@telora/daemon 0.22.245 → 0.22.290

package/dist/focus/review-spawn-coverage.js

@@ -3,39 +3,31 @@
 //   packages/daemon/src/integration/approved-head-gate-failure-respawn-regression.test.ts,
 //   packages/daemon/src/integration/fully-merged-focus-sibling-red-scenario.test.ts
 // PINNED-BY-END
-import { resolveRef } from '../git/index.js';
-import { shouldAbortReviewSpawnForUnresolvableCoverage } from '../completion/review-spawn-coverage-guard.js';
-import { isHeadAlreadyApproved } from '../completion/review-approved-head-gate.js';
-import { listReviewAutoApprovals } from '../completion/review-auto-approval-record.js';
-import { readLatestApprovedReviewSha } from '../queries/focus-review-approval.js';
-import { getFocusDeliveries, setReviewCoverageSha } from '../queries/focuses.js';
+import { shouldAbortReviewSpawnForUnresolvableCoverage } from '../completion/review-coverage/review-spawn-coverage-guard.js';
+import { isHeadAlreadyApproved } from '../completion/state-cascade/review-approved-head-gate.js';
 import { isForeignOnlyExtension } from '../git/focus-own-delta.js';
-import { getActiveFocuses } from '../queries/focus-discovery.js';
-import { createLogger } from '../shell/log.js';
+import { createLogger } from '../log/daemon-log.js';
 const log = createLogger({ module: 'focus-executor' });
 /**
  * The production ownership proof: provenance is read from the NAMED focus branch
  * (not whatever the worktree has checked out), with the focus's delivery ids from
- * `listDeliveryIds` (the product-api by default).
+ * `listDeliveryIds` (the root binds the product-api read).
  */
-export function makeAddsNoOwnWork(listDeliveryIds = async (focusId) => (await getFocusDeliveries(focusId)).map((d) => d.id)) {
-    return async (target, integrationBranch, anchor, tip) => isForeignOnlyExtension(target.worktreePath, integrationBranch, anchor, tip, new Set(await listDeliveryIds(target.focusId)), { focusBranch: target.branchName });
+export function makeAddsNoOwnWork(listDeliveryIds, git) {
+    return async (target, integrationBranch, anchor, tip) => isForeignOnlyExtension(target.worktreePath, integrationBranch, anchor, tip, new Set(await listDeliveryIds(target.focusId)), { git, focusBranch: target.branchName });
 }
-const defaultAddsNoOwnWork = makeAddsNoOwnWork();
 /** Whether the spawn-tip adds no own work past `anchor`; false when it cannot be shown (the review is not declined on it). */
 async function tipAddsNoOwnWork(target, anchor, tip, deps) {
     const integrationBranch = target.config.integrationBranch;
     if (!anchor || !integrationBranch || anchor === tip)
         return false;
-    return (deps.addsNoOwnWork ?? defaultAddsNoOwnWork)(target, integrationBranch, anchor, tip).catch(() => false);
+    return deps.addsNoOwnWork(target, integrationBranch, anchor, tip).catch(() => false);
 }
-const defaultReadApprovedReviewSha = (productId, focusId) => readLatestApprovedReviewSha(focusId, { autoApprovals: listReviewAutoApprovals(productId, focusId) });
-const defaultReadPriorWatermark = async (organizationId, productId, focusId) => (await getActiveFocuses(organizationId, productId)).find((f) => f.focus_id === focusId)?.reviewed_through_sha ?? null;
 /** Whether a review at the spawn-tip must not open: the tip is the approved commit, or the approval is unreadable (fails closed). */
 async function reviewSpawnDeclined(target, spawnTip, deps) {
     let approvedSha;
     try {
-        approvedSha = await (deps.readApprovedReviewSha ?? defaultReadApprovedReviewSha)(target.config.productId, target.focusId);
+        approvedSha = await deps.readApprovedReviewSha(target.config.productId, target.focusId);
     }
     catch (err) {
         log.warn(`[focus-executor] Review spawn DEFERRED for "${target.focusName}": its current approval is unreadable, so head ` +
@@ -59,9 +51,9 @@ async function reviewSpawnDeclined(target, spawnTip, deps) {
  * (true: no session may open). Only a 'review' session type is governed by the
  * approved-head decline; see the module header.
