commandmate 0.48.0 → 0.49.1

package/dist/server/src/lib/relay/relay-bound-reply.js

@@ -0,0 +1,519 @@
+"use strict";
+/**
+ * Reading B's reply out of the ledger and stashing it for A (Issue #2377,
+ * bound relays Issue #3957).
+ *
+ * Split out of `relay-delivery` (Issue #3996): everything here decides WHAT is
+ * owed to a relay — the reply, the prompt notice, the bound relay's recovery
+ * after a restart — and nothing here sends. The send, the pump and the state
+ * they share stay in `relay-delivery`, which re-exports this module's public
+ * names, and this module never imports it back.
+ *
+ * @module lib/relay/relay-bound-reply
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.senderLabel = senderLabel;
+exports.requiresTurnRow = requiresTurnRow;
+exports.findWorkerReply = findWorkerReply;
+exports.stashReplyForOpenRelays = stashReplyForOpenRelays;
+exports.observationStillHolds = observationStillHolds;
+exports.findWorkerCompletions = findWorkerCompletions;
+exports.stashBoundReply = stashBoundReply;
+exports.notifyPromptForRelay = notifyPromptForRelay;
+exports.stashPromptNotice = stashPromptNotice;
+exports.recoverBoundRelays = recoverBoundRelays;
+const crypto_1 = require("crypto");
+const relay_db_1 = require("../../lib/db/relay-db");
+const chat_db_1 = require("../../lib/db/chat-db");
+const models_1 = require("../../types/models");
+const model_change_push_notifier_1 = require("../../lib/push/model-change-push-notifier");
+const relay_messages_1 = require("../../lib/relay/relay-messages");
+const relay_bind_1 = require("../../lib/relay/relay-bind");
+const relay_boot_1 = require("../../lib/relay/relay-boot");
+const relay_overlap_1 = require("../../lib/relay/relay-overlap");
+const waiting_episode_state_1 = require("../../lib/session/waiting-episode-state");
+const prompt_waiting_composition_1 = require("../../lib/session/prompt-waiting-composition");
+const registry_1 = require("../../lib/hooks/sources/registry");
+const relay_session_ref_1 = require("../../lib/relay/relay-session-ref");
+const relay_delivery_claims_1 = require("../../lib/relay/relay-delivery-claims");
+const types_1 = require("../../lib/relay/types");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('relay-delivery');
+/**
+ * How many assistant rows back the reply is looked for.
+ *
+ * A turn can write several rows (a narration then a summary), and the relay
+ * wants the last one that is actually the agent talking. Bounded because an
+ * unbounded read of a long-lived worktree's history is a large query for one
+ * line of answer.
+ */
+const REPLY_LOOKBACK_MESSAGES = 40;
+/**
+ * The `request_id` shape a transcript reader mints for a finished turn.
+ *
+ * `claude-turn:<uuid>`, `codex-turn:<turn_id>`, `antigravity-turn:<id>`,
+ * `command-code-turn:<id>` and opencode's `oc-turn:<message id>`. Matched as a
+ * SHAPE rather than as a list of five literals for the reason `ask`'s copy of
+ * this line gives (Issue #2386): the sixth reader lands INSIDE the filter
+ * instead of silently outside it. A `:` cannot appear in any of the ids
+ * themselves, so this cannot match a row that merely contains the text.
+ *
+ * Copied rather than imported, deliberately. `src/cli/commands/ask.ts` has the
+ * same regexp, and importing it here would invert the dependency (lib reaching
+ * into the CLI bundle); `AGENT_MARKDOWN_REQUEST_ID_PREFIXES` in
+ * `src/types/agent-transcript.ts` is the LIST form this shape is chosen not to
+ * be. One regexp in each layer is cheaper than either edge.
+ */
+const TURN_REQUEST_ID_PATTERN = /-turn:/;
+/**
+ * Request-id namespaces CommandMate writes ABOUT a session, not for it.
+ *
+ * `chat_messages` has no `system` role, so "reply from X" (Issue #2377) and
+ * "the model changed" (Issue #2357) are both stored as assistant rows and told
+ * apart by their request id. Neither is a word the worker said, and handing the
+ * relay's own notice back to the session it came from is the smallest possible
+ * loop. `ask` steps over exactly these two for the same reason.
