@winkjs/composer 0.5.0 → 0.6.0

package/src/flow/run.js

@@ -17,6 +17,8 @@ import * as partitionManager from '../core/partition-manager/index.js';
 import { wireLinearGraph, emitters, storages, assertModuleDurability } from '../core/wiring/index.js';
 import shutdownManager from '../core/shutdown-manager/index.js';
 import { ENV_VARS } from '../core/env-vars.js';
+import { wrapCallback } from '../core/utils/callback-guard/index.js';
+import { logger } from '../core/logger/index.js';
 
 /**
  * Wires and starts the pipeline for direct execution.
@@ -27,7 +29,8 @@ import { ENV_VARS } from '../core/env-vars.js';
  * @param {Set} importSet - Set of node names used
  * @param {Object} runtime - Runtime configuration
  * @param {Array} [caseOrder] - Order of case keys (only for multi-specialization)
- * @returns {Promise<Object>} Pipeline handle with shutdown method
+ * @returns {Promise<Object>} Pipeline handle: processMessage, shutdown,
+ *   whenComplete, getStats, flowName, composerState
  */
 export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet, runtime, caseOrder ) {
     // Determine if this is multi-specialization mode
@@ -156,10 +159,16 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
     // caller that ignores the Promise (a push source such as the MQTT
     // subscriber) can never see messages update a partition out of order.
     //
-    // The caller contract (ADR-013) is unchanged: `undefined` on the hot
-    // path, a Promise on the yield tick; `await` works with both, and the
-    // Promise never rejects — a pipeline fault throws synchronously here,
-    // the same as on every other message.
+    // The caller contract (ADR-013) is unchanged in shape: `undefined` on
+    // the hot path, a Promise on the yield tick; `await` works with both,
+    // and the Promise never rejects. Fault delivery depends on the flow
+    // kind (ADR-018 — the runtime owns per-message dispatch failure). With
+    // a source present, a pipeline fault is contained here: the message is
+    // skipped, one red MESSAGE_HANDLER_FAILED travels the status channel,
+    // and a run of consecutive failures stops the flow in the terminal
+    // 'errored' phase. A headless flow (no source) has no status channel,
+    // so the fault throws synchronously to the caller — the headless
+    // driver's catch and `failed` counter are that path's containment.
     //
     // The default threshold comes from YIELD_TIME_THRESHOLD_MS (500 ms);
     // `.yield( { threshold } )` overrides it per flow, and Infinity turns
@@ -187,26 +196,10 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
 
     const partitionState = composerState.partitionState;
 
-    const processMessage = function ( msg ) {
-        const graph = partitionManager.update( composerState, msg );
-
-        // Process first — pmUpdate always returns the graph synchronously
-        // (or null for a dropped message, which never sets the flag).
-        if ( graph ) {
-            runPipeline( graph, msg );
-        }
-
-        // Breathe after (yield tick, rare): hand the awaiting caller a
-        // Promise that resolves once the event loop has had a full turn.
-        if ( partitionState.yieldPending ) {
-            partitionState.yieldPending = false;
-            return new Promise( ( resolve ) => {
-                setImmediate( resolve );
-            } );
-        }
-
-        return undefined;
-    };
+    // The dispatch function itself is defined AFTER the shutdown
+    // closure below — its escalation path drains the flow, so it
+    // needs `shutdown` in scope. No message can arrive before then:
+    // the source only receives processMessage at start, further down.
 