  */
-export async function captureReviewSpawnCoverage(teamState, target, deps = {}) {
+export async function captureReviewSpawnCoverage(teamState, target, deps) {
     const { worktreePath, branchName, focusId, focusName, config } = target;
-    const spawnTip = (deps.resolveRef ?? resolveRef)(worktreePath, branchName);
+    const spawnTip = deps.resolveRef(worktreePath, branchName);
     if (shouldAbortReviewSpawnForUnresolvableCoverage(teamState.sessionType, spawnTip)) {
         log.error(`[focus-executor] Review spawn ABORTED for "${focusName}": coverage ref ` +
             `"${branchName}" could not be resolved in ${worktreePath}. No session opened ` +
@@ -70,24 +62,25 @@ export async function captureReviewSpawnCoverage(teamState, target, deps = {}) {
     }
     if (spawnTip && teamState.sessionType === 'review' && await reviewSpawnDeclined(target, spawnTip, deps))
         return true;
-    teamState.reviewSpawnTip = spawnTip;
+    const coverage = teamState;
+    coverage.reviewSpawnTip = spawnTip;
     // Capture the PRIOR coverage watermark BEFORE this pass's review_complete
     // promotes the spawn-tip into it (migration 20260909203246), so the hand-off
     // delta rule measures against the prior value. A read failure leaves it null --
     // the exit handler treats an absent carry as no proof of advance.
     try {
-        teamState.reviewPriorWatermark = await (deps.readPriorWatermark ?? defaultReadPriorWatermark)(config.organizationId, config.productId, focusId);
+        coverage.reviewPriorWatermark = await deps.readPriorWatermark(config.organizationId, config.productId, focusId);
     }
     catch (err) {
         log.warn(`[focus-executor] Could not resolve prior review watermark for "${focusName}": ${err.message}`);
-        teamState.reviewPriorWatermark = null;
+        coverage.reviewPriorWatermark = null;
     }
-    if (teamState.sessionType === 'review' && spawnTip && await tipAddsNoOwnWork(target, teamState.reviewPriorWatermark, spawnTip, deps)) {
+    if (teamState.sessionType === 'review' && spawnTip && await tipAddsNoOwnWork(target, coverage.reviewPriorWatermark, spawnTip, deps)) {
         log.info(`[focus-executor] Review spawn DECLINED for "${focusName}": the range ${(teamState.reviewPriorWatermark ?? '').slice(0, 12)}..` +
             `${spawnTip.slice(0, 12)} holds only other foci's commits (already on integration) and none of its own. No session opened.`);
         return true;
     }
-    (deps.setReviewCoverageSha ?? setReviewCoverageSha)(focusId, spawnTip).catch((err) => log.warn(`[focus-executor] Failed to persist review_coverage_sha for "${focusName}": ${err.message}`));
+    deps.setReviewCoverageSha(focusId, spawnTip).catch((err) => log.warn(`[focus-executor] Failed to persist review_coverage_sha for "${focusName}": ${err.message}`));
     return false;
 }
 /**
@@ -96,7 +89,7 @@ export async function captureReviewSpawnCoverage(teamState, target, deps = {}) {
  * session is never opened (null, exactly like a failed session creation). Other
  * session types open directly. The one way spawnFocusTeam creates a session.
  */
-export async function openTeamSessionAfterReviewCoverage(teamState, target, openSession, deps = {}) {
+export async function openTeamSessionAfterReviewCoverage(teamState, target, openSession, deps) {
     if (teamState.sessionType === 'review' && await captureReviewSpawnCoverage(teamState, target, deps))
         return null;
     return openSession();

package/dist/focus/review-spawn-coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-spawn-coverage.js","sourceRoot":"","sources":["../../src/focus/review-spawn-coverage.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,sEAAsE;AACtE,2FAA2F;AAC3F,oFAAoF;AACpF,gBAAgB;AA+ChB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,6CAA6C,EAAE,MAAM,8CAA8C,CAAC;AAC7G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AA2BvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,kBAAmE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1I,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAC7E,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CACxI,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;AAEjD,8HAA8H;AAC9H,KAAK,UAAU,gBAAgB,CAAC,MAAiC,EAAE,MAAqB,EAAE,GAAW,EAAE,IAA6B;IAClI,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAAE,OAAe,EAA0B,EAAE,CAClG,2BAA2B,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAEvG,MAAM,yBAAyB,GAAG,KAAK,EAAE,cAAsB,EAAE,SAAiB,EAAE,OAAe,EAA0B,EAAE,CAC7H,CAAC,MAAM,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,oBAAoB,IAAI,IAAI,CAAC;AAExH,qIAAqI;AACrI,KAAK,UAAU,mBAAmB,CAAC,MAAiC,EAAE,QAAgB,EAAE,IAA6B;IACnH,IAAI,WAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,iDAAiD;YAChH,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mEAAoE,GAAa,CAAC,OAAO,EAAE,CACpH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,eAAe,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB;YACtH,kEAAkE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB;YACvH,qDAAqD,CACtD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,eAAe,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB;QACxH,iGAAiG,CAClG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAyB,EACzB,MAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACxE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC3E,IAAI,6CAA6C,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,KAAK,CACP,8CAA8C,SAAS,kBAAkB;YACzE,IAAI,UAAU,8BAA8B,YAAY,sBAAsB;YAC9E,uFAAuF,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrH,SAAS,CAAC,cAAc,GAAG,QAAQ,CAAC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kEAAkE,SAAS,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpH,SAAS,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACrI,GAAG,CAAC,IAAI,CACN,+CAA+C,SAAS,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;YAC/H,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mGAAmG,CAC5H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,CAAC,OAAO,EAAE,QAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CACtG,GAAG,CAAC,IAAI,CAAC,+DAA+D,SAAS,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CACjH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAyB,EACzB,MAAiC,EACjC,WAAoC,EACpC,OAAgC,EAAE;IAElC,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"review-spawn-coverage.js","sourceRoot":"","sources":["../../src/focus/review-spawn-coverage.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,sEAAsE;AACtE,2FAA2F;AAC3F,oFAAoF;AACpF,gBAAgB;AAyDhB,OAAO,EAAE,6CAA6C,EAAE,MAAM,8DAA8D,CAAC;AAC7H,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AA2BvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,eAAgE,EAChE,GAAqB;IAErB,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAC7E,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EACnG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,8HAA8H;AAC9H,KAAK,UAAU,gBAAgB,CAAC,MAAiC,EAAE,MAAqB,EAAE,GAAW,EAAE,IAA6B;IAClI,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACvF,CAAC;AAED,qIAAqI;AACrI,KAAK,UAAU,mBAAmB,CAAC,MAAiC,EAAE,QAAgB,EAAE,IAA6B;IACnH,IAAI,WAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,iDAAiD;YAChH,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mEAAoE,GAAa,CAAC,OAAO,EAAE,CACpH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,eAAe,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB;YACtH,kEAAkE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB;YACvH,qDAAqD,CACtD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,GAAG,CAAC,IAAI,CACN,+CAA+C,MAAM,CAAC,SAAS,eAAe,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB;QACxH,iGAAiG,CAClG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAyB,EACzB,MAAiC,EACjC,IAA6B;IAE7B,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,6CAA6C,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,KAAK,CACP,8CAA8C,SAAS,kBAAkB;YACzE,IAAI,UAAU,8BAA8B,YAAY,sBAAsB;YAC9E,uFAAuF,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrH,MAAM,QAAQ,GAAyC,SAAS,CAAC;IACjE,QAAQ,CAAC,cAAc,GAAG,QAAQ,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,gFAAgF;IAChF,kEAAkE;IAClE,IAAI,CAAC;QACH,QAAQ,CAAC,oBAAoB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kEAAkE,SAAS,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpH,QAAQ,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACpI,GAAG,CAAC,IAAI,CACN,+CAA+C,SAAS,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;YAC/H,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mGAAmG,CAC5H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAC5E,GAAG,CAAC,IAAI,CAAC,+DAA+D,SAAS,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CACjH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAyB,EACzB,MAAiC,EACjC,WAAoC,EACpC,IAA6B;IAE7B,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC"}

package/dist/focus/schema-version-gate.d.ts

@@ -0,0 +1,137 @@
+export type SchemaGateMode = 'fail-fast' | 'warn' | 'off';
+/** How the initial missing set was classified before any decision. */
+export type GapClassification = 'ok' | 'transient' | 'drift';
+export interface SchemaGateResult {
+    mode: SchemaGateMode;
+    /** Expected migration versions (timestamp prefixes, e.g. '20260521233716'). */
+    expected: string[];
+    /** Applied migration versions returned by the live DB (final read). */
+    applied: string[];
+    /** Expected ∖ applied after the final ledger read. Empty when ok. */
+    missing: string[];
+    /**
+     * Applied ∖ expected after the final ledger read: migrations the LIVE DB
+     * carries that this daemon build does not know about -- i.e. this daemon is
+     * OLDER than the schema it is about to arm against.
+     *
+     * Reported and recorded, never gated on: see the "IT IS A REPORT, NOT A
+     * GATE" note in the module header. A non-empty value leaves `ok`,
+     * `classification` and `attempts` untouched.
+     */
+    unknownApplied: string[];
+    ok: boolean;
+    /**
+     * Classification of the initial missing set:
+     *   'ok'        -- nothing missing on the first read.
+     *   'transient' -- small gap of only very-recent migrations; the gate
+     *                  re-polled before deciding (ok may be true or false).
+     *   'drift'     -- large gap or an older missing migration; tripped
+     *                  immediately with no re-poll.
+     */
+    classification: GapClassification;
+    /** Total ledger reads performed (1 = no re-poll; >1 = transient re-poll). */
+    attempts: number;
+}
+/**
+ * Resolve the operating mode from environment.
+ *   TELORA_SCHEMA_GATE=off | 0     -> 'off'
+ *   TELORA_SCHEMA_GATE=warn        -> 'warn'
+ *   TELORA_SCHEMA_GATE=fail-fast   -> 'fail-fast'
+ *   unset (default):
+ *     NODE_ENV=production -> 'fail-fast'
+ *     otherwise           -> 'warn'
+ */
+export declare function resolveSchemaGateMode(env?: NodeJS.ProcessEnv): SchemaGateMode;
+/**
+ * Extract the supabase migration version (timestamp prefix) from a
+ * full filename: '20260521233716_daemon_get_applied_migrations.sql'
+ *   -> '20260521233716'. Returns the input unchanged if no underscore.
