @@
+/**
+ * Everything async about a deploy: the single-flight job slot, the append-only
+ * JSONL journal, the wall-clock deadline watchdog, the boot-time interrupted
+ * scan, and status snapshots. It runs whatever `run` closure the gateway hands
+ * it and knows nothing about MCP or orchestration.
+ *
+ * **There is no cancel** (D-4): undeploying a strategy is closing it, not
+ * stopping the job. The only thing that stops a running deploy early is the
+ * deadline watchdog armed in {@link DeployJobController.start} — a soft stop the
+ * orchestrator honours at its next step boundary, followed by a force-terminate
+ * that frees the slot even when the run is wedged inside an await.
+ *
+ * **The journal is narration-only.** No code path may read `deploys/*.jsonl` to
+ * decide an action. Journals are read for exactly three purposes: rendering
+ * `status` history, the boot scan that stamps unterminated journals
+ * `interrupted`, and the one sanctioned carve-out — {@link
+ * DeployJobController.priorCreatedStrategyIds}, which yields a LOOKUP KEY (a
+ * strategyId this box journaled at create time) that reconcile must verify
+ * against the live backend before acting on it. Every orchestrator decision
+ * still reads the live surfaces (backend strategies + runtime registry) — that
+ * is what keeps the E_STATE drift class dead.
+ *
+ * **No auto-resume.** `scanOnBoot` is a janitor: it stamps and prunes, and never
+ * re-enters a state machine. Only a fresh agent-initiated `senpi deploy`
+ * resumes, via reconciliation.
+ */
+import { randomBytes } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { recordDeploy } from "../telemetry/metrics.js";
+import { extractTaxonomyCode } from "./taxonomy.js";
+/**
+ * The taxonomy code of the FIRST refused step in the report, for the deploy metric's dimension.
+ *
+ * Reads the shared extractor, not a private pattern: this was the third reader, and its narrower
+ * one silently dropped any code carrying a digit — so `[E_MIN_10]` would exit 2 at the CLI and
+ * carry a `senpi.deploy.refusal.code` span attribute while producing no metric dimension at all.
+ */
+function firstRefusalCode(report) {
+    for (const instance of report.instances) {
+        for (const outcome of Object.values(instance.steps)) {
+            if (outcome.status !== "refused")
+                continue;
+            const code = extractTaxonomyCode(outcome.detail);
+            if (code)
+                return code;
+        }
+    }
+    return undefined;
+}
+const EVENT_TAIL_MAX = 50;
+const DEFAULT_KEEP = 20;
+const DEPLOY_ID_RE = /^dpl-[0-9a-f]{8}$/;
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * H6: every MCP call a deploy makes is separately deadline-bounded. Owned here, beside the grace it
+ * determines, so the two can never be hand-synced apart; `register.ts` imports it for its own
+ * per-call signals.
+ */
+export const MCP_CALL_TIMEOUT_MS = 90_000;
+/**
+ * How long the soft stop gets to land at a step boundary before the slot is taken back by force.
+ *
+ * DERIVED, never a bare number: force-terminate releases the single-flight slot while the abandoned
+ * run may still be waiting on a call. Sized past the per-call deadline so that by the time the slot
+ * frees, every call the abandoned run could still be awaiting has already been abandoned by its own
+ * deadline — a NEW deploy never starts its preflight/create while the old job is still parked on a
+ * money-moving call against the same funding waterfall. The headroom covers the abort landing and
+ * the step-boundary check that follows it.
+ *
+ * What this does NOT buy: a deadline bounds the WAIT, not the backend's work (`boundAwait` in
+ * `senpi/client.ts` — the gateway-injected MCP transport accepts no abort option). A create or fund
+ * this job stopped waiting on may still complete server-side after the slot has been handed on.
+ * What the grace guarantees is that the job is no longer *waiting* on a money-moving call when the
+ * slot comes back; the residue is reconciled by the next deploy, not prevented here.
+ *
+ * (This supersedes the plan's locked 60s: 60 < the locked 90s call timeout, so the two locked
+ * defaults were mutually inconsistent.)