     // 6. Setup the flow's shutdown closure.
     //
@@ -272,8 +265,8 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
             await stage();
         } catch ( err ) {
             stageErrors.push( err );
-            console.error(
-                `WinkComposer/flow: ${label} drain stage failed [${( err && err.code ) || 'UNKNOWN'}]: ` +
+            logger.error(
+                `winkComposer/flow: ${label} drain stage failed [${( err && err.code ) || 'UNKNOWN'}]: ` +
                 `${( err && err.message ) || String( err )} — later drain stages still ran`
             );
         }
@@ -311,6 +304,93 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
         return shutdownPromise;
     };
 
+    // Run the drain with its rejection observed. Both fire-and-forget
+    // call sites use this: the natural-completion trigger and the
+    // consecutive-failure escalation. drainAll rethrows the first
+    // stage error; with no awaiting caller that rejection would end
+    // the process as unhandled. The classified log keeps the loss
+    // loud without the crash, and a caller that later awaits
+    // `handle.shutdown()` still receives the memoized rejection.
+    const observedShutdown = function () {
+        shutdown().catch( function ( err ) {
+            logger.error(
+                `winkComposer/flow '${flowName}': shutdown failed ` +
+                `[${( err && err.code ) || 'UNKNOWN'}]: ${( err && err.message ) || String( err )}`
+            );
+        } );
+    };
+
+    // ── Message dispatch with fault containment (ADR-018: the flow
+    // runtime owns per-message dispatch failure at this chokepoint) ──
+    // All containment state is flow-scoped policy, kept in this
+    // closure beside the shutdown state — never on the handle-exposed
+    // composerState. `reportDispatchFailure` stays null for a headless
+    // flow (no source); the source block below assigns it before the
+    // source ever receives processMessage.
+    let consecutiveFailures = 0;
+    let errored = false;
+    let erroredDropReported = false;
+    let reportDispatchFailure = null;
+
+    const processMessage = function ( msg ) {
+        // Terminal 'errored': drop everything. The first drop is
+        // reported once, classified; a flood of per-drop reports
+        // would bury the one terminal red that matters.
+        if ( errored ) {
+            if ( !erroredDropReported ) {
+                erroredDropReported = true;
+                logger.error(
+                    `winkComposer/flow '${flowName}': flow is in the terminal 'errored' ` +
+                    'phase [MESSAGE_HANDLER_FAILED] — dropping this and all further messages'
+                );
+            }
+            return undefined;
+        }
+
+        // Process first — pmUpdate always returns the graph synchronously
+        // (or null for a dropped message, which never sets the flag).
+        // The guard covers pmUpdate too: a first message for a new asset
+        // runs every node's init lazily, so an init throw surfaces here.
+        try {
+            const graph = partitionManager.update( composerState, msg );
+            if ( graph ) {
+                runPipeline( graph, msg );
+                // Reset on success only — a dropped message is neither
+                // a success nor a failure. Branch-guarded so the
+                // healthy steady state never writes.
+                if ( consecutiveFailures !== 0 ) {
+                    consecutiveFailures = 0;
+                }
+            }
+        } catch ( err ) {
+            if ( reportDispatchFailure === null ) {
+                // Headless: the caller is the reporting channel — the
+                // driver's catch and `failed` counter own the fault.
+                throw err;
+            }
+            consecutiveFailures += 1;
+            const isTerminal = consecutiveFailures >= ENV_VARS.messageFailureThreshold;
+            reportDispatchFailure( err, isTerminal );
+            if ( isTerminal ) {
+                errored = true;
+                observedShutdown();
+            }
+        }
+
+        // Breathe after (yield tick, rare): hand the awaiting caller a
+        // Promise that resolves once the event loop has had a full turn.
+        // Runs on the catch path too — pmUpdate may have set the flag
+        // before the pipeline threw, and the breath must not be lost.
+        if ( partitionState.yieldPending ) {
+            partitionState.yieldPending = false;
+            return new Promise( ( resolve ) => {
+                setImmediate( resolve );
+            } );
+        }
+
+        return undefined;
+    };
+
     // 7. Start source (singleton).
     if ( runtime.source ) {
         const { adapter, config } = runtime.source;
@@ -321,17 +401,42 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
         // too (they bypass the DSL entirely).
         assertModuleDurability( adapter.id || 'source', adapter );
 