+ */
+export declare function versionPrefix(filename: string): string;
+/**
+ * Tunables governing when a missing set is treated as a transient
+ * deploy-race tail vs genuine drift, and how the bounded re-poll behaves.
+ */
+export interface TransientToleranceConfig {
+    /** Max missing count that can still qualify as transient. Above -> drift. */
+    maxMissing: number;
+    /**
+     * Recency margin (ms). A missing migration qualifies as "very recent"
+     * only if its timestamp is newer than (newest-applied minus this margin).
+     * Any older missing migration -> drift. The margin absorbs the small
+     * out-of-order interleaving that concurrent migration authoring can
+     * produce around the newest-applied boundary.
+     */
+    recencyMarginMs: number;
+    /** Max additional ledger reads after the first (the re-poll budget). */
+    repollAttempts: number;
+    /** Total wall-clock budget (ms) for all re-polls combined. */
+    repollWindowMs: number;
+}
+export declare const DEFAULT_TRANSIENT_TOLERANCE: TransientToleranceConfig;
+/**
+ * Resolve transient-tolerance tunables from environment. Recency margin and
+ * the re-poll window are configured in SECONDS for operator friendliness;
+ * everything is stored internally in ms.
+ *
+ *   TELORA_SCHEMA_GATE_TRANSIENT_MAX     -> maxMissing (count)
+ *   TELORA_SCHEMA_GATE_RECENCY_MARGIN_SEC -> recencyMarginMs
+ *   TELORA_SCHEMA_GATE_REPOLL_ATTEMPTS   -> repollAttempts (count)
+ *   TELORA_SCHEMA_GATE_REPOLL_WINDOW_SEC -> repollWindowMs
+ */
+export declare function resolveTransientToleranceConfig(env?: NodeJS.ProcessEnv): TransientToleranceConfig;
+/**
+ * Parse a 14-digit migration version (YYYYMMDDHHMMSS, UTC) into epoch ms.
+ * Returns NaN for anything that is not exactly 14 digits -- callers treat
+ * an unparseable timestamp as non-recent (i.e. genuine drift), which is the
+ * conservative choice.
+ */
+export declare function parseMigrationTimestamp(version: string): number;
+/**
+ * Classify a non-empty missing set as a transient deploy-race tail or
+ * genuine drift, given the currently-applied versions.
+ *
+ * Transient requires BOTH:
+ *   - count <= maxMissing, AND
+ *   - every missing timestamp is "very recent": newer than the newest
+ *     applied timestamp minus the recency margin.
+ *
+ * Drift otherwise -- including the degenerate cases (no applied baseline,
+ * or an unparseable timestamp), which cannot be a recoverable deploy tail.
+ */
+export declare function classifyMissing(missing: string[], applied: string[], cfg: TransientToleranceConfig): Exclude<GapClassification, 'ok'>;
+/**
+ * The reverse set: `applied` ∖ `expected` -- migration versions the live DB
+ * carries that this daemon build does not know about. Preserves the ledger's
+ * own order so the newest unknown versions read last, as they do in the
+ * ledger.
+ *
+ * Exported so the reverse direction is testable on its own, and so a later
+ * caller can ask the question without re-deriving the set difference.
+ */
+export declare function computeUnknownApplied(expected: string[], applied: string[]): string[];
+/**
+ * The gate's collaborators and settings: the embedded expected set, the live
+ * applied set, the sleep + clock + progress log of the transient re-poll, and
+ * the mode and tolerance it runs under. Required -- the production binding is
+ * built at the composition root (composition/runtime-contexts.ts), which
+ * resolves the mode and tolerance from env (resolveSchemaGateMode,
+ * resolveTransientToleranceConfig).
+ */
+export interface SchemaGateSeams {
+    getExpected: () => string[];
+    getApplied: () => Promise<string[]>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    /** The gate mode. */
+    mode: SchemaGateMode;
+    /** Transient-tolerance tunables. */
+    transientTolerance: TransientToleranceConfig;
+    /** Logger for re-poll progress. */
+    log: (msg: string) => void;
+}
+export declare function checkSchemaVersion(deps: SchemaGateSeams): Promise<SchemaGateResult>;
+/** Health-event code for "this daemon is older than the schema it arms against". */
+export declare const DAEMON_BEHIND_DB_CODE = "schema.daemon_behind_db";
+export declare function reportSchemaGateResult(result: SchemaGateResult): void;
+//# sourceMappingURL=schema-version-gate.d.ts.map

package/dist/focus/schema-version-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-version-gate.d.ts","sourceRoot":"","sources":["../../src/focus/schema-version-gate.ts"],"names":[],"mappings":"AAyDA,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAO1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItD;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,wBAKzC,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAQ1B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAclC;AAOD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAGrF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,MAAM,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,oCAAoC;IACpC,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,mCAAmC;IACnC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmFzF;AAED,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AA4D/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA+BrE"}

package/dist/focus/schema-version-gate.js

@@ -0,0 +1,325 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/focus/schema-version-gate.test.ts
+// PINNED-BY-END
+/**
+ * Schema-version gate.
