blun-king-cli 9.1.601 → 9.1.603

package/bin/agentspine-king-status-policy.mjs

@@ -1,226 +1,226 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { lstat, mkdir, open, readFile, realpath, rename, unlink } from 'node:fs/promises';
-import path from 'node:path';
-
-const SCHEMA = 'blun.king-goal-status/v2';
-const MAX_BYTES = 4 * 1024 * 1024;
-const STATES = new Set(['pending', 'dispatching', 'uncertain', 'delivered']);
-const RESULT_REJECTIONS = new Set(['GOAL_STEP_RESULT_EXCEEDS_64_KIB', 'GOAL_STEP_RESULT_INVALID_JSON',
-  'GOAL_STEP_RESULT_INVALID', 'GOAL_STEP_CHECKPOINT_REQUIRED', 'GOAL_STEP_CHECKPOINT_TOO_LARGE']);
-const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
-const identifier = value => typeof value === 'string' && /^[A-Za-z0-9:._@/-]{1,200}$/.test(value);
-const routeKeys = ['id', 'provider', 'tenantId', 'accountId', 'chatId', 'threadId', 'agentId',
-  'projectId', 'groupId', 'createdAt'];
-
-export function goalResultRejectionCode(error) {
-  const code = String(error?.message ?? error).replace(/^Host runtime unavailable: /, '');
-  return RESULT_REJECTIONS.has(code) ? code : null;
-}
-
-function normalizeScope(input) {
-  const keys = ['logicalPersonaId', 'runtimePersonaId', 'projectId', 'groupId', 'ownerSubjectId',
-    'chatId', 'senderId'];
-  if (!input || keys.some(key => !identifier(input[key]))
-    || (input.threadId !== null && input.threadId !== undefined && !identifier(input.threadId))) throw new Error('GOAL_STATUS_SCOPE_INVALID');
-  return { ...Object.fromEntries(keys.map(key => [key, input[key]])), threadId: input.threadId ?? null };
-}
-
-function errorCode(error) {
-  return /^(GOAL_[A-Z0-9_]{1,100})(?::|\s|$)/.exec(String(error ?? ''))?.[1] ?? 'GOAL_STATUS_OPERATION_REJECTED';
-}
-
-function normalizeEvent(input) {
-  if (!input || !identifier(input.eventId)) throw new Error('GOAL_STATUS_EVENT_INVALID');
-  if (input.kind === 'intake-rejected' && identifier(input.messageId)) {
-    return { kind: input.kind, eventId: input.eventId, messageId: input.messageId, error: errorCode(input.error) };
-  }
-  if (!identifier(input.goalId) || (input.goalStepId !== null && input.goalStepId !== undefined && !identifier(input.goalStepId))) {
-    throw new Error('GOAL_STATUS_EVENT_INVALID');
-  }
-  const event = { kind: input.kind, eventId: input.eventId, goalId: input.goalId, goalStepId: input.goalStepId ?? null };
-  if (input.kind === 'result-rejected' && Number.isSafeInteger(input.attempt) && input.attempt > 0) {
-    return { ...event, attempt: input.attempt, error: errorCode(input.error) };
-  }
-  if (input.kind !== 'goal-status' || !identifier(input.status)
-    || !['offen', 'blockiert', 'bestanden'].includes(input.gate)) throw new Error('GOAL_STATUS_EVENT_INVALID');
-  return { ...event, status: input.status, gate: input.gate };
-}
-
-function message(scope, event) {
-  if (event.kind === 'intake-rejected') {
-    return `${scope.logicalPersonaId} | Zielannahme Nachricht ${event.messageId} | abgelehnt | ${event.error}`;
-  }
-  if (event.kind === 'result-rejected') {
-    return `${scope.logicalPersonaId} | Zielantwort ${event.goalId} / ${event.goalStepId ?? '-'} | abgelehnt ${event.attempt} | ${event.error}`;
-  }
-  return `${scope.logicalPersonaId} | Ziel ${event.goalId} | Schritt ${event.goalStepId ?? '-'} | ${event.status} | Gate ${event.gate}`;
-}
-
-function matches(binding, scope) {
-  return binding?.status === 'active' && binding.provider === 'telegram'
-    && binding.authority === 'explicit-local-channel-policy'
-    && binding.agentId === scope.runtimePersonaId && binding.projectId === scope.projectId
-    && binding.groupId === scope.groupId && binding.chatId === scope.chatId
-    && (binding.threadId ?? null) === scope.threadId
-    && binding.senderIds?.includes(scope.senderId) && binding.capabilities?.includes('reply');
-}
-
-function selectRoute(loaded, scope) {
-  const candidates = loaded?.policy?.bindings?.filter(binding => matches(binding, scope)) ?? [];
-  if (candidates.length !== 1) return null;
-  const binding = candidates[0];