+ */
+export const GRACE_MS = MCP_CALL_TIMEOUT_MS + 30_000;
+/**
+ * The single-flight slot is IN-MEMORY ONLY (`this.live`). It must never be persisted: an
+ * interrupted job belongs to a dead process and leaves the slot free by construction — persisting
+ * it would wedge every deploy on the box after one crash.
+ */
+export class DeployJobController {
+    deploysDir;
+    now;
+    log;
+    keep;
+    live = null;
+    constructor(opts) {
+        this.deploysDir = opts.deploysDir;
+        this.now = opts.now;
+        this.log = opts.log;
+        this.keep = opts.keep ?? DEFAULT_KEEP;
+    }
+    /** The running job's identity and progress, or null. The single-flight gate reads this. */
+    running() {
+        if (!this.live)
+            return null;
+        return { ...this.live.meta, phase: this.live.phase, stopRequested: this.live.stopRequested };
+    }
+    /**
+     * Claim the single job slot and fire `run` un-awaited.
+     *
+     * Single-flight is a money invariant, not a convenience: concurrent deploys
+     * share one funding waterfall, so two preflights can both pass while jointly
+     * overdrawing. Throws when a job is already running. The ordinary
+     * `E_DEPLOY_IN_PROGRESS` refusal comes from the gateway's own `running()`
+     * check BEFORE it gets here; this throw is the lost race between that check
+     * and this call, and the gateway catches it and renders the same refusal.
+     *
+     * `capMs` is the job's wall-clock cap (H6). Every MCP call the run makes is separately
+     * timeout-bounded, but a cap is what guarantees the slot comes back: one hung await used to hold
+     * it until the gateway restarted, and a boundary-honored stop flag never protected that case.
+     */
+    start(meta, capMs, run) {
+        if (this.live) {
+            throw new Error(`deploy ${this.live.meta.deployId} is already running (${this.live.phase})`);
+        }
+        const full = {
+            ...meta,
+            deployId: `dpl-${randomBytes(4).toString("hex")}`,
+            startedAt: new Date(this.now()).toISOString(),
+        };
+        const job = { meta: full, phase: "reconcile", stopRequested: false, terminated: false, events: [], seq: 0 };
+        // Header first, slot second: the journal is narration, so a write failure must not be able to
+        // claim (and then never release) the single-flight slot. `append` never throws — see its JSDoc.
+        try {
+            mkdirSync(this.deploysDir, { recursive: true });
+        }
+        catch (err) {
+            this.log(`deploy ${full.deployId}: could not create ${this.deploysDir} — journaling disabled (${errorText(err)})`);
+        }
+        this.append(full.deployId, { kind: "header", ...full });
+        this.live = job;
+        const handle = {
+            deployId: full.deployId,
+            emit: (event) => this.recordEvent(job, event),
+            shouldAbandon: () => job.stopRequested,
+        };
+        // Soft stop at the cap, hard stop `GRACE_MS` later. Both timers are unref'd so a deploy never
+        // keeps the gateway process alive, and both are cleared in `terminate`.
+        job.watchdog = setTimeout(() => {
+            job.stopRequested = true;
+            this.recordEvent(job, {
+                type: "job",
+                detail: `deploy deadline (${Math.round(capMs / 1000)}s) exceeded — abandoning at the next step boundary`,
+            });
+            job.grace = setTimeout(() => {
+                if (this.live === job) {
+                    this.terminate(job, { status: "done", overall: "failed" }, {
+                        packageId: full.packageId,
+                        version: full.version,
+                        overall: "failed",
+                        instances: [],
+                        next: `The deploy exceeded its deadline and was abandoned; a step may still have been in ` +
+                            `flight. Nothing was rolled back. Re-run \`openclaw senpi deploy -p '${full.packageDir}'\` — ` +
+                            `reconciliation adopts what exists.`,
+                    });
+                }
+            }, GRACE_MS);
+            job.grace.unref?.();
+        }, capMs);
+        job.watchdog.unref?.();
+        // Deferred a microtask so `start` stays pure bookkeeping: a synchronously throwing `run`
+        // becomes a journaled terminal state like any other failure, never an exception at the caller.