+ *
+ * Compares the publish-time `expectedMigrations` set embedded in
+ * build-info.json against the migrations actually applied in the
+ * live DB (the daemon_get_applied_migrations action). On mismatch:
+ *   - fail-fast (production default): exit 1 with the missing list
+ *   - warn (dev default): log and continue
+ *   - off: skip the check entirely
+ *
+ * Runs at startup immediately after validateTrackerAuth so the daemon
+ * never reaches its write path with a deploy-order schema drift.
+ *
+ * Deploy-race tolerance: infra's apply-migrations.sh applies a migration
+ * and writes its public._migrations ledger row in SEPARATE (non-atomic)
+ * psql invocations. Across a multi-migration deploy this leaves an
+ * inter-migration window where the schema is live but the newest ledger
+ * rows are not written yet -- a daemon (re)starting in that window reads
+ * recently-applied migrations as "missing". To avoid false-tripping into
+ * read-only mode, the gate classifies the missing set: a small number of
+ * only-very-recent missing migrations is a transient eventual-consistency
+ * gap, so the gate re-polls the ledger with bounded backoff (early-exit
+ * the moment the gap closes) before deciding. A large gap, or any missing
+ * migration older than the recency margin, is genuine drift and trips
+ * immediately with no added latency.
+ *
+ * THE OTHER DIRECTION -- a DAEMON behind its DATABASE. The forward set
+ * (expected ∖ applied) only ever sees a database BEHIND the daemon. The
+ * reverse set (applied ∖ expected) is the state that matters when a refusal
+ * lands in the SHARED production database while the daemon binaries that
+ * satisfy it arrive host by host: the migration is live for every host the
+ * instant it is applied, and a host running an older daemon reads that as
+ * perfectly ok, because nothing it expects is missing. It then arms. The gate
+ * computes and REPORTS that set (`unknownApplied`) so a stale host is
+ * visible before it arms.
+ *
+ * IT IS A REPORT, NOT A GATE, AND MUST STAY ONE. A database ahead of a daemon
+ * is the NORMAL state during any deploy -- the migration lands first, every
+ * host follows -- so refusing to start on a non-empty reverse set would halt
+ * EVERY host on EVERY migration. `unknownApplied` therefore never touches
+ * `ok`, in any TELORA_SCHEMA_GATE mode; startup proceeds exactly as it does
+ * with an empty reverse set. Do not "fix" this into a hard gate.
+ *
+ * Operator runbook: docs/runbook-schema-version-gate.md
+ * History: docs/daemon/history-team-lifecycle.md (focus/schema-version-gate.ts).
+ */
+import { createLogger } from '../log/daemon-log.js';
+import { healthEvents, loadEnvConfig } from '@telora/daemon-core';
+const dlog = createLogger({ module: 'schema-gate' });
+/**
+ * Resolve the operating mode from environment.
+ *   TELORA_SCHEMA_GATE=off | 0     -> 'off'
+ *   TELORA_SCHEMA_GATE=warn        -> 'warn'
+ *   TELORA_SCHEMA_GATE=fail-fast   -> 'fail-fast'
+ *   unset (default):
+ *     NODE_ENV=production -> 'fail-fast'
+ *     otherwise           -> 'warn'
+ */
+export function resolveSchemaGateMode(env = process.env) {
+    const raw = (loadEnvConfig(env).TELORA_SCHEMA_GATE ?? '').trim().toLowerCase();
+    if (raw === 'off' || raw === '0')
+        return 'off';
+    if (raw === 'warn')
+        return 'warn';
+    if (raw === 'fail-fast')
+        return 'fail-fast';
+    // Default: prod is strict, dev is permissive
+    return env.NODE_ENV === 'production' ? 'fail-fast' : 'warn';
+}
+/**
+ * Extract the supabase migration version (timestamp prefix) from a
+ * full filename: '20260521233716_daemon_get_applied_migrations.sql'
+ *   -> '20260521233716'. Returns the input unchanged if no underscore.
+ */
+export function versionPrefix(filename) {
+    const underscore = filename.indexOf('_');
+    if (underscore <= 0)
+        return filename;
+    return filename.slice(0, underscore);
+}
+export const DEFAULT_TRANSIENT_TOLERANCE = {
+    maxMissing: 3,
+    recencyMarginMs: 10 * 60 * 1000, // 10 minutes
+    repollAttempts: 6,
+    repollWindowMs: 45_000, // 45 seconds
+};
+/** Initial re-poll delay; doubles each attempt up to MAX_REPOLL_DELAY_MS. */
+const INITIAL_REPOLL_DELAY_MS = 1_000;
+const MAX_REPOLL_DELAY_MS = 8_000;
+/**
+ * Resolve transient-tolerance tunables from environment. Recency margin and
+ * the re-poll window are configured in SECONDS for operator friendliness;
+ * everything is stored internally in ms.