+        // The callback guard below turns a non-function into null
+        // (absent). Validate raw first, so a misconfigured handler
+        // fails loudly at setup instead of silently vanishing. Placed
+        // here for the same reason as the durability check above:
+        // direct runFlow() callers bypass the DSL schema.
+        if ( config.onStatus !== undefined && config.onStatus !== null && typeof config.onStatus !== 'function' ) {
+            const err = new Error( `winkComposer/flow '${flowName}': onStatus must be a function` );
+            err.code = 'INVALID_CONFIG';
+            throw err;
+        }
+
         // Wrap user's onStatus so the runtime can spot the natural-
         // completion signal without taking it away from the user.
         // When the source signals `phase: 'complete'`:
         //   1. Resolve the whenComplete Promise so callers can stop
         //      waiting for natural completion.
-        //   2. Trigger the drain (`shutdown()` is fire-and-forget —
-        //      it's concurrent-safe and stages have their own timeouts).
-        const userOnStatus = config.onStatus;
+        //   2. Trigger the drain via observedShutdown — fire-and-forget
+        //      with its rejection logged; shutdown is concurrent-safe
+        //      and stages have their own timeouts.
+        // The user's handler is armed by the shared callback guard
+        // (ADR-018: a misbehaving user callback never interrupts the
+        // runtime that called it). Null when the flow has no handler,
+        // so the classified fallback branch below keeps red statuses
+        // loud.
+        const safeUserOnStatus = wrapCallback( config.onStatus, {
+            name: 'onStatus',
+            severity: 'red',
+            report: function ( severity, name, detail ) {
+                logger.error(
+                    `winkComposer/flow '${flowName}': user callback ${name} failed [CALLBACK_FAILED]: ${detail}`
+                );
+            }
+        } );
         const wrappedOnStatus = function ( s ) {
-            if ( userOnStatus ) {
-                userOnStatus( s );
+            if ( safeUserOnStatus ) {
+                safeUserOnStatus( s );
             } else if ( s && s.status === 'red' ) {
                 // No user handler: log the failure here, classified. The
                 // source's own console fallback fires only when NO handler
@@ -341,13 +446,39 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
                 const code = ( s.error && s.error.code ) || 'UNKNOWN';
                 const message = ( s.error && s.error.message ) ||
                     'source reported status red with no error detail';
-                console.error( `WinkComposer/flow '${flowName}': source error [${code}]: ${message}` );
+                logger.error( `winkComposer/flow '${flowName}': source error [${code}]: ${message}` );
             }
+            // Completion bookkeeping runs after — and independently of —
+            // the user's reporter. A throwing onStatus must never swallow
+            // the flow's own completion: whenComplete waiters would hang
+            // and the source would never stop.
             if ( s && s.phase === 'complete' ) {
                 resolveWhenComplete();
-                shutdown();
+                observedShutdown();
             }
         };
+
+        // The dispatch guard's reporting channel. Routing through
+        // wrappedOnStatus keeps the two-party rule: a flow without a
+        // user handler still gets the classified console fallback for
+        // red statuses. No local guard is needed here: the callback
+        // guard above contains a throwing user handler, and every other
+        // branch of wrappedOnStatus is throw-free.
+        reportDispatchFailure = function ( err, isTerminal ) {
+            const payload = {
+                status: 'red',
+                connected: true,
+                phase: isTerminal ? 'errored' : 'running',
+                error: {
+                    code: 'MESSAGE_HANDLER_FAILED',
+                    message: isTerminal ?
+                        `${ENV_VARS.messageFailureThreshold} consecutive message failures — ` +
+                        `flow stopped. Last: ${err.message}` :
+                        `${err.message} — message skipped`
+                }
+            };
+            wrappedOnStatus( payload );
+        };
         stopSource = adapter.start( {
             ...config,
             // Override any source-level auto-shutdown setting. The
@@ -362,10 +493,12 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
             onShutdown: shutdown
         } );
     } else {
-
-        /* c8 ignore next 3 -- defensive: the flow API rejects empty flows before run() is called, so a flow without a source cannot reach this branch via the public API. Kept as a safety net for direct runFlow() callers. */
-        // No source means "nothing to wait for" — resolve immediately
-        // so any `await handle.whenComplete()` is a no-op.
+        // The headless branch: a flow with no source is a documented
+        // DSL path (the headless driver feeds it). No source means
+        // "nothing to wait for" — resolve immediately so any
+        // `await handle.whenComplete()` is a no-op. And with no
+        // status channel, `reportDispatchFailure` stays null, so the
+        // dispatch guard rethrows pipeline faults to the caller.
         resolveWhenComplete();
     }
 