+ */
+const SYSTEM_ROW_REQUEST_ID_PREFIXES = [
+    chat_db_1.RELAY_SYSTEM_REQUEST_ID_PREFIX,
+    chat_db_1.MODEL_CHANGE_REQUEST_ID_PREFIX,
+];
+/**
+ * Whether this tool's reply is read out of a transcript rather than off a screen.
+ *
+ * For the six that answer `true` the ledger is authoritative: a row with no
+ * turn marker was written by the SCRAPER, and for these tools a scraped row is
+ * never the answer — it is a footer line, a half-drawn frame or the ANSI dump
+ * the send path flushes (Issues #2398 / #2400). The relay may therefore hold
+ * out for a marked row. For copilot, gemini and vibe-local the scraper's row is
+ * the only record there will ever be, and demanding a marker would deliver
+ * nothing, ever.
+ *
+ * A record and not a `Set`, so a ninth entry in `CLI_TOOL_IDS` fails `tsc` here
+ * instead of quietly defaulting to "screen-scraped" — the idiom
+ * `cli-tools/install-hints` uses for the same reason.
+ *
+ * Deliberately NOT `isPullTranscriptHistory`: that asks who does the READING,
+ * so opencode (whose own server pushes) answers `false` even though its rows
+ * carry `oc-turn:` like the other four. It also lives in `lib/polling`, whose
+ * module graph reaches this file's triggers — importing it would close a cycle
+ * the relay was built to avoid.
+ */
+const TRANSCRIPT_READER_TOOLS = {
+    claude: true,
+    codex: true,
+    antigravity: true,
+    'command-code': true,
+    opencode: true,
+    copilot: false,
+    gemini: false,
+    'vibe-local': false,
+    // Issue #2940: OpenCode V2's replies are written from its server
+    // (`GET /api/session/{id}/message`) under `oc-turn:`, like opencode's.
+    'opencode-v2': true,
+};
+function senderLabel(db, relay) {
+    const worker = (0, relay_session_ref_1.resolveRelaySession)(db, relay.to);
+    return { alias: worker.alias, worktreeId: worker.worktreeId };
+}
+/** Whether a row's `request_id` says a transcript reader wrote it. */
+function isTurnRow(requestId) {
+    return typeof requestId === 'string' && TURN_REQUEST_ID_PATTERN.test(requestId);
+}
+/** Whether a row is CommandMate's own furniture rather than the worker's words. */
+function isSystemRow(requestId) {
+    return typeof requestId === 'string'
+        && SYSTEM_ROW_REQUEST_ID_PREFIXES.some((prefix) => requestId.startsWith(prefix));
+}
+/** Whether this worker's answer is only ever a transcript row. */
+function requiresTurnRow(cliToolId) {
+    return TRANSCRIPT_READER_TOOLS[cliToolId] === true;
+}
+/**
+ * The newest thing B actually said, at or after `since`.
+ *
+ * Four kinds of row are stepped over, and each exclusion is load-bearing:
+ * prompt rows (a question is not an answer, and the confirmation notice is a
+ * separate delivery), CommandMate's own system rows (delivering "Reply from X"
+ * back to X is the smallest possible loop), empty bodies — and, for a tool that
+ * keeps a transcript, every row the SCRAPER wrote.
+ *
+ * That last one is Issue #2401. Until it was added the filter looked only at
+ * shape, never at provenance, so the newest row won whatever had written it:
+ * a codex footer line, a partial scrape, or the raw ANSI the send path flushes
+ * lands in the ledger with `request_id IS NULL` and, being newest, WAS the
+ * reply — forwarded to the requesting agent as the worker's own answer, which
+ * it then summarises. #2386 fixed the identical hole in `ask` by demanding the
+ * turn marker; the relay looked exempt only because its 15-second pump usually
+ * gave the transcript time to land, and a race the timing usually wins is still
+ * a race.
+ */
+function findWorkerReply(db, worker, since) {
+    const messages = (0, chat_db_1.getMessages)(db, worker.worktreeId, {
+        limit: REPLY_LOOKBACK_MESSAGES,
+        cliToolId: worker.cliToolId,
+        instanceId: worker.instanceId,
+        matchResolvedInstance: true,
+    });
+    const requireTurnRow = requiresTurnRow(worker.cliToolId);
+    // `getMessages` answers newest-first, so the first candidate IS the newest.