-  if (routeKeys.some(key => key !== 'threadId' && (typeof binding[key] !== 'string' || !binding[key]))) return null;
-  return Object.fromEntries(routeKeys.map(key => [key, binding[key] ?? null]));
-}
-
-function sameRoute(left, right) {
-  return left && right && routeKeys.every(key => left[key] === right[key]);
-}
-
-async function assertRegular(file) {
-  try {
-    const meta = await lstat(file);
-    if (!meta.isFile() || meta.isSymbolicLink()) throw new Error('GOAL_STATUS_NOT_REGULAR');
-  } catch (error) { if (error.code !== 'ENOENT') throw error; }
-}
-
-async function loadState(file) {
-  await assertRegular(file);
-  let bytes;
-  try { bytes = await readFile(file); } catch (error) {
-    if (error.code === 'ENOENT') return { schema: SCHEMA, receipts: [] };
-    throw error;
-  }
-  try {
-    if (bytes.length > MAX_BYTES) throw new Error('oversized');
-    const state = JSON.parse(bytes);
-    if (state?.schema !== SCHEMA || !Array.isArray(state.receipts)) throw new Error('schema');
-    const keys = new Set();
-    for (const record of state.receipts) {
-      const scope = normalizeScope(record.scope);
-      const event = normalizeEvent(record.event);
-      if (JSON.stringify(scope) !== JSON.stringify(record.scope) || JSON.stringify(event) !== JSON.stringify(record.event)
-        || record.key !== digest({ scope, event }) || keys.has(record.key) || !STATES.has(record.status)
-        || !Number.isSafeInteger(record.nextAttemptAt) || record.nextAttemptAt < 0
-        || !Number.isSafeInteger(record.attempts) || record.attempts < 0
-        || (record.route !== null && (!record.route || routeKeys.some(key => !(key in record.route))))
-        || (record.status === 'delivered' && !/^telegram-message:\d+$/.test(record.receipt))) throw new Error('receipt');
-      keys.add(record.key);
-    }
-    return state;
-  } catch { throw new Error('GOAL_STATUS_STATE_INVALID'); }
-}
-
-async function saveState(file, state, assertOwned) {
-  const bytes = JSON.stringify(state) + '\n';
-  if (Buffer.byteLength(bytes) > MAX_BYTES) throw new Error('GOAL_STATUS_CAPACITY');
-  const temporary = `${file}.${randomUUID()}.tmp`;
-  const handle = await open(temporary, 'wx', 0o600);
-  try {
-    await handle.writeFile(bytes);
-    await handle.sync();
-  } finally { await handle.close(); }
-  try {
-    await assertOwned();
-    await assertRegular(file);
-    await rename(temporary, file);
-  } finally { await unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
-}
-
-export function createGoalStatusReporter({ stateFile, scope: inputScope, withOwnedFileLock,
-  loadPolicy, adapter, now = Date.now, maxRecords = 512 }) {
-  const scope = normalizeScope(inputScope);
-  if (!path.isAbsolute(stateFile) || typeof withOwnedFileLock !== 'function'
-    || typeof loadPolicy !== 'function' || typeof adapter?.send !== 'function'
-    || !Number.isSafeInteger(maxRecords) || maxRecords < 1) throw new Error('GOAL_STATUS_CONFIG_INVALID');
-  const scopeKey = digest(scope);
-  const transact = async task => {
-    const directory = path.dirname(stateFile);
-    await mkdir(directory, { recursive: true });
-    if (path.relative(directory, await realpath(directory)) !== '') throw new Error('GOAL_STATUS_DIRECTORY_REDIRECTED');
-    const assertPath = async () => {
-      if (path.relative(directory, await realpath(directory)) !== '') throw new Error('GOAL_STATUS_DIRECTORY_REDIRECTED');
-      await assertRegular(`${stateFile}.lock`);
-    };
-    return withOwnedFileLock(`${stateFile}.lock`, async ({ assertOwned }) => {
-      const state = await loadState(stateFile);
-      return task(state, () => saveState(stateFile, state, assertOwned), assertOwned);
-    }, { assertPath });
-  };
-
-  const record = async input => {
-    const event = normalizeEvent(input);
-    return transact(async (state, save) => {
-      const key = digest({ scope, event });
-      const existing = state.receipts.find(row => row.key === key);
-      if (existing) return { key, status: existing.status };
-      // Retain the deduplication history and every unresolved delivery; never silently evict one.
