@vibe-commit/capture 0.6.1 → 0.7.0

package/dist/policy.js

@@ -55,6 +55,11 @@ export const STATUS_CLASSES = new Map([
     // Org approval pending (D60 §D12). Capture has not stopped; it is waiting.
     [403, "later"],
     // Payload too large. Retrying the same bytes cannot work.
+    //
+    // ⚠ PR 4a: this row is now the verdict on a span that CANNOT BE SPLIT — a single record that alone exceeds a limit.
+    // `deliver()` halves a splittable span at a record boundary and sends the two halves, which are different bytes, so the
+    // reason above still holds for what reaches this table. Only a `deliver()` given no `RecordCutter` (a caller that
+    // cannot align) classifies a 413 here directly, and it is `never` there exactly as before.
     [413, "never"],
     // Rate limited. The definition of transient.
     [429, "later"],
@@ -150,6 +155,48 @@ function positiveOr(raw, fallback) {
     const parsed = Number(raw);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
+// ---------------------------------------------------------------------------
+// Delta sizing — PR 4a. One request carries one DELTA, never the whole span to EOF.
+// ---------------------------------------------------------------------------
+/**
+ * The most RAW transcript bytes one delta carries. The server's own ceiling is 16 MiB decompressed
+ * (`MAX_DELTA_BYTES`, `ingest_session.ts:146`); half of it leaves room for redaction markers and for a record that
+ * straddles the cut.
+ */
+export const MAX_DELTA_RAW_BYTES = 8 * 1024 * 1024;
+/**
+ * The most COMPRESSED bytes one delta's frame may be. The server refuses a request body over 1 MiB (`MAX_BODY_BYTES`,
+ * `src/transport/server.ts:115`, a 413); 960 KiB leaves the rest for the framing the body does not include.
+ */
+export const MAX_DELTA_FRAME_BYTES = 960 * 1024;
+/**
+ * Cut the next delta from `from`: everything to `eof` when it fits, else up to the last record boundary inside `maxRaw`.
+ *
+ * Pure; the cutter is the only thing that touches a file.
+ */
+export function planChunk(cutter, from, eof, maxRaw = MAX_DELTA_RAW_BYTES) {
+    if (eof - from <= maxRaw)
+        return { kind: "span", to: eof };
+    const boundary = cutter.lastBoundary(from, from + maxRaw);
+    if (boundary !== null)
+        return { kind: "span", to: boundary };
+    const end = cutter.firstBoundary(from);
+    return end === null ? { kind: "wait" } : { kind: "oversize", to: end };
+}
+/**
+ * Where to cut `[from, to)` in two, at a record boundary, or `null` when the span is a single record and cannot be.
+ *
+ * Halves by bytes, snapping back to the last boundary at or before the middle. When the first record is longer than
+ * half, the cut is that record's end, so the oversize record goes out alone and a second 413 on it is final.
+ */
+export function splitPoint(cutter, from, to) {
+    const middle = from + Math.floor((to - from) / 2);
+    const boundary = cutter.lastBoundary(from, middle);
+    if (boundary !== null)
+        return boundary;
+    const end = cutter.firstBoundary(from);
+    return end !== null && end < to ? end : null;
+}
 /** Undelivered bytes currently held. */
 export function pendingBytes(state) {
     if (state.backlog.length === 0)

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsC,IAAI,GAAG,CAAC;IACvE,gFAAgF;IAChF,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,2EAA2E;IAC3E,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,6CAA6C;IAC7C,CAAC,GAAG,EAAE,OAAO,CAAC;CACf,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAiB,OAAO,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAiB,OAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB,OAAO,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,OAAoB;IAC3C,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AA6DD,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IACtB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC1B,OAAO,EAAE,GAAG;CACJ,CAAC;AAQX;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,4BAA4B,EAAE,YAAY,CAAC,KAAK,CAAC;QACvE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,6BAA6B,EAAE,YAAY,CAAC,KAAK,CAAC;QACxE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,CAAC,OAAO,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB,EAAE,QAAgB;IAC3D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAgB,EAAE,GAAW;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC3D,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,EAAU,EAAE,KAAa;IACvE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,6EAA6E;QAC7E,qDAAqD;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,OAAO;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,6EAA6E;QAC7E,2EAA2E;QAC3E,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAgB,EAChB,IAAkC,EAClC,KAAa,EACb,IAAiB;IAEjB,MAAM,IAAI,GACR,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI;QAC5B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,0EAA0E;YAC1E,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IAC3C,MAAM,OAAO,GACX,IAAI,CAAC,EAAE,GAAG,MAAM;QACd,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAEnB,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,KAAa,EAAE,IAAiB;IAC5E,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAE9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QAChF,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;YAAE,MAAM;QAElD,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC;QACvB,QAAQ,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACpC,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrG,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsC,IAAI,GAAG,CAAC;IACvE,gFAAgF;IAChF,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,2EAA2E;IAC3E,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,EAAE;IACF,oHAAoH;IACpH,wHAAwH;IACxH,kHAAkH;IAClH,2FAA2F;IAC3F,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,6CAA6C;IAC7C,CAAC,GAAG,EAAE,OAAO,CAAC;CACf,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAiB,OAAO,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAiB,OAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB,OAAO,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,OAAoB;IAC3C,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AA6DD,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IACtB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC1B,OAAO,EAAE,GAAG;CACJ,CAAC;AAQX;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,4BAA4B,EAAE,YAAY,CAAC,KAAK,CAAC;QACvE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,6BAA6B,EAAE,YAAY,CAAC,KAAK,CAAC;QACxE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,CAAC,OAAO,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB,EAAE,QAAgB;IAC3D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AA2BhD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAoB,EAAE,IAAY,EAAE,GAAW,EAAE,MAAM,GAAG,mBAAmB;IACrG,IAAI,GAAG,GAAG,IAAI,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAY,EAAE,EAAU;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAgB,EAAE,GAAW;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC3D,OAAO,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,EAAU,EAAE,KAAa;IACvE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,6EAA6E;QAC7E,qDAAqD;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,OAAO;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,6EAA6E;QAC7E,2EAA2E;QAC3E,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAgB,EAChB,IAAkC,EAClC,KAAa,EACb,IAAiB;IAEjB,MAAM,IAAI,GACR,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI;QAC5B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,0EAA0E;YAC1E,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IAC3C,MAAM,OAAO,GACX,IAAI,CAAC,EAAE,GAAG,MAAM;QACd,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAEnB,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,KAAa,EAAE,IAAiB;IAC5E,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAE9B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QAChF,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;YAAE,MAAM;QAElD,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC;QACvB,QAAQ,IAAI,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACpC,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrG,CAAC"}

package/dist/post.d.ts

@@ -19,7 +19,7 @@
  */
 import { type SelectedAgentId } from "./agents/types.js";
 import type { IngestCredential } from "./credential.js";
-import { type Disposition } from "./policy.js";
+import { type Disposition, type RecordCutter } from "./policy.js";
 import { type InferredGroupId, type Observed } from "./spool.js";
 /** Production data plane. Overridable for tests and for a self-hosted server. */
 export declare const DEFAULT_INGEST_URL = "https://api.vibecommit.ai/ingest/v1/session";
@@ -360,8 +360,29 @@ export type Delivery =
     readonly inferredSetAsidePairs: number;
     /** `X-Credential-Expires` from the 2xx that delivered this, or `null`/absent. See `SendOutcome`. */
     readonly credentialExpires?: string | null;
-    /** `conversation_id` from that 2xx, ONLY when the caller opted in and `disposition === "ok"`. See `SendOutcome`. */
+    /**
+     * `conversation_id` from a 2xx, ONLY when the caller opted in. See `SendOutcome`.
+     *
+     * PR 4a (DX D8): a delivery of several deltas carries the id from whichever delta was acknowledged with it, even when
+     * a LATER delta came back `later`, so `connect`'s session link does not fall back to `/app/commits` on a partial run.
+     */
     readonly conversationId?: string;
+    /**
+     * PR 4a — records skipped because one record ALONE exceeded a limit (`record too large`): over `limits.rawBytes`
+     * raw, or over `limits.frameBytes` compressed, or refused with a 413 that no split can shrink. Each was written off
+     * with `markSkipped`, so it is in the gap counters `status` reports as "skipped … will not be sent later".
+     */
+    readonly recordsTooLarge?: number;
+    /**
+     * PR 5 — set when the last attempt got NO response at all (a refused connection, a timeout), so a caller can tell a server
+     * that could not be reached apart from one that answered and asked to wait. Absent whenever a response arrived. It
+     * changes no decision here: both are `later`.