+        void Promise.resolve()
+            .then(() => run(handle))
+            .then((report) => this.terminate(job, { status: "done", overall: report.overall }, report), (err) => {
+            if (job.terminated)
+                return; // already force-terminated; do not narrate past the terminal line
+            const message = err instanceof Error ? err.message : String(err);
+            this.recordEvent(job, { type: "job", detail: `deploy failed: ${message}` });
+            this.terminate(job, { status: "done", overall: "failed" }, {
+                packageId: full.packageId,
+                version: full.version,
+                overall: "failed",
+                instances: [],
+                next: `The deploy died mid-flight: ${message}. Nothing was rolled back. ` +
+                    `Re-run \`openclaw senpi deploy -p '${full.packageDir}'\` — reconciliation adopts what exists.`,
+            });
+        });
+        return full;
+    }
+    /**
+     * The running job (from memory) when it is the one being asked about — by id or by omission —
+     * else the newest journal, or the named one. Unknown id → null.
+     *
+     * The live check MUST come first even for an explicit id: a
+     * running job's journal has no terminal line yet, so falling through to {@link readJournal}
+     * would render it `interrupted` — a state only the boot scan may ever assign, and a flat lie
+     * about a job that is actively moving money.
+     */
+    async status(deployId) {
+        // A caller's id is joined into a path by `journalPath`, so it is shape-checked against the same
+        // pattern `journalIds` applies to what it reads back. An unknown id already answers "no such
+        // deploy"; this is what keeps `../…` from being READ before answering it.
+        if (deployId !== undefined && !DEPLOY_ID_RE.test(deployId))
+            return null;
+        if (this.live && (!deployId || deployId === this.live.meta.deployId)) {
+            return {
+                meta: this.live.meta,
+                state: { status: "running", phase: this.live.phase, stopRequested: this.live.stopRequested },
+                events: [...this.live.events],
+            };
+        }
+        const id = deployId ?? this.newestJournalId();
+        if (!id)
+            return null;
+        return this.readJournal(id);
+    }
+    /**
+     * C2 carve-out: the ONE sanctioned journal read that feeds the orchestrator — and only as a
+     * LOOKUP KEY. Every id returned here is verified against the live backend (strategy_list
+     * strategyIds:[…]) before reconcile acts on it; the journal never decides anything.
+     *
+     * It exists because a create whose custom name the backend rejected lands under a
+     * backend-assigned name, which the reconcile name match can never find again: without the key,
+     * a re-run creates and funds a second wallet beside the first.
+     *
+     * Returns instance name → journaled created-strategy ids, newest journals first.
+     *
+     * `deployId` scopes the answer to ONE journal. Reconcile deliberately passes nothing: every
+     * journal of the package is a legitimate key source there, because any of them may hold the id
+     * of the wallet a re-run must adopt instead of funding a second one (D-9). The interrupted RENDER
+     * passes its own id, because it answers a narrower question — what did THIS job leave behind —
+     * and a still-live wallet from an earlier completed deploy is not that. Rendering it there would
+     * offer to close a strategy that is running exactly as intended.
+     */
+    priorCreatedStrategyIds(packageId, deployId) {
+        const byInstance = new Map();
+        for (const id of this.journalIdsNewestFirst()) {
+            if (deployId !== undefined && id !== deployId)
+                continue;
+            const lines = this.readLines(id);
+            const header = lines.find((line) => line.kind === "header");
+            if (!header || header.kind !== "header" || header.packageId !== packageId)
+                continue;
+            for (const line of lines) {
+                // ONLY the create-key event. Narrowing the shape keeps the carve-out explicit: any future
+                // job event that happens to carry an instance + strategyId must not silently become a
+                // reconcile input.
+                if (line.kind !== "event" || line.type !== "job" || line.phase !== "create")
+                    continue;
+                const instance = line.evidence?.instance;
+                const strategyId = line.evidence?.strategyId;
+                if (typeof instance !== "string" || typeof strategyId !== "string")
+                    continue;
+                const list = byInstance.get(instance) ?? [];
+                if (!list.includes(strategyId))
+                    list.push(strategyId);
+                byInstance.set(instance, list);
+            }
+        }
+        return byInstance;
+    }
+    /**
+     * The second D-9 lookup input off the SAME create-key event: strategyId → the amount that create
+     * call asked the backend to fund.