@@ -384,6 +517,11 @@ export const runFlow = async function ( flowName, specsOrSpecsByCase, importSet,
         composerState,
         shutdown,
         processMessage,
+        // Cold-path counter snapshot (drops, partitions). Allocates one
+        // small object per call; never called by the pipeline itself.
+        getStats: function () {
+            return partitionManager.getStats( composerState );
+        },
         whenComplete: function () {
             return whenCompletePromise;
         }

package/src/flow/serialize.js

@@ -59,7 +59,7 @@ const serializeValue = function ( value, indent ) {
 
     if ( t === 'function' ) {
         const funcStr = value.toString();
-        if ( funcStr.includes( '[native code]' ) ) throw Error( 'WinkComposer/flow: only regular or arrow functions are supported.' );
+        if ( funcStr.includes( '[native code]' ) ) throw Error( 'winkComposer/flow: only regular or arrow functions are supported.' );
         return funcStr;
     }
 

package/src/flow/spec-builder.js

@@ -11,7 +11,7 @@ const buildStatsFromOutputs = function ( outputs ) {
         // overwrite case, caught at build time by check-output-collisions.js.
         if ( seenStoreAs[ storeAs ] ) {
             throw new Error(
-                `WinkComposer/flow: Node has duplicate storeAs '${storeAs}' ` +
+                `winkComposer/flow: Node has duplicate storeAs '${storeAs}' ` +
                 `for stats '${seenStoreAs[ storeAs ]}' and '${stat}'`
             );
         }

package/src/flow/validate.js

@@ -254,7 +254,7 @@ export const validateFlowOrThrow = function ( flowName, specs, nodeModules, regi
     if ( !result.valid ) {
         const errorList = result.errors.map( ( e ) => `  - ${e}` ).join( '\n' );
         throw new Error(
-            `Flow '${flowName}' validation failed:\n${errorList}`
+            `winkComposer/flow '${flowName}': validation failed:\n${errorList}`
         );
     }
 };

package/src/nodes/butterworth-filter/init.js

@@ -10,6 +10,7 @@
 import { validateSpec } from '../../core/utils/node/index.js';
 import * as introspect from './introspect.js';
 import { resolveScalar } from '../../core/utils/options/resolve-field-keyed.js';
+import { logger } from '../../core/logger/index.js';
 
 const init = function ( spec ) {
     validateSpec( spec, introspect );
@@ -74,14 +75,14 @@ const init = function ( spec ) {
     // Validate the computed cutoff
     if ( cutoffHz <= 0 || cutoffHz >= nyquistHz ) {
         throw new RangeError(
-            `Computed cutoff ${cutoffHz.toFixed(1)}Hz is outside valid range (0, ${nyquistHz}Hz)`
+            `winkComposer/butterworthFilter: Computed cutoff ${cutoffHz.toFixed(1)}Hz is outside valid range (0, ${nyquistHz}Hz)`
         );
     }
 
     // Warn about potential numerical issues
     const normalizedCutoff = cutoffHz / nyquistHz;
     if ( normalizedCutoff < 0.001 && !state.acceptNumericalRisk ) {
-        console.warn( `Very low cutoff (${cutoffHz.toFixed(3)}Hz) may cause numerical instability` );
+        logger.warn( `winkComposer/butterworthFilter: Very low cutoff (${cutoffHz.toFixed(3)}Hz) may cause numerical instability` );
     }
 