+     */
+    readonly unreachable?: true;
+    /** PR 4a — deltas this call acknowledged or skipped past, when more than one. */
+    readonly deltas?: number;
+    /** PR 4a — `true` when the call stopped on the hook's budget with bytes still unsent. The offset is where it left off. */
+    readonly more?: boolean;
 };
 export interface DeliveryContext {
     readonly home: string;
@@ -444,23 +465,36 @@ export interface DeliveryContext {
      * reads, awaits or parses a 2xx body.
      */
     readonly readConversationId?: boolean;
+    /**
+     * PR 4a — WHEN THE HOOK'S SEND BUDGET ENDS, epoch ms. Set by the hook path only. `deliver()` starts a further delta (or a
+     * 413 split's retry) only while at least `MIN_NEXT_DELTA_BUDGET_MS` of it remains, and leaves the rest of the span for the
+     * next event or `vibecommit finalize`. Unset (`finalize`, `connect`) means no deadline.
+     */
+    readonly deadlineAtMs?: number;
+    /** PR 4a — the clock `deadlineAtMs` is measured on. A test seam; defaults to `Date.now`. */
+    readonly clock?: () => number;
+    /** PR 4a — the delta size limits. A test seam; defaults to the server-derived constants in `policy.ts`. */
+    readonly limits?: {
+        readonly rawBytes: number;
+        readonly frameBytes: number;
+    };
 }
 /**
- * Send the undelivered span of one transcript file and apply the failure policy.
+ * Send the undelivered span of one transcript file, in deltas — PR 4a.
  *
- * **At most one NETWORK attempt per hook, still — exactly D56 §D8's rule.** A
- * `finalize` lean retry (below) is the one exception D56 §D8 itself does not
- * cover: it governs HOOKS, and `finalize` is a synchronous, user-invoked verb
- * that already makes 1 + up to `FINALIZE_DRAIN_MAX_ITERATIONS` requests by
- * design (VL's explicit ruling, `TODOS[182]`). On the hook path, `later` still
- * does not retry here; it leaves the offset where it is so the hook that fires
- * on the NEXT turn picks the same bytes up.
+ * Without a `cutter` this is the single request it always was: everything from the offset to EOF, at most one attempt.
+ * With one (every production caller), the span goes out as record-aligned deltas, each acknowledged before the offset
+ * moves past it:
  *
- * Never throws: the caller is a hook, and an exception on this path is the
- * contract breaking. Every failure resolves to a `Delivery`.
+ *   - **A hook sends deltas only while its budget lasts** (`ctx.deadlineAtMs`) and leaves the rest for its next event or
+ *     `vibecommit finalize`; `Delivery.more` says it stopped early. `finalize` and `connect` set no deadline and run on.
+ *   - **It stops at the first delta that is not `ok`** and returns that delta's outcome: `later` and `fatal` hold exactly
+ *     the bytes that failed, so a resume starts at the next unacknowledged delta, with no resend and no gap. A
+ *     `capture_not_approved` 403 on any delta is such a stop, so its pending beat is printed once.
+ *   - **A skipped oversize record does not stop it.** The records after it still go out.
+ *   - **`connect`'s conversation id survives a partial run** (DX D8): it is read from the first 2xx that carries it, no later
+ *     delta reads a body, and it is returned even when a later delta came back `later`.
  *
- * `readBody` is supplied by the caller rather than read here, because the caller
- * is the one that has confined `transcript_path` to the Claude Code root
- * (`/cso` finding 1). This module never opens a file.
+ * ⛔ A 2xx never changes a delta's outcome, and a hook reads no body (eng-2 D2): the only body read is `connect`'s opt-in.