+    for (const message of messages) {
+        if (message.role !== 'assistant')
+            continue;
+        if (message.messageType === 'prompt')
+            continue;
+        if (isSystemRow(message.requestId))
+            continue;
+        if (requireTurnRow && !isTurnRow(message.requestId))
+            continue;
+        if (message.content.trim() === '')
+            continue;
+        return message.timestamp.getTime() < since ? null : message;
+    }
+    return null;
+}
+/** The options of B's open dialog, in the shape the notice lists them. */
+function promptOptionsOf(message) {
+    const data = message.promptData;
+    // #3184: type narrowing only — the stored row's screen `options` are listed;
+    // a stored degraded record never carries a decision id, so it has none.
+    if (!(0, models_1.isAnswerablePromptData)(data))
+        return [];
+    if (data.type === 'yes_no') {
+        return data.options.map((label) => ({ key: label, label }));
+    }
+    return data.options.map((option) => ({
+        key: String(option.number),
+        label: option.label,
+    }));
+}
+/**
+ * Stash B's finished reply against every relay that is waiting for it.
+ *
+ * @returns How many relays took a payload from this call
+ */
+function stashReplyForOpenRelays(db, worker, now) {
+    const relays = (0, relay_db_1.listOpenRelaysTo)(db, {
+        worktreeId: worker.worktreeId,
+        instanceId: worker.instanceId,
+    });
+    if (relays.length === 0)
+        return 0;
+    let stashed = 0;
+    for (const relay of relays) {
+        // Issue #3957: a bound relay is answered from its own send's boundary, and
+        // only once that send is confirmed.
+        if (relay.bindMode === 'bound') {
+            if (stashForBoundRelay(db, worker, relay, now))
+                stashed += 1;
+            continue;
+        }
+        // `createdAt` and not "the last time we looked": a reply written BEFORE the
+        // relay existed answered somebody else's question, and delivering it would
+        // hand session A the previous turn — the exact failure a bare `capture`
+        // after a `wait` has always had.
+        const reply = findWorkerReply(db, worker, relay.createdAt);
+        if (!reply)
+            continue;
+        const body = (0, relay_messages_1.buildRelayReplyMessage)(senderLabel(db, relay), reply.content);
+        if (stashReply(db, relay.id, { candidateId: reply.id, body, overlap: null, basis: 'legacy' }, now)) {
+            stashed += 1;
+        }
+    }
+    return stashed;
+}
+/**
+ * Stash a decided reply, minding the prompt notice that may hold the slot
+ * (Issue #3957).
+ *
+ * The slot is free: the reply takes it. A prompt notice holds it and is not
+ * being typed: the reply REPLACES it — the dialog it describes has been
+ * answered, and delivering the stale notice would start a new turn on the
+ * requester for nothing. The notice is being typed: the reply waits in the
+ * second slot and is promoted once the notice is out. A reply already holds
+ * it: nothing (two producers, one delivery).
+ */
+function stashReply(db, relayId, reply, now) {
+    const decided = { ...reply, payloadId: (0, crypto_1.randomUUID)() };
+    if ((0, relay_db_1.stashRelayPayload)(db, relayId, 'reply', decided.body, now, {
+        payloadId: decided.payloadId,
+        overlap: decided.overlap ?? undefined,
+    })) {
+        return true;
+    }
+    const current = (0, relay_db_1.getRelayPendingPayload)(db, relayId);
+    if (!current || current.kind !== 'prompt')
+        return false;
+    if (!(0, relay_delivery_claims_1.isRelayDeliveryClaimed)(relayId)) {
+        if ((0, relay_db_1.replaceRelayPromptWithReply)(db, relayId, current.payloadId, decided, now))
+            return true;
+    }
+    return (0, relay_db_1.setRelayPendingReply)(db, relayId, decided, now);
+}
+/**
+ * Whether the session's observation still matches the one the send recorded.
+ *
+ * A mismatch is a relaunch or a restart since the boundary; the relay is held
+ * with the reason and its observation marked invalid, so no later reply from
+ * the new process is matched to it either.
+ */
+function observationStillHolds(db, worker, binding) {
+    if (binding.relay.obsState === 'invalid')
+        return false;
+    const now = (0, relay_boot_1.relayObservationSource)(worker.worktreeId, worker.cliToolId, worker.instanceId);
+    if (binding.obsSource === now)
+        return true;
+    const restarted = (0, relay_boot_1.bootOfObservationSource)(binding.obsSource) !== (0, relay_boot_1.relayServerBootId)();
+    (0, relay_db_1.setRelayHold)(db, binding.relay.id, restarted ? relay_bind_1.RELAY_HOLD_REASONS.serverRestarted : relay_bind_1.RELAY_HOLD_REASONS.generationChanged, { invalidate: true });
+    logger.info('relay-observation-mismatch', { relayId: binding.relay.id, restarted });
+    return false;
+}
+/**
+ * A completion reached a bound relay (Issue #3957).