+ *
+ *   TELORA_SCHEMA_GATE_TRANSIENT_MAX     -> maxMissing (count)
+ *   TELORA_SCHEMA_GATE_RECENCY_MARGIN_SEC -> recencyMarginMs
+ *   TELORA_SCHEMA_GATE_REPOLL_ATTEMPTS   -> repollAttempts (count)
+ *   TELORA_SCHEMA_GATE_REPOLL_WINDOW_SEC -> repollWindowMs
+ */
+export function resolveTransientToleranceConfig(env = process.env) {
+    const envCfg = loadEnvConfig(env);
+    return {
+        maxMissing: envCfg.TELORA_SCHEMA_GATE_TRANSIENT_MAX,
+        recencyMarginMs: envCfg.TELORA_SCHEMA_GATE_RECENCY_MARGIN_SEC * 1000,
+        repollAttempts: envCfg.TELORA_SCHEMA_GATE_REPOLL_ATTEMPTS,
+        repollWindowMs: envCfg.TELORA_SCHEMA_GATE_REPOLL_WINDOW_SEC * 1000,
+    };
+}
+/**
+ * Parse a 14-digit migration version (YYYYMMDDHHMMSS, UTC) into epoch ms.
+ * Returns NaN for anything that is not exactly 14 digits -- callers treat
+ * an unparseable timestamp as non-recent (i.e. genuine drift), which is the
+ * conservative choice.
+ */
+export function parseMigrationTimestamp(version) {
+    const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/.exec(version);
+    if (!m)
+        return NaN;
+    const [, y, mo, d, h, mi, s] = m;
+    return Date.UTC(Number(y), Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
+}
+/**
+ * Classify a non-empty missing set as a transient deploy-race tail or
+ * genuine drift, given the currently-applied versions.
+ *
+ * Transient requires BOTH:
+ *   - count <= maxMissing, AND
+ *   - every missing timestamp is "very recent": newer than the newest
+ *     applied timestamp minus the recency margin.
+ *
+ * Drift otherwise -- including the degenerate cases (no applied baseline,
+ * or an unparseable timestamp), which cannot be a recoverable deploy tail.
+ */
+export function classifyMissing(missing, applied, cfg) {
+    if (missing.length > cfg.maxMissing)
+        return 'drift';
+    const appliedTs = applied.map(parseMigrationTimestamp).filter((n) => !Number.isNaN(n));
+    if (appliedTs.length === 0)
+        return 'drift'; // no baseline to call anything "recent"
+    const newestApplied = Math.max(...appliedTs);
+    const recencyThreshold = newestApplied - cfg.recencyMarginMs;
+    for (const v of missing) {
+        const ts = parseMigrationTimestamp(v);
+        if (Number.isNaN(ts))
+            return 'drift';
+        if (ts <= recencyThreshold)
+            return 'drift'; // older than the margin -> not a deploy tail
+    }
+    return 'transient';
+}
+function computeMissing(expected, applied) {
+    const appliedSet = new Set(applied);
+    return expected.filter((v) => !appliedSet.has(v));
+}
+/**
+ * The reverse set: `applied` ∖ `expected` -- migration versions the live DB
+ * carries that this daemon build does not know about. Preserves the ledger's
+ * own order so the newest unknown versions read last, as they do in the
+ * ledger.
+ *
+ * Exported so the reverse direction is testable on its own, and so a later
+ * caller can ask the question without re-deriving the set difference.
+ */
+export function computeUnknownApplied(expected, applied) {
+    const expectedSet = new Set(expected);
+    return applied.filter((v) => !expectedSet.has(v));
+}
+export async function checkSchemaVersion(deps) {
+    const { getApplied, sleep, now, mode, log } = deps;
+    const cfg = deps.transientTolerance;
+    const expectedFilenames = deps.getExpected();
+    const expected = expectedFilenames.map(versionPrefix);
+    // Dev mode -- build-info missing or empty. Skip the gate. With no expected
+    // set there is no baseline to call anything "unknown" either, so the reverse
+    // set is empty rather than "every applied migration".
+    if (expected.length === 0) {
+        return {
+            mode, expected: [], applied: [], missing: [], unknownApplied: [],
+            ok: true, classification: 'ok', attempts: 0,
+        };
+    }
+    let applied = await getApplied();
+    let attempts = 1;
+    let missing = computeMissing(expected, applied);
+    // The reverse set is computed at every exit from the FINAL ledger read, and
+    // is never consulted by any decision below -- it rides along as a report.
+    if (missing.length === 0) {
+        return {
+            mode, expected, applied, missing,
+            unknownApplied: computeUnknownApplied(expected, applied),
+            ok: true, classification: 'ok', attempts,
+        };
+    }
+    // Something is missing -- transient deploy tail, or genuine drift?
+    const classification = classifyMissing(missing, applied, cfg);
+    if (classification === 'drift') {
+        // Genuine drift: trip immediately, no re-poll, no added latency.