     // Store configuration for reference
@@ -127,14 +128,14 @@ const init = function ( spec ) {
     /* c8 ignore next 5 -- defensive: bilinear transform produces stable coefficients for valid Nyquist-bounded cutoff */
     if ( Math.abs( state.a2 ) >= 1 ) {
         throw new Error(
-            `Filter unstable: coefficient a2 (${state.a2.toFixed(4)}) is outside stability bounds`
+            `winkComposer/butterworthFilter: Filter unstable: coefficient a2 (${state.a2.toFixed(4)}) is outside stability bounds`
         );
     }
 
     /* c8 ignore next 5 -- defensive: same Nyquist guard prevents a1 stability violation */
     if ( Math.abs( state.a1 ) >= 1 + state.a2 ) {
         throw new Error(
-            `Filter unstable: coefficient a1 (${state.a1.toFixed(4)}) violates stability condition |a1| < 1 + a2`
+            `winkComposer/butterworthFilter: Filter unstable: coefficient a1 (${state.a1.toFixed(4)}) violates stability condition |a1| < 1 + a2`
         );
     }
 

package/src/nodes/categorize/update.js

@@ -6,6 +6,8 @@
  * threshold counts (3–5), linear search outperforms binary search.
  */
 
+import { logger } from '../../core/logger/index.js';
+
 const update = function ( state, msg ) {
     if ( state.disable || state.pause ) return state;
     const xVal = msg[ state.x ];
@@ -25,7 +27,7 @@ const update = function ( state, msg ) {
     } catch ( error ) {
         if ( !state.tunableErrorLogged ) {
             state.tunableErrorLogged = true;
-            console.error( `WinkComposer/${state.nodeType}: tunable threw: ${error.message}` );
+            logger.error( `winkComposer/${state.nodeType}: tunable threw: ${error.message}` );
         }
     }
 

package/src/nodes/controller/update.js

@@ -1,6 +1,7 @@
 // nodes/controller/update.js
 
 import { executeTriggers } from '../../core/utils/node/index.js';
+import { logger } from '../../core/logger/index.js';
 
 const update = function ( state, msg ) {
     // Track whether any predicate threw during this pass
@@ -22,7 +23,7 @@ const update = function ( state, msg ) {
             // Log first error per episode; suppress subsequent until recovery
             if ( !state.predicateErrorLogged ) {
                 state.predicateErrorLogged = true;
-                console.error( `WinkComposer/controller: predicate threw exception: ${error.message}` );
+                logger.error( `winkComposer/controller: predicate threw exception: ${error.message}` );
             }
             // Skip to next condition
             continue;  // eslint-disable-line no-continue

package/src/nodes/dwell-time-tracker/update.js

@@ -1,6 +1,7 @@
 // nodes/dwell-time-tracker/update.js
 
 import { executeTriggers } from '../../core/utils/node/index.js';
+import { logger } from '../../core/logger/index.js';
 
 const update = function ( state, msg ) {
     if ( state.disable || state.pause ) return state;
@@ -20,7 +21,7 @@ const update = function ( state, msg ) {
         // Log first error per episode; suppress subsequent until recovery
         if ( !state.predicateErrorLogged ) {
             state.predicateErrorLogged = true;
-            console.error( `WinkComposer/dwellTimeTracker: predicate threw exception: ${error.message}` );
+            logger.error( `winkComposer/dwellTimeTracker: predicate threw exception: ${error.message}` );
         }
         return state;
     }

package/src/nodes/emit-if/helpers.js

@@ -6,6 +6,8 @@
  * and the status-signal path below.
  */
 
+import { logger } from '../../core/logger/index.js';
+
 /**
  * Static fallback error the framework substitutes when an adapter breaks
  * the return contract — no result object at all, or `{ ok: false }` with
@@ -54,10 +56,52 @@ const recordEmissionFailure = function ( state, error ) {
         state.emitErrorLogged = true;
         state.firstEmissionError = error.message;
         state.firstEmissionErrorCode = error.code;
-        console.error( state.emitErrorLogPrefix + error.code + '): ' + error.message );
+        logger.error( state.emitErrorLogPrefix + error.code + '): ' + error.message );
     }
 }; // recordEmissionFailure()
 