-      if (state.receipts.length >= maxRecords) throw new Error('GOAL_STATUS_CAPACITY');
-      state.receipts.push({ key, scope, event, route: selectRoute(await loadPolicy(), scope),
-        status: 'pending', attempts: 0, nextAttemptAt: 0, receipt: null });
-      await save();
-      return { key, status: 'pending' };
-    });
-  };
-
-  const flush = () => transact(async (state, save, assertOwned) => {
-    const results = [];
-    for (const row of state.receipts) {
-      if (digest(row.scope) !== scopeKey || row.status === 'delivered') continue;
-      const result = status => { results.push({ key: row.key, status }); };
-      // A process may have died after Telegram accepted the request but before the receipt was saved.
-      if (row.status === 'dispatching') { row.status = 'uncertain'; await save(); }
-      if (row.status === 'uncertain') { result('uncertain'); continue; }
-      const current = selectRoute(await loadPolicy(), scope);
-      if (!current) { result(row.route ? 'route-changed' : 'unrouted'); continue; }
-      if (row.route && !sameRoute(row.route, current)) { result('route-changed'); continue; }
-      if (row.nextAttemptAt > now()) { result('waiting'); continue; }
-      row.route ??= current;
-      row.status = 'dispatching'; row.attempts++;
-      await save();
-      if (!sameRoute(row.route, selectRoute(await loadPolicy(), scope))) {
-        row.status = 'pending'; await save(); result('route-changed'); continue;
-      }
-      await assertOwned();
-      let outcome;
-      try {
-        outcome = await adapter.send({ provider: row.route.provider, bindingId: row.route.id,
-          tenantId: row.route.tenantId, accountId: row.route.accountId, chatId: row.route.chatId,
-          threadId: row.route.threadId, replyTo: null,
-          idempotencyKey: row.key, text: message(scope, row.event) });
-      } catch { outcome = { ok: false, effect: 'unknown' }; }
-      if (outcome?.ok === true && /^telegram-message:\d+$/.test(outcome.receipt)) {
-        row.status = 'delivered'; row.receipt = outcome.receipt;
-      } else if (outcome?.ok === false && outcome.effect === 'none') {
-        row.status = 'pending';
-        const wait = Number.isSafeInteger(outcome.retryAfterMs) && outcome.retryAfterMs > 0 ? outcome.retryAfterMs : 15000;
-        row.nextAttemptAt = Math.min(Number.MAX_SAFE_INTEGER, now() + wait);
-      } else { row.status = 'uncertain'; }
-      await save();
-      result(row.status);
-    }
-    return results;
-  });
-
-  const reconcile = async context => {
-    for (const goal of context.goals) {
-      if (goal.agentId !== scope.runtimePersonaId || goal.projectId !== scope.projectId
-        || goal.groupId !== scope.groupId || goal.ownerSubjectId !== scope.ownerSubjectId) continue;
-      const rows = context.queue.filter(row => row.goalId === goal.goalId && row.agentId === scope.runtimePersonaId
-        && row.projectId === scope.projectId && row.groupId === scope.groupId && row.attempts > 0);
-      const row = rows.toSorted((a, b) => a.updatedAt.localeCompare(b.updatedAt)).at(-1);
-      if (!row) continue;
-      const step = goal.plan?.steps.find(item => item.stepId === row.goalStepId);
-      if (row.goalStepId && !step) continue;
-      const identity = { eventId: `${row.queueId}:${row.attempts}`, goalId: goal.goalId, goalStepId: row.goalStepId ?? null };
-      const rejection = goalResultRejectionCode(row.lastError);
-      if (rejection) {
-        await record({ ...identity, kind: 'result-rejected', attempt: row.attempts, error: rejection });
-      }
-      const status = row.status === 'blocked' ? 'blocked' : step?.status ?? goal.status;
-      await record({ ...identity, kind: 'goal-status', status,
-        gate: goal.status === 'completed' ? 'bestanden' : status === 'blocked' ? 'blockiert' : 'offen' });
-    }
-  };
-  return Object.freeze({ record, flush, reconcile });
-}
+import { createHash, randomUUID } from 'node:crypto';