  */
-export declare function deliver(ctx: DeliveryContext, eof: number, readBody: (from: number, to: number) => Uint8Array | null): Promise<Delivery>;
+export declare function deliver(ctx: DeliveryContext, eof: number, readBody: (from: number, to: number) => Uint8Array | null, cutter?: RecordCutter): Promise<Delivery>;

package/dist/post.js

@@ -22,7 +22,8 @@ import { agentForTranscript } from "./agents/registry.js";
 import { UNKNOWN_AGENT_ID } from "./agents/types.js";
 import { headerSafe, sessionIdSafe } from "./header_safety.js";
 import { recordInferredSkipped } from "./inferred_tally.js";
-import { classify, markDelivered, markHeld, markSkipped, nextSpan, resolveCaps, } from "./policy.js";
+import { clearOrgPending, markOrgPending } from "./org_pending.js";
+import { MAX_DELTA_FRAME_BYTES, MAX_DELTA_RAW_BYTES, classify, markDelivered, markHeld, markSkipped, nextSpan, planChunk, resolveCaps, splitPoint, } from "./policy.js";
 import { fileState, isStopped, loadSessionState, saveSessionState, withFileState, } from "./state.js";
 import { INFERRED_SET_ASIDE_AFTER, dropInferredGroups, dropRewrites, dropSpooled, isFullSha, recordInferredAttempt, setAsideInferredGroup, settleSpooled, } from "./spool.js";
 import { CLIENT_VERSION, CLIENT_VERSION_HEADER } from "./version.js";
@@ -498,6 +499,15 @@ function parseFinalAck(raw) {
     const v = raw?.trim().toLowerCase();
     return v === "sealed" || v === "already" || v === "refused" ? v : null;
 }
+/**
+ * PR 4a — below this much remaining hook budget, do not START another delta. The same floor the sub-agent loop uses
+ * (`MIN_SUBAGENT_BUDGET_MS`, `hooks/entry.ts`), for the same reason: a request that small can only time out.
+ */
+const MIN_NEXT_DELTA_BUDGET_MS = 400;
+/** The floor under one attempt's timeout once the hook budget is nearly or fully spent — `MIN_SEND_TIMEOUT_MS` in `hooks/entry.ts`. */
+const MIN_ATTEMPT_TIMEOUT_MS = 50;
+/** The share of what is left one further attempt may take — `SEND_BUDGET_FRACTION`'s value in `hooks/entry.ts`. */
+const NEXT_DELTA_BUDGET_FRACTION = 0.6;
 /**
  * Build the delta, reduce it to the deny-list set when `lean`, validate every
  * resulting header value, and only then call `send()` — `TODOS[182]`.
@@ -508,7 +518,12 @@ function parseFinalAck(raw) {
  * by elimination, always names a REQUIRED header — there is no second
  * optional one for the caller to drop.
  */
-async function attemptSend(ctx, agent, seq, span, body, lean) {
+async function attemptSend(ctx, agent, seq, span, body, lean, 
+// PR 4a. ⛔ ONLY THE DELTA THAT ENDS AT EOF CARRIES THE SESSION-LEVEL HEADERS. `X-Session-Final` seals the open turn, and
+// sealing before the rest of the span has arrived would seal a poorer turn (`finalize.ts`'s docblock). The commits,
+// rewrites and head describe the END of the session, and `capture_commits`' PK admits one row per (capture, sha), so they
+// ride on one delta and not on every one. A delta that is not the last sends none of them, and the spool keeps them.
+isLast = true) {
     const full = buildIngestHeaders(ctx.credential, {
         sessionId: ctx.sessionId,
         seq,
@@ -516,11 +531,11 @@ async function attemptSend(ctx, agent, seq, span, body, lean) {
         fileKey: ctx.fileKey,
         repoSlug: ctx.repoSlug,
         agent,
-        final: ctx.final === true,
-        head: ctx.head,
-        commits: ctx.commits,
-        rewrites: ctx.rewrites,
-        inferredRewrites: ctx.inferredRewrites,
+        final: ctx.final === true && isLast,
+        head: isLast ? ctx.head : undefined,
+        commits: isLast ? ctx.commits : undefined,
+        rewrites: isLast ? ctx.rewrites : undefined,
+        inferredRewrites: isLast ? ctx.inferredRewrites : undefined,
     });
     const headers = lean ? leanHeaders(full) : full;
     const badHeader = firstUnsafeHeader(headers);
@@ -593,8 +608,10 @@ function holdLean(ctx, key, session, current, span, caps) {
 /**
  * Send the undelivered span of one transcript file and apply the failure policy.