+ *
+ * Before the send is confirmed it is only HELD — appended to the candidates,
+ * never replacing an earlier one — because the send may still fail, and a
+ * reply that ended while the body queued for the lock is not this request's.
+ * Once `sent`, the reply is read from the boundary and stashed with its
+ * overlap. `failed` / `unknown` take nothing.
+ */
+function stashForBoundRelay(db, worker, relay, now) {
+    if (relay.sendState === 'awaiting' || relay.sendState === 'input_started') {
+        // Every finished turn since the relay opened, oldest first — not only the
+        // newest: a transcript reader that backfills two turns saves both and
+        // announces once, and holding only the newest would lose the earlier one.
+        // From the boundary once it is written: rows before it are never taken,
+        // and must not use up the scan's bound. `timestamp` is the turn's ORDER
+        // (its first row), the same key the confirmation re-reads by.
+        for (const turn of findWorkerCompletions(db, worker, relay.inputBoundaryAt ?? relay.createdAt)) {
+            (0, relay_db_1.appendRelayHeldCandidate)(db, relay.id, { messageId: turn.row.id, timestamp: turn.orderAt, requestId: turn.row.requestId ?? null }, now);
+        }
+        return false;
+    }
+    if (relay.sendState !== 'sent' || relay.inputBoundaryAt === null)
+        return false;
+    const binding = (0, relay_db_1.getRelayBinding)(db, relay.id);
+    if (!binding || !observationStillHolds(db, worker, binding))
+        return false;
+    // The earliest turn that finished after the boundary, for the same reason.
+    const [first] = findWorkerCompletions(db, worker, relay.inputBoundaryAt);
+    if (!first)
+        return false;
+    return stashBoundReply(db, worker, binding, first.row, now);
+}
+/**
+ * How many completion rows one read collects at most (Issue #3957).
+ *
+ * A safety bound, not a window: the rows are read OLDEST first from the lower
+ * bound, so reaching it can only drop the LATEST turns, never the earliest —
+ * and the earliest is the only one ever taken. A newest-first window (the
+ * 40 rows {@link findWorkerReply} reads) is the opposite: a backfill of more
+ * rows than it holds pushes the earliest turn out and the next one is taken.
+ */
+const COMPLETION_SCAN_MAX_ROWS = 500;
+/**
+ * Every finished turn of B at or after `since`, oldest first, as one row per
+ * turn (Issue #3957).
+ *
+ * The same row filter as {@link findWorkerReply}, applied in SQL so that user
+ * rows, prompt rows and CommandMate's own rows do not use up the bound, and
+ * ordered by time then insertion (rowid). A transcript tool's turn is its
+ * `-turn:` request id, represented by its NEWEST row (the summary after the
+ * narration, read by the request id without a bound — see
+ * {@link latestRowOfTurn}); a row with no request id (a scrape-only tool) is a
+ * turn of its own.
+ */
+function findWorkerCompletions(db, worker, since) {
+    const requireTurnRow = requiresTurnRow(worker.cliToolId);
+    const systemClauses = SYSTEM_ROW_REQUEST_ID_PREFIXES.map(() => 'request_id NOT LIKE ?').join(' AND ');
+    const rows = db
+        .prepare(`
+      SELECT id, request_id, timestamp FROM chat_messages
+      WHERE worktree_id = ? ${chat_db_1.ACTIVE_FILTER}
+        AND COALESCE(cli_tool_id, 'claude') = ?
+        AND COALESCE(instance_id, cli_tool_id, 'claude') = ?
+        AND role = 'assistant' AND COALESCE(message_type, 'normal') != 'prompt'
+        AND (request_id IS NULL OR (${systemClauses}))
+        ${requireTurnRow ? "AND request_id LIKE '%-turn:%'" : ''}
+        AND TRIM(content, ' ' || char(9, 10, 13)) != ''
+        AND timestamp >= ?
+      ORDER BY timestamp ASC, rowid ASC
+      LIMIT ?
+    `)
+        .all(worker.worktreeId, worker.cliToolId, worker.instanceId, ...SYSTEM_ROW_REQUEST_ID_PREFIXES.map((prefix) => `${prefix}%`), since, COMPLETION_SCAN_MAX_ROWS);
+    // Already in turn order: a turn is placed by its first row, and its body is
+    // its newest row — kept apart so the order never follows the body.