+import { lstat, mkdir, open, readFile, realpath, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+
+const SCHEMA = 'blun.king-goal-status/v2';
+const MAX_BYTES = 4 * 1024 * 1024;
+const STATES = new Set(['pending', 'dispatching', 'uncertain', 'delivered']);
+const RESULT_REJECTIONS = new Set(['GOAL_STEP_RESULT_EXCEEDS_64_KIB', 'GOAL_STEP_RESULT_INVALID_JSON',
+  'GOAL_STEP_RESULT_INVALID', 'GOAL_STEP_CHECKPOINT_REQUIRED', 'GOAL_STEP_CHECKPOINT_TOO_LARGE']);
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const identifier = value => typeof value === 'string' && /^[A-Za-z0-9:._@/-]{1,200}$/.test(value);
+const routeKeys = ['id', 'provider', 'tenantId', 'accountId', 'chatId', 'threadId', 'agentId',
+  'projectId', 'groupId', 'createdAt'];
+
+export function goalResultRejectionCode(error) {
+  const code = String(error?.message ?? error).replace(/^Host runtime unavailable: /, '');
+  return RESULT_REJECTIONS.has(code) ? code : null;
+}
+
+function normalizeScope(input) {
+  const keys = ['logicalPersonaId', 'runtimePersonaId', 'projectId', 'groupId', 'ownerSubjectId',
+    'chatId', 'senderId'];
+  if (!input || keys.some(key => !identifier(input[key]))
+    || (input.threadId !== null && input.threadId !== undefined && !identifier(input.threadId))) throw new Error('GOAL_STATUS_SCOPE_INVALID');
+  return { ...Object.fromEntries(keys.map(key => [key, input[key]])), threadId: input.threadId ?? null };
+}
+
+function errorCode(error) {
+  return /^(GOAL_[A-Z0-9_]{1,100})(?::|\s|$)/.exec(String(error ?? ''))?.[1] ?? 'GOAL_STATUS_OPERATION_REJECTED';
+}
+
+function normalizeEvent(input) {
+  if (!input || !identifier(input.eventId)) throw new Error('GOAL_STATUS_EVENT_INVALID');
+  if (input.kind === 'intake-rejected' && identifier(input.messageId)) {
+    return { kind: input.kind, eventId: input.eventId, messageId: input.messageId, error: errorCode(input.error) };
+  }
+  if (!identifier(input.goalId) || (input.goalStepId !== null && input.goalStepId !== undefined && !identifier(input.goalStepId))) {
+    throw new Error('GOAL_STATUS_EVENT_INVALID');
+  }
+  const event = { kind: input.kind, eventId: input.eventId, goalId: input.goalId, goalStepId: input.goalStepId ?? null };
+  if (input.kind === 'result-rejected' && Number.isSafeInteger(input.attempt) && input.attempt > 0) {
+    return { ...event, attempt: input.attempt, error: errorCode(input.error) };
+  }
+  if (input.kind !== 'goal-status' || !identifier(input.status)
+    || !['offen', 'blockiert', 'bestanden'].includes(input.gate)) throw new Error('GOAL_STATUS_EVENT_INVALID');
+  return { ...event, status: input.status, gate: input.gate };
+}
+
+function message(scope, event) {
+  if (event.kind === 'intake-rejected') {
+    return `${scope.logicalPersonaId} | Zielannahme Nachricht ${event.messageId} | abgelehnt | ${event.error}`;
+  }
+  if (event.kind === 'result-rejected') {
+    return `${scope.logicalPersonaId} | Zielantwort ${event.goalId} / ${event.goalStepId ?? '-'} | abgelehnt ${event.attempt} | ${event.error}`;
+  }
+  return `${scope.logicalPersonaId} | Ziel ${event.goalId} | Schritt ${event.goalStepId ?? '-'} | ${event.status} | Gate ${event.gate}`;
+}
+
+function matches(binding, scope) {
+  return binding?.status === 'active' && binding.provider === 'telegram'
+    && binding.authority === 'explicit-local-channel-policy'
+    && binding.agentId === scope.runtimePersonaId && binding.projectId === scope.projectId
+    && binding.groupId === scope.groupId && binding.chatId === scope.chatId
+    && (binding.threadId ?? null) === scope.threadId
+    && binding.senderIds?.includes(scope.senderId) && binding.capabilities?.includes('reply');
+}
+
+function selectRoute(loaded, scope) {
+  const candidates = loaded?.policy?.bindings?.filter(binding => matches(binding, scope)) ?? [];
+  if (candidates.length !== 1) return null;
+  const binding = candidates[0];
+  if (routeKeys.some(key => key !== 'threadId' && (typeof binding[key] !== 'string' || !binding[key]))) return null;