  *
- * **At most one NETWORK attempt per hook, still — exactly D56 §D8's rule.** A
- * `finalize` lean retry (below) is the one exception D56 §D8 itself does not
+ * **At most one NETWORK attempt per hook, still — exactly D56 §D8's rule — FOR ONE DELTA.** PR 4a:
+ * `deliver()` (below) calls this once per delta, and a hook calls it again only while its budget lasts; a 413 split's
+ * retry is budget-gated the same way and is a DIFFERENT, smaller body, so it is not the retry of the same bytes §D8
+ * forbids. A `finalize` lean retry (below) is the one exception D56 §D8 itself does not
  * cover: it governs HOOKS, and `finalize` is a synchronous, user-invoked verb
  * that already makes 1 + up to `FINALIZE_DRAIN_MAX_ITERATIONS` requests by
  * design (VL's explicit ruling, `TODOS[182]`). On the hook path, `later` still
@@ -608,7 +625,7 @@ function holdLean(ctx, key, session, current, span, caps) {
  * is the one that has confined `transcript_path` to the Claude Code root
  * (`/cso` finding 1). This module never opens a file.
  */
-export async function deliver(ctx, eof, readBody) {
+async function deliverChunk(ctx, eof, readBody, cutter) {
     // `CR-017d`. The consent gate already refuses a `cwd` outside a work tree, so
     // the hook cannot reach this — but the ledger's isolation must not rest on a
     // check in another module, the same discipline `consent.ts` states about its
@@ -630,10 +647,41 @@ export async function deliver(ctx, eof, readBody) {
     }
     if (span === null)
         return { kind: "nothing-to-send" };
-    const body = readBody(span.from, span.to);
+    const caps = resolveCaps(ctx.env);
+    const limits = ctx.limits ?? { rawBytes: MAX_DELTA_RAW_BYTES, frameBytes: MAX_DELTA_FRAME_BYTES };
+    // ⭐ PR 4a — ONE DELTA, NOT THE WHOLE SPAN TO EOF. Without a `cutter` this is the old single-span path, byte for byte.
+    //
+    // The delta is cut on a record boundary (the server drops a trailing partial line), at most `limits.rawBytes` raw, and
+    // measured AFTER compression: a frame over `limits.frameBytes` is halved at a boundary and measured again. A record that
+    // alone exceeds either limit cannot be split, so it is skipped and COUNTED (`markSkipped`: the gap counters `status`
+    // reports as "skipped … will not be sent later"), never retried — retrying the same bytes cannot work.
+    //
+    // A cut that is NOT at EOF is not the last delta (`isLast`), so it carries none of the session-level headers.
+    if (cutter !== undefined && span.to > span.from) {
+        const plan = planChunk(cutter, span.from, span.to, limits.rawBytes);
+        // An unterminated record longer than the limit, still at EOF: it may be growing. Leave it for the next event.
+        if (plan.kind === "wait")
+            return { kind: "nothing-to-send" };
+        if (plan.kind === "oversize")
+            return recordTooLarge(ctx, key, session, current, { from: span.from, to: plan.to }, caps);
+        span = { from: span.from, to: plan.to };
+    }
+    let body = readBody(span.from, span.to);
     if (body === null)
         return { kind: "nothing-to-send" };
-    const caps = resolveCaps(ctx.env);
+    if (cutter !== undefined) {
+        while (body.length > limits.frameBytes) {
+            const at = splitPoint(cutter, span.from, span.to);
+            if (at === null)
+                return recordTooLarge(ctx, key, session, current, span, caps);
+            span = { from: span.from, to: at };
+            body = readBody(span.from, span.to);
+            if (body === null)
+                return { kind: "nothing-to-send" };
+        }
+    }
+    // An empty span (a `final` with nothing new) is the last delta by definition.
+    let isLast = cutter === undefined || span.to >= eof || span.to === span.from;
     // `seq` is claimed BEFORE the attempt and persisted by the SWITCH below (every ordinary disposition —
     // "ok"/"later"/"never"/"fatal" — builds `next` from `{ ...session, seq, … }`), so it is monotonic per
     // session across retries once a request was actually classified. A seq reused after a failure would read
@@ -673,7 +721,7 @@ export async function deliver(ctx, eof, readBody) {
     // full and lean requests depending on what the NEXT turn happens to contain,
     // which nobody can debug.
     let lean = current.lean;
-    let attempt = await attemptSend(ctx, agent, seq, span, body, lean);
+    let attempt = await attemptSend(withinBudget(ctx), agent, seq, span, body, lean, isLast);
     if (attempt.kind === "unsafe") {
         return refuse(ctx, key, session, current, span, caps, attempt.header === "authorization" ? "fatal" : "never", lean);
     }
@@ -688,7 +736,7 @@ export async function deliver(ctx, eof, readBody) {
     if (outcome.kind === "response" && outcome.status === 431) {
         if (lean) {
             // Already lean and STILL 431: nothing client-side can shrink this
-            // further. `never`, exactly as 413 — the one case `never` is correct
+            // further. `never`, exactly as an UNSPLITTABLE 413 (a single record) — the one case `never` is correct
             // here, because it really is per-body now.