+    const turns = [];
+    const seenTurns = new Set();
+    for (const row of rows) {
+        if (row.request_id !== null) {
+            if (seenTurns.has(row.request_id))
+                continue;
+            seenTurns.add(row.request_id);
+            const latest = latestRowOfTurn(db, worker, row.request_id);
+            if (latest)
+                turns.push({ row: latest, orderAt: row.timestamp });
+            continue;
+        }
+        const message = (0, chat_db_1.getMessageById)(db, row.id);
+        if (message)
+            turns.push({ row: message, orderAt: row.timestamp });
+    }
+    return turns;
+}
+/** The newest row a turn wrote, by its request id — no row bound. */
+function latestRowOfTurn(db, worker, requestId) {
+    const row = db
+        .prepare(`
+      SELECT id FROM chat_messages
+      WHERE worktree_id = ? ${chat_db_1.ACTIVE_FILTER}
+        AND COALESCE(cli_tool_id, 'claude') = ?
+        AND COALESCE(instance_id, cli_tool_id, 'claude') = ?
+        AND role = 'assistant' AND request_id = ?
+        AND TRIM(content, ' ' || char(9, 10, 13)) != ''
+      ORDER BY timestamp DESC, rowid DESC
+      LIMIT 1
+    `)
+        .get(worker.worktreeId, worker.cliToolId, worker.instanceId, requestId);
+    return row ? (0, chat_db_1.getMessageById)(db, row.id) : null;
+}
+/** Judge the overlap of one reply and stash it, note and all. */
+function stashBoundReply(db, worker, binding, reply, now) {
+    const verdict = (0, relay_overlap_1.judgeRelayOverlap)(db, binding, worker, reply);
+    const note = (0, relay_messages_1.buildRelayOverlapNote)((0, model_change_push_notifier_1.resolveReadersLocale)(db), verdict.overlap);
+    const body = (0, relay_messages_1.buildRelayReplyMessage)(senderLabel(db, binding.relay), reply.content, note);
+    const stashed = stashReply(db, binding.relay.id, { candidateId: reply.id, body, overlap: verdict.overlap, basis: verdict.basis }, now);
+    if (stashed) {
+        logger.info('relay-reply-decided', {
+            relayId: binding.relay.id,
+            candidateId: reply.id,
+            overlap: verdict.overlap,
+            basis: verdict.basis,
+        });
+    }
+    return stashed;
+}
+/**
+ * Whether a prompt row may be told to this relay's requester (Issue #3957).
+ *
+ * A legacy relay: as before. A bound one: only once its send is confirmed,
+ * with a valid observation, and only for a dialog that appeared at or after
+ * its boundary — one shown before the request went in belongs to somebody
+ * else's turn.
+ */
+function promptBelongsToRelay(db, worker, relay, prompt) {
+    if (relay.bindMode !== 'bound')
+        return true;
+    if (relay.sendState !== 'sent' || relay.inputBoundaryAt === null)
+        return false;
+    if (prompt.timestamp.getTime() < relay.inputBoundaryAt)
+        return false;
+    const binding = (0, relay_db_1.getRelayBinding)(db, relay.id);
+    return binding !== null && observationStillHolds(db, worker, binding);
+}
+/**
+ * Re-judge the worker's open dialog for one bound relay just confirmed.
+ *
+ * "Still open" is the waiting episode, not merely an unanswered row: the
+ * opening edge that would have told the relay fired before the send was
+ * confirmed, and a dialog closed since must not be reported.
+ */
+function notifyPromptForRelay(db, worker, relayId) {
+    const episode = (0, waiting_episode_state_1.getWaitingEpisode)(worker.worktreeId, worker.cliToolId, worker.instanceId);
+    if (!episode || episode.kind !== 'prompt')
+        return false;
+    if ((0, prompt_waiting_composition_1.isApiAnswerableWaitNow)(worker.worktreeId, worker.cliToolId, worker.instanceId, (0, registry_1.getAgentEventSource)(worker.cliToolId).capabilities.eventIdentity)) {
+        return false;
+    }
+    const prompt = (0, chat_db_1.getLatestOpenPromptMessage)(db, worker.worktreeId, worker.cliToolId, worker.instanceId);
+    if (!prompt)
+        return false;
+    const relay = (0, relay_db_1.getRelayById)(db, relayId);
+    if (!relay || !(0, types_1.isOpenRelayState)(relay.state))
+        return false;
+    return stashPromptNotice(db, worker, relay, prompt);
+}
+/** Stash one prompt notice for one relay, once per dialog. */
+function stashPromptNotice(db, worker, relay, prompt) {
+    if (!promptBelongsToRelay(db, worker, relay, prompt))
+        return false;
+    // The dialog's own row id is the signature: a wait that lasts twenty
+    // minutes is ONE row, so A is told once however many polls observe it.