+  return Object.fromEntries(routeKeys.map(key => [key, binding[key] ?? null]));
+}
+
+function sameRoute(left, right) {
+  return left && right && routeKeys.every(key => left[key] === right[key]);
+}
+
+async function assertRegular(file) {
+  try {
+    const meta = await lstat(file);
+    if (!meta.isFile() || meta.isSymbolicLink()) throw new Error('GOAL_STATUS_NOT_REGULAR');
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+}
+
+async function loadState(file) {
+  await assertRegular(file);
+  let bytes;
+  try { bytes = await readFile(file); } catch (error) {
+    if (error.code === 'ENOENT') return { schema: SCHEMA, receipts: [] };
+    throw error;
+  }
+  try {
+    if (bytes.length > MAX_BYTES) throw new Error('oversized');
+    const state = JSON.parse(bytes);
+    if (state?.schema !== SCHEMA || !Array.isArray(state.receipts)) throw new Error('schema');
+    const keys = new Set();
+    for (const record of state.receipts) {
+      const scope = normalizeScope(record.scope);
+      const event = normalizeEvent(record.event);
+      if (JSON.stringify(scope) !== JSON.stringify(record.scope) || JSON.stringify(event) !== JSON.stringify(record.event)
+        || record.key !== digest({ scope, event }) || keys.has(record.key) || !STATES.has(record.status)
+        || !Number.isSafeInteger(record.nextAttemptAt) || record.nextAttemptAt < 0
+        || !Number.isSafeInteger(record.attempts) || record.attempts < 0
+        || (record.route !== null && (!record.route || routeKeys.some(key => !(key in record.route))))
+        || (record.status === 'delivered' && !/^telegram-message:\d+$/.test(record.receipt))) throw new Error('receipt');
+      keys.add(record.key);
+    }
+    return state;
+  } catch { throw new Error('GOAL_STATUS_STATE_INVALID'); }
+}
+
+async function saveState(file, state, assertOwned) {
+  const bytes = JSON.stringify(state) + '\n';
+  if (Buffer.byteLength(bytes) > MAX_BYTES) throw new Error('GOAL_STATUS_CAPACITY');
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  const handle = await open(temporary, 'wx', 0o600);
+  try {
+    await handle.writeFile(bytes);
+    await handle.sync();
+  } finally { await handle.close(); }
+  try {
+    await assertOwned();
+    await assertRegular(file);
+    await rename(temporary, file);
+  } finally { await unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
+}
+
+export function createGoalStatusReporter({ stateFile, scope: inputScope, withOwnedFileLock,
+  loadPolicy, adapter, now = Date.now, maxRecords = 512 }) {
+  const scope = normalizeScope(inputScope);
+  if (!path.isAbsolute(stateFile) || typeof withOwnedFileLock !== 'function'
+    || typeof loadPolicy !== 'function' || typeof adapter?.send !== 'function'
+    || !Number.isSafeInteger(maxRecords) || maxRecords < 1) throw new Error('GOAL_STATUS_CONFIG_INVALID');
+  const scopeKey = digest(scope);
+  const transact = async task => {
+    const directory = path.dirname(stateFile);
+    await mkdir(directory, { recursive: true });
+    if (path.relative(directory, await realpath(directory)) !== '') throw new Error('GOAL_STATUS_DIRECTORY_REDIRECTED');
+    const assertPath = async () => {
+      if (path.relative(directory, await realpath(directory)) !== '') throw new Error('GOAL_STATUS_DIRECTORY_REDIRECTED');
+      await assertRegular(`${stateFile}.lock`);
+    };
+    return withOwnedFileLock(`${stateFile}.lock`, async ({ assertOwned }) => {
+      const state = await loadState(stateFile);
+      return task(state, () => saveState(stateFile, state, assertOwned), assertOwned);
+    }, { assertPath });
+  };
+
+  const record = async input => {
+    const event = normalizeEvent(input);
+    return transact(async (state, save) => {
+      const key = digest({ scope, event });
+      const existing = state.receipts.find(row => row.key === key);
+      if (existing) return { key, status: existing.status };
+      // Retain the deduplication history and every unresolved delivery; never silently evict one.