             return refuse(ctx, key, session, current, span, caps, "never", true);
         }
@@ -700,7 +748,7 @@ export async function deliver(ctx, eof, readBody) {
         // in-process retry here does not reopen D56 §D8, which governs hooks. Go
         // lean and retry ONCE, within this same invocation.
         lean = true;
-        attempt = await attemptSend(ctx, agent, seq, span, body, lean);
+        attempt = await attemptSend(withinBudget(ctx), agent, seq, span, body, lean, isLast);
         if (attempt.kind === "unsafe") {
             // Unreachable in practice — every lean header is already proven safe, or
             // it would never have reached the full build either — but stated rather
@@ -718,6 +766,35 @@ export async function deliver(ctx, eof, readBody) {
         // true — the `"ok"` case's accounting reads it to skip settling data this
         // attempt never put on the wire.
     }
+    // ⭐ PR 4a — A 413 IS NO LONGER A WRITE-OFF WHEN THE SPAN CAN BE SPLIT. Halve it at a record boundary and send the first half
+    // as a different, smaller request. A 413 is refused before the server applies anything (`server.ts`'s body limit, then the
+    // decompressed-size check), so the SAME `seq` is reused: the server never recorded it, and it is not a replay.
+    //
+    // ⛔ Only a span that is a single record falls through to `classify`, where 413 is `never`: the bytes cannot be made
+    // smaller, so skipping them is correct and the record is counted. Everything else here sends bytes the 413 did not see.
+    //
+    // Each retry is gated on the hook's remaining budget (`budgetLeftMs`), so this is not D56 §D8's forbidden synchronous
+    // retry of the SAME bytes: it is bounded by the budget the hook already has, and out of budget it HOLDS the span.
+    let splitTooLarge = false;
+    while (cutter !== undefined && outcome.kind === "response" && outcome.status === 413) {
+        const at = splitPoint(cutter, span.from, span.to);
+        if (at === null) {
+            splitTooLarge = true;
+            break;
+        }
+        if (budgetLeftMs(ctx) < MIN_NEXT_DELTA_BUDGET_MS)
+            return holdSpan(ctx, key, session, current, span, caps, lean);
+        span = { from: span.from, to: at };
+        isLast = false;
+        const half = readBody(span.from, span.to);
+        if (half === null)
+            return { kind: "nothing-to-send" };
+        attempt = await attemptSend(withinBudget(ctx), agent, seq, span, half, lean, false);
+        if (attempt.kind === "unsafe") {
+            return refuse(ctx, key, session, current, span, caps, attempt.header === "authorization" ? "fatal" : "never", lean);
+        }
+        outcome = attempt.outcome;
+    }
     const disposition = classify(outcome);
     let next = ctx.byHook ? { ...session, seq, liveAt: ctx.nowMs } : { ...session, seq };
     let inferredSetAsidePairs = 0;
@@ -797,7 +874,9 @@ export async function deliver(ctx, eof, readBody) {
             // sendable, for a reason unrelated to `lean`) entries are UNAFFECTED by this gate: they are consumed
             // only via a NORMAL, non-lean call's `capSpool`/`capSuccessors`/`capInferred`, which this gate does not
             // touch, so a lean session's held lines still drain exactly as soon as a non-lean request reads them.
-            if (!lean) {
+            // PR 4a: AND ONLY ON THE DELTA THAT CARRIED THEM (`isLast`). A delta earlier in the span sent none of the commits,
+            // rewrites or inferred pairs, so a 2xx for it says nothing about them and the spool must keep them for the delta that did.
+            if (!lean && isLast) {
                 const retry = outcome.kind === "response" ? outcome.commitsRetry : null;
                 const nothingLanded = outcome.kind === "response" && outcome.captureId === "";
                 const holdForNextDelta = nothingLanded && (ctx.commits?.shas.length ?? 0) > 0;
@@ -880,6 +959,14 @@ export async function deliver(ctx, eof, readBody) {
             break;
     }
     saveSessionState(ctx.home, key, next);
+    // 0.7.0: remember, for `status`, that THIS repo's upload was refused because its org has not approved capture — and
+    // forget it on the next delivery. Only that one error code sets it; a 5xx or a timeout neither sets nor clears it.