+    if ((0, relay_db_1.getRelayPromptSignature)(db, relay.id) === prompt.id)
+        return false;
+    const locale = (0, model_change_push_notifier_1.resolveReadersLocale)(db);
+    const options = promptOptionsOf(prompt);
+    // #3184: type narrowing only, to read `question` off the closed union.
+    const question = (0, models_1.isAnswerablePromptData)(prompt.promptData)
+        ? prompt.promptData.question
+        : (prompt.promptData?.question ?? prompt.content);
+    const body = (0, relay_messages_1.buildRelayPromptMessage)(locale, senderLabel(db, relay), { question, options });
+    if (!(0, relay_db_1.stashRelayPayload)(db, relay.id, 'prompt', body))
+        return false;
+    // The signature is recorded HERE, before the delivery, and not after it:
+    // it is what stops every later poll of the same twenty-minute dialog
+    // from stashing the same notice again while A is still busy. The state
+    // moving to `prompt` is an OPEN state, so the reply that follows once
+    // the dialog is answered can still be stashed and delivered.
+    (0, relay_db_1.markRelayPromptNotified)(db, relay.id, prompt.id);
+    return true;
+}
+/**
+ * After a restart, settle every bound relay the previous boot left mid-send
+ * (Issue #3957). Once per boot; cheap when there is nothing to do.
+ *
+ *  - `awaiting`, not reserved: left alone (nobody has sent yet).
+ *  - `awaiting`, reserved by another boot: that boot died before the boundary,
+ *    i.e. before the first key — proven unsent, so the relay is cancelled.
+ *  - `input_started` by another boot: whether the body went in cannot be
+ *    told; held as `unknown`.
+ *  - `sent` with a decided payload: delivered as usual.
+ *  - `sent` without one, observed by another boot: the turn record that
+ *    reply would be judged against is gone; held, observation invalid.
+ */
+function recoverBoundRelays(db, now = Date.now()) {
+    const boot = (0, relay_boot_1.relayServerBootId)();
+    let recovered = 0;
+    for (const binding of (0, relay_db_1.listOpenBoundRelays)(db)) {
+        const { relay } = binding;
+        if (relay.sendState === 'awaiting') {
+            if (binding.bindAttemptId === null || binding.bindOwner === boot)
+                continue;
+            if ((0, relay_db_1.failOrphanedRelayBind)(db, relay.id, binding.bindAttemptId, relay_bind_1.RELAY_HOLD_REASONS.serverRestartedBeforeInput, now)) {
+                recovered += 1;
+            }
+            continue;
+        }
+        if (relay.sendState === 'input_started') {
+            if (binding.bindOwner === boot || binding.bindAttemptId === null)
+                continue;
+            if ((0, relay_db_1.settleRelaySendState)(db, {
+                relayId: relay.id,
+                attemptId: binding.bindAttemptId,
+                from: ['input_started'],
+                to: 'unknown',
+                holdReason: relay_bind_1.RELAY_HOLD_REASONS.serverRestarted,
+                now,
+            })) {
+                recovered += 1;
+            }
+            continue;
+        }
+        if (relay.sendState === 'sent') {
+            if (binding.pendingKind !== null)
+                continue;
+            if (binding.pendingReply !== null) {
+                if ((0, relay_db_1.promoteRelayPendingReply)(db, relay.id, now))
+                    recovered += 1;
+                continue;
+            }
+            if ((0, relay_boot_1.bootOfObservationSource)(binding.obsSource) === boot || relay.obsState === 'invalid')
+                continue;
+            (0, relay_db_1.setRelayHold)(db, relay.id, relay_bind_1.RELAY_HOLD_REASONS.serverRestarted, { invalidate: true, now });
+            recovered += 1;
+        }
+    }
+    if (recovered > 0)
+        logger.info('relay-bound-recovered', { recovered });
+    return recovered;
+}