+/**
+ * Substituted error for an emitter that THREW from publishNow — the
+ * other face of a broken return contract (ADR-018: the hot path never
+ * throws; a sink answers { ok }). Same code as the malformed-result
+ * face: the remediation is identical (fix the non-conforming adapter),
+ * and the message names the difference. Allocates on the failure path
+ * only.
+ *
+ * @param {Error} error - The thrown value
+ * @returns {Object} `{ code, message }` for the failure episode
+ */
+const thrownSinkError = function ( error ) {
+    return {
+        code: 'MALFORMED_RESULT',
+        message: `emitter publishNow threw instead of returning { ok, error? }: ${error.message}`
+    };
+}; // thrownSinkError()
+
+/**
+ * Delivers one payload to the wired emitter with the sink call fully
+ * guarded. A conforming emitter never throws; a throwing one is a
+ * broken adapter, recorded in the emission episode — never blamed on
+ * the user's predicate, and never escaped into the pipeline where it
+ * would cost the whole message. Returns true only on `{ ok: true }`.
+ *
+ * @param {Object} state - Node state containing emitter and topic
+ * @param {Object} data - Payload to publish
+ * @returns {boolean} True when the emitter accepted the payload
+ */
+const deliverToEmitter = function ( state, data ) {
+    try {
+        const result = state.emitter.publishNow( state.topic, data );
+        if ( result && result.ok ) {
+            return true;
+        }
+        recordEmissionFailure( state, ( result && result.error ) || MALFORMED_RESULT_ERROR );
+    } catch ( sinkError ) {
+        recordEmissionFailure( state, thrownSinkError( sinkError ) );
+    }
+    return false;
+}; // deliverToEmitter()
+
 /**
  * Emits disable/enable status signal to the wired emitter. Published
  * unconditionally (no connectivity pre-check per ADR-018 — during a
@@ -80,15 +124,17 @@ const emitStatusSignal = function ( state, disable, reason ) {
         $timestamp: Date.now()
     };
 
-    // Guarded read: this path runs inside update()'s catch block, so a
-    // TypeError here would escape update() and kill the pipeline. A
-    // malformed result counts as a failure with the static fallback
-    // error instead.
-    const result = state.emitter.publishNow( state.topic, signal );
-    if ( result && result.ok ) {
-        return;
-    }
-    recordEmissionFailure( state, ( result && result.error ) || MALFORMED_RESULT_ERROR );
+    // Fully guarded delivery: this path can run inside update()'s
+    // catch block, so a throwing emitter here would otherwise escape
+    // update() and kill the pipeline. deliverToEmitter contains both
+    // faces of a broken adapter — a throw and a malformed result.
+    deliverToEmitter( state, signal );
 }; // emitStatusSignal()
 
-export { assertAnnotateReturn, emitStatusSignal, recordEmissionFailure, MALFORMED_RESULT_ERROR };
+export {
+    assertAnnotateReturn,
+    emitStatusSignal,
+    recordEmissionFailure,
+    deliverToEmitter,
+    MALFORMED_RESULT_ERROR
+};

package/src/nodes/emit-if/init.js

@@ -59,7 +59,7 @@ const init = function ( spec ) {
     state.firstEmissionErrorCode = null;
     // Static log prefix pre-built here per ADR-004 (no string building in
     // update beyond the two runtime fields, and only once per episode).
-    state.emitErrorLogPrefix = `WinkComposer/emitIf: publish failed (node=${state.name}, insightType=${state.insightType}, code=`;
+    state.emitErrorLogPrefix = `winkComposer/emitIf: publish failed (node=${state.name}, insightType=${state.insightType}, code=`;
 