+        return {
+            mode, expected, applied, missing,
+            unknownApplied: computeUnknownApplied(expected, applied),
+            ok: false, classification: 'drift', attempts,
+        };
+    }
+    // Transient: re-poll the ledger with bounded backoff, exiting early the
+    // moment the gap closes. Bounded by BOTH the attempt count and the total
+    // wall-clock window so a never-resolving gap still trips read-only.
+    log(`[schema-gate] Transient gap: ${missing.length} very-recent migration(s) missing ` +
+        `(<= ${cfg.maxMissing}); re-polling up to ${cfg.repollAttempts}x over ${Math.round(cfg.repollWindowMs / 1000)}s ` +
+        'before deciding (deploy-race tolerance).');
+    const start = now();
+    let delay = INITIAL_REPOLL_DELAY_MS;
+    let repolls = 0;
+    while (repolls < cfg.repollAttempts) {
+        const elapsed = now() - start;
+        if (elapsed >= cfg.repollWindowMs)
+            break;
+        const remaining = cfg.repollWindowMs - elapsed;
+        await sleep(Math.min(delay, remaining));
+        applied = await getApplied();
+        attempts += 1;
+        repolls += 1;
+        missing = computeMissing(expected, applied);
+        if (missing.length === 0) {
+            log(`Transient gap closed after ${repolls} re-poll(s) -- proceeding in write mode.`);
+            return {
+                mode, expected, applied, missing,
+                unknownApplied: computeUnknownApplied(expected, applied),
+                ok: true, classification: 'transient', attempts,
+            };
+        }
+        delay = Math.min(delay * 2, MAX_REPOLL_DELAY_MS);
+    }
+    // Window exhausted and the gap remains -- treat as drift for the decision.
+    log(`[schema-gate] Transient gap did not close after ${repolls} re-poll(s) -- ${missing.length} migration(s) still missing.`);
+    return {
+        mode, expected, applied, missing,
+        unknownApplied: computeUnknownApplied(expected, applied),
+        ok: false, classification: 'transient', attempts,
+    };
+}
+/** Health-event code for "this daemon is older than the schema it arms against". */
+export const DAEMON_BEHIND_DB_CODE = 'schema.daemon_behind_db';
+/** How many unknown versions the report names inline before truncating. */
+const MAX_NAMED_UNKNOWN = 10;
+/**
+ * Report the REVERSE set -- the live DB carries migrations this daemon does
+ * not know about.
+ *
+ * WHERE THE RECORD LANDS, AND WHY THERE. This is a HOST-scoped startup fact
+ * ("the binary running here is older than the shared database"), so the two
+ * surfaces a sibling delivery reached for are both the wrong shape:
+ * `focus_debug_artifacts` is keyed by focus and this gate runs before any
+ * focus is known, and `daemon_connections.metadata.readOnlyMode` is the
+ * READ-ONLY state -- writing there would say the daemon stopped writing, which
+ * is exactly what this path must NOT claim. What fits is the health-event ring
+ * buffer: the heartbeat publishes it verbatim as
+ * `daemon_connections.metadata.healthEvents` on every beat (heartbeat.ts), on
+ * the row that already carries `hostname` and `daemon_version` -- so the fact
+ * lands durably, per host, next to the version it indicts, and renders in the
+ * dashboard's DaemonHealthTimeline. The buffer is a process singleton, so
+ * emitting here (the gate runs before `initHeartbeat`) is picked up by the
+ * first beat that follows, which still precedes any team spawn. No new
+ * metadata key is added, so the heartbeat-metadata classification rule is
+ * untouched: health events are process events unless they carry a productId,
+ * and this one is process-wide by construction.
+ *
+ * SEVERITY IS 'info', DELIBERATELY. The heartbeat derives `health_status` from
+ * unresolved warn/error counts, so a 'warn' here would mark every not-yet-
+ * updated host 'degraded' during every normal deploy window -- the same
+ * reasoning `config.ts` records for `product.skipped_invalid_repo`. The log
+ * line below is the loud half and stays at warn; an operator diagnosing a host
+ * reads it there.
+ *
+ * The log is the FLOOR this degrades to if the buffer is unavailable, and the
+ * record is emitted regardless of `ok`: a daemon can be behind the DB in the
+ * forward-clean case (the one this exists for) and in the drift case alike.