+    if (disposition === "ok")
+        clearOrgPending(ctx.home, ctx.repoSlug);
+    else if (disposition === "later" && outcome.kind === "response" && outcome.detail?.code === CAPTURE_NOT_APPROVED) {
+        // The slug is the CLIENT's (`ctx.repoSlug`), never the response body's: the 403 names nobody.
+        markOrgPending(ctx.home, ctx.nowMs, outcome.detail.ownersNotified ?? null, ctx.repoSlug);
+    }
     // `outcome.detail` is null on every path except a non-2xx with a parseable
     // error body, so this is a pass-through and not a second decision.
     return {
@@ -894,6 +981,123 @@ export async function deliver(ctx, eof, readBody) {
         ...(outcome.kind === "response" && disposition === "ok" && outcome.conversationId !== undefined
             ? { conversationId: outcome.conversationId }
             : {}),
+        ...(outcome.kind === "unreachable" ? { unreachable: true } : {}),
+        // PR 4a: a 413 that no split could shrink was skipped by the `never` arm above; say so, so the caller can count it.
+        ...(splitTooLarge && disposition === "never" ? { recordsTooLarge: 1 } : {}),
     };
 }
+/**
+ * PR 4a — a single record that alone exceeds a delta limit. Nothing is sent: the same bytes would be refused, so the record
+ * is skipped, the gap is stamped (`markSkipped`, which `status` reports), and the offset moves past it. `refuse` does
+ * exactly that and persists it; this adds the count.
+ */
+function recordTooLarge(ctx, key, session, current, span, caps) {
+    const skipped = refuse(ctx, key, session, current, span, caps, "never", current.lean);
+    return skipped.kind === "attempted" ? { ...skipped, recordsTooLarge: 1 } : skipped;
+}
+/**
+ * PR 4a — out of hook budget in the middle of a 413 split: hold the span the failed request covered, as a `later` does. The
+ * `seq` is not persisted for the same reason the split reuses it: the 413 was refused before the server applied it.
+ */
+function holdSpan(ctx, key, session, current, span, caps, lean) {
+    saveSessionState(ctx.home, key, withFileState(session, ctx.fileKey, { ...markHeld(current, span, ctx.nowMs, caps), lean }));
+    return { kind: "attempted", disposition: "later", detail: null, finalAck: null, inferredStored: null, inferredSetAsidePairs: 0 };
+}
+/** Hook budget left for further sends, ms. `Infinity` when the caller set no deadline (`finalize`, `connect`). */
+function budgetLeftMs(ctx) {
+    return ctx.deadlineAtMs === undefined ? Infinity : ctx.deadlineAtMs - (ctx.clock ?? Date.now)();
+}
+/**
+ * `ctx` with this attempt's timeout trimmed to what is left of the hook budget (unchanged when there is no deadline).
+ *
+ * ⛔ CALLED RIGHT BEFORE EACH `attemptSend`, never ahead of the read. The read, the redaction and the compression of a delta
+ * (and every halving pass) take real time, and a timeout fixed before them lets the last delta end past `deadlineAtMs` by
+ * exactly that. Floored like `sendTimeoutMs` (`hooks/entry.ts`): when the budget is already gone the watchdog is the real
+ * limit, and a zero timeout would only abort a send that was about to be refused anyway.
+ */
+function withinBudget(ctx) {
+    const left = budgetLeftMs(ctx);
+    if (!Number.isFinite(left))
+        return ctx;
+    return { ...ctx, timeoutMs: Math.max(MIN_ATTEMPT_TIMEOUT_MS, Math.min(ctx.timeoutMs, Math.floor(left * NEXT_DELTA_BUDGET_FRACTION))) };
+}
+/**
+ * Send the undelivered span of one transcript file, in deltas — PR 4a.
+ *
+ * Without a `cutter` this is the single request it always was: everything from the offset to EOF, at most one attempt.
+ * With one (every production caller), the span goes out as record-aligned deltas, each acknowledged before the offset
+ * moves past it:
+ *
+ *   - **A hook sends deltas only while its budget lasts** (`ctx.deadlineAtMs`) and leaves the rest for its next event or
+ *     `vibecommit finalize`; `Delivery.more` says it stopped early. `finalize` and `connect` set no deadline and run on.