     return state;
 }; // init()

package/src/nodes/emit-if/update.js

@@ -14,7 +14,8 @@
  * the two output gates share one failure model).
  */
 
-import { assertAnnotateReturn, emitStatusSignal, recordEmissionFailure, MALFORMED_RESULT_ERROR } from './helpers.js';
+import { assertAnnotateReturn, emitStatusSignal, deliverToEmitter } from './helpers.js';
+import { logger } from '../../core/logger/index.js';
 
 const update = function ( state, msg ) {
     // Always increment pass count for observability
@@ -44,19 +45,15 @@ const update = function ( state, msg ) {
             // Per the ADR-018 sink return contract, the emitter answers
             // { ok: true } on success or
             // { ok: false, error: { code, message } } on failure.
-            const result = state.emitter.publishNow( state.topic, data );
-
-            if ( result && result.ok ) {
+            // deliverToEmitter guards the call itself too: a THROWING
+            // emitter is the other face of a broken contract, recorded
+            // in the same adapter episode — a non-conforming adapter
+            // can neither fail silently nor throw out of the hot path.
+            if ( deliverToEmitter( state, data ) ) {
                 state.emissionCount += 1;
                 state.lastEmissionTime = Date.now();
                 // Recovery: a successful publish closes the failure episode.
                 if ( state.emitErrorLogged ) state.emitErrorLogged = false;
-            } else {
-                // A malformed result (no object at all, or ok:false with no
-                // error) counts as a failure with the static fallback error,
-                // so a non-conforming adapter can neither fail silently
-                // nor throw out of the hot path.
-                recordEmissionFailure( state, ( result && result.error ) || MALFORMED_RESULT_ERROR );
             }
         }
 
@@ -76,7 +73,7 @@ const update = function ( state, msg ) {
         // Log first error per episode; suppress subsequent until recovery
         if ( !state.predicateErrorLogged ) {
             state.predicateErrorLogged = true;
-            console.error( `WinkComposer/emitIf: predicate threw exception: ${error.message}` );
+            logger.error( `winkComposer/emitIf: predicate threw exception: ${error.message}` );
         }
         state.emissionErrors += 1;
         state.lastEmissionError = error.message;

package/src/nodes/page-hinkley/update.js

@@ -39,6 +39,7 @@
  */
 
 import { executeTriggers } from '../../core/utils/node/index.js';
+import { logger } from '../../core/logger/index.js';
 
 const update = function ( state, msg ) {
     if ( state.disable || state.pause ) return state;
@@ -64,7 +65,7 @@ const update = function ( state, msg ) {
     } catch ( error ) {
         if ( !state.tunableErrorLogged ) {
             state.tunableErrorLogged = true;
-            console.error( `WinkComposer/${state.nodeType}: tunable threw: ${error.message}` );
+            logger.error( `winkComposer/${state.nodeType}: tunable threw: ${error.message}` );
         }
     }
 

package/src/nodes/pass-if/update.js

@@ -8,6 +8,8 @@
  * is false. Predicate errors are caught and tracked per-episode.
  */
 
+import { logger } from '../../core/logger/index.js';
+
 const update = function ( state, msg ) {
     if ( state.disable || state.pause ) return state;
 
@@ -26,7 +28,7 @@ const update = function ( state, msg ) {
         // Log first error per episode; suppress subsequent until recovery
         if ( !state.predicateErrorLogged ) {
             state.predicateErrorLogged = true;
-            console.error( `WinkComposer/passIf: predicate threw exception: ${error.message}` );
+            logger.error( `winkComposer/passIf: predicate threw exception: ${error.message}` );
         }
     }