+     *
+     * Narrower than {@link priorCreatedStrategyIds} in what it may do, and deliberately so. It feeds
+     * exactly one thing — the report's funded-vs-requested comparison — and only the REQUESTED half
+     * of it; the funded half is always re-read live from `strategy_list` on the current run. No
+     * orchestration branch reads it, so a stale, missing or wrong entry costs a warn, never an action.
+     *
+     * It exists because the ask lives only in the memory of the run that funded. A deploy that funds
+     * $60 of a $500 ask and dies before assembling its report resumes as an adoption, and without
+     * this the shortfall is simply never mentioned again.
+     *
+     * Newest journal wins on a repeated strategyId — the ask that most recently produced that wallet.
+     */
+    priorRequestedFunding(packageId) {
+        const byStrategy = new Map();
+        for (const id of this.journalIdsNewestFirst()) {
+            const lines = this.readLines(id);
+            const header = lines.find((line) => line.kind === "header");
+            if (!header || header.kind !== "header" || header.packageId !== packageId)
+                continue;
+            for (const line of lines) {
+                if (line.kind !== "event" || line.type !== "job" || line.phase !== "create")
+                    continue;
+                const strategyId = line.evidence?.strategyId;
+                const requested = line.evidence?.requested;
+                if (typeof strategyId !== "string" || typeof requested !== "number")
+                    continue;
+                if (!(requested > 0) || byStrategy.has(strategyId))
+                    continue;
+                byStrategy.set(strategyId, requested);
+            }
+        }
+        return byStrategy;
+    }
+    /**
+     * Boot janitor: stamp every unterminated journal `interrupted`, then prune to
+     * the newest `keep`. Discovery is pull-based — the next `openclaw senpi deploy status`
+     * renders the interruption; nothing is resumed or notified here.
+     */
+    async scanOnBoot() {
+        if (!existsSync(this.deploysDir))
+            return;
+        for (const id of this.journalIds()) {
+            const lines = this.readLines(id);
+            if (lines.length === 0 || lines.some((line) => line.kind === "terminal"))
+                continue;
+            this.append(id, {
+                kind: "terminal",
+                state: { status: "interrupted" },
+                endedAt: new Date(this.now()).toISOString(),
+            });
+            this.log(`deploy ${id} interrupted by restart — surfaced on next openclaw senpi deploy status`);
+        }
+        this.prune();
+    }
+    // ── internals ───────────────────────────────────────────────────────────────
+    recordEvent(job, body) {
+        job.seq += 1;
+        const event = { ...body, seq: job.seq, ts: new Date(this.now()).toISOString() };
+        if (body.type === "job" && body.phase)
+            job.phase = body.phase;
+        job.events.push(event);
+        if (job.events.length > EVENT_TAIL_MAX)
+            job.events.splice(0, job.events.length - EVENT_TAIL_MAX);
+        this.append(job.meta.deployId, { kind: "event", ...event });
+    }
+    /**
+     * Close a job out. The slot is released in `finally`: a journal-write failure is narration lost,
+     * never a wedged single-flight slot that would refuse every future deploy with a stale
+     * `E_DEPLOY_IN_PROGRESS`.
+     */
+    terminate(job, state, report) {
+        // Idempotent: after a force-terminate the abandoned `run` promise settles later and calls in
+        // again. `readJournal` already tolerates the second terminal line (first wins), but the deploy
+        // METRIC does not — without this guard one wedged deploy counts twice, under two different
+        // outcomes, on precisely the path where the count matters most.
+        if (job.terminated)
+            return;
+        job.terminated = true;
+        try {
+            if (job.watchdog)
+                clearTimeout(job.watchdog);
+            if (job.grace)
+                clearTimeout(job.grace);
+            // M6: `refused` is recorded as an outcome like any other, with its taxonomy code — a refusal
+            // is a correct answer, never an error.