+      if (state.receipts.length >= maxRecords) throw new Error('GOAL_STATUS_CAPACITY');
+      state.receipts.push({ key, scope, event, route: selectRoute(await loadPolicy(), scope),
+        status: 'pending', attempts: 0, nextAttemptAt: 0, receipt: null });
+      await save();
+      return { key, status: 'pending' };
+    });
+  };
+
+  const flush = () => transact(async (state, save, assertOwned) => {
+    const results = [];
+    for (const row of state.receipts) {
+      if (digest(row.scope) !== scopeKey || row.status === 'delivered') continue;
+      const result = status => { results.push({ key: row.key, status }); };
+      // A process may have died after Telegram accepted the request but before the receipt was saved.
+      if (row.status === 'dispatching') { row.status = 'uncertain'; await save(); }
+      if (row.status === 'uncertain') { result('uncertain'); continue; }
+      const current = selectRoute(await loadPolicy(), scope);
+      if (!current) { result(row.route ? 'route-changed' : 'unrouted'); continue; }
+      if (row.route && !sameRoute(row.route, current)) { result('route-changed'); continue; }
+      if (row.nextAttemptAt > now()) { result('waiting'); continue; }
+      row.route ??= current;
+      row.status = 'dispatching'; row.attempts++;
+      await save();
+      if (!sameRoute(row.route, selectRoute(await loadPolicy(), scope))) {
+        row.status = 'pending'; await save(); result('route-changed'); continue;
+      }
+      await assertOwned();
+      let outcome;
+      try {
+        outcome = await adapter.send({ provider: row.route.provider, bindingId: row.route.id,
+          tenantId: row.route.tenantId, accountId: row.route.accountId, chatId: row.route.chatId,
+          threadId: row.route.threadId, replyTo: null,
+          idempotencyKey: row.key, text: message(scope, row.event) });
+      } catch { outcome = { ok: false, effect: 'unknown' }; }
+      if (outcome?.ok === true && /^telegram-message:\d+$/.test(outcome.receipt)) {
+        row.status = 'delivered'; row.receipt = outcome.receipt;
+      } else if (outcome?.ok === false && outcome.effect === 'none') {
+        row.status = 'pending';
+        const wait = Number.isSafeInteger(outcome.retryAfterMs) && outcome.retryAfterMs > 0 ? outcome.retryAfterMs : 15000;
+        row.nextAttemptAt = Math.min(Number.MAX_SAFE_INTEGER, now() + wait);
+      } else { row.status = 'uncertain'; }
+      await save();
+      result(row.status);
+    }
+    return results;
+  });
+
+  const reconcile = async context => {
+    for (const goal of context.goals) {
+      if (goal.agentId !== scope.runtimePersonaId || goal.projectId !== scope.projectId
+        || goal.groupId !== scope.groupId || goal.ownerSubjectId !== scope.ownerSubjectId) continue;
+      const rows = context.queue.filter(row => row.goalId === goal.goalId && row.agentId === scope.runtimePersonaId
+        && row.projectId === scope.projectId && row.groupId === scope.groupId && row.attempts > 0);
+      const row = rows.toSorted((a, b) => a.updatedAt.localeCompare(b.updatedAt)).at(-1);
+      if (!row) continue;
+      const step = goal.plan?.steps.find(item => item.stepId === row.goalStepId);
+      if (row.goalStepId && !step) continue;
+      const identity = { eventId: `${row.queueId}:${row.attempts}`, goalId: goal.goalId, goalStepId: row.goalStepId ?? null };
+      const rejection = goalResultRejectionCode(row.lastError);
+      if (rejection) {
+        await record({ ...identity, kind: 'result-rejected', attempt: row.attempts, error: rejection });
+      }
+      const status = row.status === 'blocked' ? 'blocked' : step?.status ?? goal.status;
+      await record({ ...identity, kind: 'goal-status', status,
+        gate: goal.status === 'completed' ? 'bestanden' : status === 'blocked' ? 'blockiert' : 'offen' });
+    }
+  };
+  return Object.freeze({ record, flush, reconcile });
+}