+ *   - **It stops at the first delta that is not `ok`** and returns that delta's outcome: `later` and `fatal` hold exactly
+ *     the bytes that failed, so a resume starts at the next unacknowledged delta, with no resend and no gap. A
+ *     `capture_not_approved` 403 on any delta is such a stop, so its pending beat is printed once.
+ *   - **A skipped oversize record does not stop it.** The records after it still go out.
+ *   - **`connect`'s conversation id survives a partial run** (DX D8): it is read from the first 2xx that carries it, no later
+ *     delta reads a body, and it is returned even when a later delta came back `later`.
+ *
+ * ⛔ A 2xx never changes a delta's outcome, and a hook reads no body (eng-2 D2): the only body read is `connect`'s opt-in.
+ */
+export async function deliver(ctx, eof, readBody, cutter) {
+    if (cutter === undefined)
+        return deliverChunk(ctx, eof, readBody, undefined);
+    const key = { repoKey: ctx.repoKey, sessionId: ctx.sessionId };
+    let chunkCtx = ctx;
+    let conversationId;
+    let tooLarge = 0;
+    let deltas = 0;
+    let last = null;
+    const carry = (d, more = false) => d.kind !== "attempted"
+        ? d
+        : {
+            ...d,
+            ...(d.conversationId === undefined && conversationId !== undefined ? { conversationId } : {}),
+            ...(tooLarge > 0 ? { recordsTooLarge: tooLarge } : {}),
+            ...(deltas > 1 ? { deltas } : {}),
+            ...(more ? { more: true } : {}),
+        };
+    for (;;) {
+        const before = fileState(loadSessionState(ctx.home, key), ctx.fileKey).sentOffset;
+        let delivery;
+        try {
+            delivery = await deliverChunk(chunkCtx, eof, readBody, cutter);
+        }
+        catch {
+            // The cutter reads the file and a read can fail. That must read as "could not tell where the record ends", never as
+            // "it does not end" (which would skip a record). Nothing was persisted for this delta, so the next event retries it.
+            delivery = { kind: "nothing-to-send" };
+        }
+        if (delivery.kind !== "attempted")
+            return last === null ? delivery : carry(last);
+        deltas += 1;
+        tooLarge += delivery.recordsTooLarge ?? 0;
+        conversationId ??= delivery.conversationId;
+        // `ok`, or a record skipped as too large, moved the offset on; anything else is a stop, and its outcome is the answer.
+        if (delivery.disposition !== "ok" && delivery.recordsTooLarge === undefined)
+            return carry(delivery);
+        const after = fileState(loadSessionState(ctx.home, key), ctx.fileKey).sentOffset;
+        // No progress is a bug somewhere below; end the loop rather than spin on it.
+        if (after <= before)
+            return carry(delivery);
+        // ⛔ EVERY BYTE IS ACCOUNTED FOR, BUT THE LAST DELTA WAS SKIPPED RATHER THAN SENT, AND THE SESSION-LEVEL HEADERS RODE
+        // ON IT. A skipped record (too large by the raw limit, the frame limit, or a 413 no split can shrink) puts nothing on
+        // the wire, so the `final` assertion, the commits, the head and the rewrites that belong to the delta ending at EOF
+        // never landed. Run ONE more pass: `nextSpan` is null at EOF, so the existing `span === null && final` branch of
+        // `deliverChunk` sends the empty delta that carries them (`isLast` is true for an empty span). Without this a
+        // `finalize` whose last record was oversize reported `notDelivered` after every byte had been sent or written off.
+        // Hooks never set `final`, and their commits ride the next event as they always did.
+        const tailSkipped = delivery.recordsTooLarge !== undefined && after >= eof && ctx.final === true;
+        if (after >= eof && !tailSkipped)
+            return carry(delivery);
+        if (budgetLeftMs(ctx) < MIN_NEXT_DELTA_BUDGET_MS)
+            return carry(delivery, true);
+        last = delivery;
+        chunkCtx = {
+            ...ctx,
+            // Stop reading bodies once the id is in hand: a later delta never needs one.
+            readConversationId: ctx.readConversationId === true && conversationId === undefined,
+        };
+    }
+}
 //# sourceMappingURL=post.js.map