+            const refusalCode = firstRefusalCode(report);
+            recordDeploy({
+                outcome: state.status === "done" ? state.overall : state.status,
+                ...(refusalCode ? { refusalCode } : {}),
+                durationSec: Math.max(0, (this.now() - Date.parse(job.meta.startedAt)) / 1000),
+            });
+            this.append(job.meta.deployId, {
+                kind: "terminal",
+                state,
+                endedAt: new Date(this.now()).toISOString(),
+                report,
+            });
+            this.prune();
+        }
+        finally {
+            if (this.live === job)
+                this.live = null;
+        }
+    }
+    journalPath(deployId) {
+        return join(this.deploysDir, `${deployId}.jsonl`);
+    }
+    /**
+     * Append one journal line. **Never throws**: the journal is narration, and the narration-only
+     * rule cuts both ways — a full or read-only state volume must not be able to change what a
+     * deploy does (or wedge its slot). A failed write is logged and the line is lost.
+     */
+    append(deployId, line) {
+        try {
+            appendFileSync(this.journalPath(deployId), `${JSON.stringify(line)}\n`);
+        }
+        catch (err) {
+            this.log(`deploy ${deployId}: journal write failed (${errorText(err)}) — narration lost, deploy unaffected`);
+        }
+    }
+    journalIds() {
+        if (!existsSync(this.deploysDir))
+            return [];
+        return readdirSync(this.deploysDir)
+            .filter((name) => name.endsWith(".jsonl"))
+            .map((name) => name.slice(0, -".jsonl".length))
+            .filter((id) => DEPLOY_ID_RE.test(id));
+    }
+    readLines(deployId) {
+        const path = this.journalPath(deployId);
+        if (!existsSync(path))
+            return [];
+        const lines = [];
+        for (const raw of readFileSync(path, "utf8").split("\n")) {
+            if (raw.trim() === "")
+                continue;
+            try {
+                lines.push(JSON.parse(raw));
+            }
+            catch {
+                // A torn last line (killed mid-append) is narration lost, not state lost.
+            }
+        }
+        return lines;
+    }
+    /** Journals newest-first by header `startedAt` — the only ordering the controller trusts. */
+    journalIdsNewestFirst() {
+        return this.journalIds()
+            .map((id) => {
+            const header = this.readLines(id).find((line) => line.kind === "header");
+            return { id, startedAt: header?.startedAt ?? "" };
+        })
+            .sort((a, b) => (a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0))
+            .map((entry) => entry.id);
+    }
+    newestJournalId() {
+        return this.journalIdsNewestFirst()[0] ?? null;
+    }
+    /**
+     * Journal → snapshot. A journal with no terminal line IS an interrupted job.
+     *
+     * The FIRST terminal line wins. That ordering is load-bearing: when the deadline watchdog
+     * force-terminates a wedged job, the zombie `run` promise may settle later and append a second
+     * terminal line — the watchdog's verdict is the true one, and reading the first keeps it.
+     */
+    readJournal(deployId) {
+        const lines = this.readLines(deployId);
+        const header = lines.find((line) => line.kind === "header");
+        if (!header)
+            return null;
+        const { kind: _kind, ...meta } = header;
+        const events = lines
+            .filter((line) => line.kind === "event")
+            .map(({ kind: _eventKind, ...event }) => event);
+        const terminal = lines.find((line) => line.kind === "terminal");
+        return {
+            meta,
+            state: terminal?.state ?? { status: "interrupted" },
+            events: events.slice(-EVENT_TAIL_MAX),
+            ...(terminal?.report ? { report: terminal.report } : {}),
+        };
+    }
+    /** Retain the newest `keep` journals. Runs on every terminate and on boot, so a long-lived
+     * gateway does not grow `deploys/` without bound between restarts. Never throws.
+     *
+     * Unlocked by design: prune and every journal read are fully synchronous on one thread, so they
+     * cannot interleave in-process; a torn last line is already tolerated by `readLines`. Do not add
+     * locking without a cross-process caller. */
+    prune() {
+        try {
+            const stale = this.journalIdsNewestFirst().slice(this.keep);
+            for (const id of stale)
+                rmSync(this.journalPath(id), { force: true });
+        }
+        catch (err) {
+            this.log(`deploy journal prune failed (${errorText(err)}) — harmless, retried on the next terminate`);
+        }
+    }
+}
+//# sourceMappingURL=job.js.map