+ */
+function reportDaemonBehindDb(result) {
+    if (result.unknownApplied.length === 0)
+        return;
+    const named = result.unknownApplied.slice(-MAX_NAMED_UNKNOWN);
+    const elided = result.unknownApplied.length - named.length;
+    const list = named.join(', ') + (elided > 0 ? ` (+${elided} older)` : '');
+    const summary = `Live DB carries ${result.unknownApplied.length} migration(s) this daemon does not know: ${list}`;
+    dlog.warn(`[schema-gate] DAEMON BEHIND DB -- ${summary}. ` +
+        'Startup proceeds (a DB ahead of a daemon is the normal deploy state), but this host may ' +
+        'be missing daemon behavior the live schema now requires -- update it before it arms. ' +
+        'See docs/runbook-schema-version-gate.md.');
+    healthEvents.emit({
+        severity: 'info',
+        source: 'schema-gate',
+        code: DAEMON_BEHIND_DB_CODE,
+        message: summary,
+    });
+}
+export function reportSchemaGateResult(result) {
+    if (result.mode === 'off')
+        return;
+    reportDaemonBehindDb(result);
+    if (result.ok) {
+        const repolled = result.classification === 'transient'
+            ? ` (transient deploy-race gap closed after ${result.attempts} ledger read(s))`
+            : '';
+        dlog.info(`[schema-gate] OK -- all ${result.expected.length} expected migrations applied${repolled}`);
+        return;
+    }
+    const cause = result.classification === 'transient'
+        ? ' (transient gap did not close within the re-poll window)'
+        : ' (genuine drift -- large gap or non-recent missing migration)';
+    const lines = result.missing.map((m) => `  - ${m}`).join('\n');
+    const body = `[schema-gate] Missing ${result.missing.length} migration(s) in live DB${cause}:\n${lines}`;
+    if (result.mode === 'fail-fast') {
+        dlog.error(body);
+        dlog.error('[schema-gate] Refusing to start. Apply missing migrations or set TELORA_SCHEMA_GATE=warn to override. ' +
+            'See docs/runbook-schema-version-gate.md.');
+    }
+    else {
+        dlog.warn(body);
+        dlog.warn('[schema-gate] Continuing with TELORA_SCHEMA_GATE=warn -- writes that depend on these migrations will fail.');
+    }
+}
+//# sourceMappingURL=schema-version-gate.js.map

package/dist/focus/schema-version-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-version-gate.js","sourceRoot":"","sources":["../../src/focus/schema-version-gate.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAwCrD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC5C,6CAA6C;IAC7C,OAAO,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACvC,CAAC;AA2BD,MAAM,CAAC,MAAM,2BAA2B,GAA6B;IACnE,UAAU,EAAE,CAAC;IACb,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAC9C,cAAc,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,aAAa;CACtC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,gCAAgC;QACnD,eAAe,EAAE,MAAM,CAAC,qCAAqC,GAAG,IAAI;QACpE,cAAc,EAAE,MAAM,CAAC,kCAAkC;QACzD,cAAc,EAAE,MAAM,CAAC,oCAAoC,GAAG,IAAI;KACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAiB,EACjB,OAAiB,EACjB,GAA6B;IAE7B,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,wCAAwC;IACpF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC;IAE7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC;QACrC,IAAI,EAAE,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,CAAC,6CAA6C;IAC3F,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,OAAiB;IAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,OAAiB;IACzE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAqB;IAC5D,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,6EAA6E;IAC7E,sDAAsD;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;YAChE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;YAChC,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACxD,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ;SACzC,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,iEAAiE;QACjE,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;YAChC,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACxD,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ;SAC7C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,GAAG,CACD,gCAAgC,OAAO,CAAC,MAAM,oCAAoC;QAChF,OAAO,GAAG,CAAC,UAAU,uBAAuB,GAAG,CAAC,cAAc,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI;QACjH,0CAA0C,CAC7C,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,IAAI,KAAK,GAAG,uBAAuB,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,OAAO,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;QAC9B,IAAI,OAAO,IAAI,GAAG,CAAC,cAAc;YAAE,MAAM;QACzC,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAExC,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,8BAA8B,OAAO,0CAA0C,CAAC,CAAC;YACrF,OAAO;gBACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;gBAChC,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC;gBACxD,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ;aAChD,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,GAAG,CACD,mDAAmD,OAAO,kBAAkB,OAAO,CAAC,MAAM,8BAA8B,CACzH,CAAC;IACF,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;QAChC,cAAc,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC;QACxD,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ;KACjD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,oBAAoB,CAAC,MAAwB;IACpD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GACX,mBAAmB,MAAM,CAAC,cAAc,CAAC,MAAM,4CAA4C,IAAI,EAAE,CAAC;IAEpG,IAAI,CAAC,IAAI,CACP,qCAAqC,OAAO,IAAI;QAC9C,0FAA0F;QAC1F,uFAAuF;QACvF,0CAA0C,CAC7C,CAAC;IACF,YAAY,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO;IAClC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,KAAK,WAAW;YACnC,CAAC,CAAC,4CAA4C,MAAM,CAAC,QAAQ,kBAAkB;YAC/E,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CACP,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,+BAA+B,QAAQ,EAAE,CAC3F,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GACT,MAAM,CAAC,cAAc,KAAK,WAAW;QACnC,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,+DAA+D,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,yBAAyB,MAAM,CAAC,OAAO,CAAC,MAAM,2BAA2B,KAAK,MAAM,KAAK,EAAE,CAAC;IACzG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CACR,wGAAwG;YACxG,0CAA0C,CAC3C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CACP,4GAA4G,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC"}