harnery 0.38.0 → 0.40.0

package/src/core/events/v3/capabilities.ts

@@ -1,8 +1,10 @@
-import type { Adapter } from "../../adapter.ts";
+import type { EventAdapterIdV3 } from "./adapter-id.ts";
 import { canonicalJsonV3, sha256V3 } from "./canonical.ts";
 
 export type CapabilitySupportV3 = "native" | "derived" | "conditional" | "unsupported";
 
+export type AdapterDurationCapabilityV3 = "turn_duration" | "tool_duration";
+
 export type CursorExecutionModeV3 = "local" | "cloud" | "unknown";
 
 export type AdapterWaitKindV3 =
@@ -59,7 +61,7 @@ export type AdapterSignalV3 =
 export interface AdapterCapabilityProfileV3 {
   format: "harnery-v3-adapter-capabilities";
   format_version: 1;
-  adapter: Adapter;
+  adapter: EventAdapterIdV3;
   signals: Record<AdapterSignalV3, CapabilitySupportV3>;
 }
 
@@ -79,7 +81,10 @@ const SHARED_SIGNAL_SUPPORT = {
   model_identity: "conditional",
 } as const;
 
-const BASE_SIGNAL_SUPPORT: Record<Adapter, Record<BaseAdapterSignalV3, CapabilitySupportV3>> = {
+const BASE_SIGNAL_SUPPORT: Record<
+  EventAdapterIdV3,
+  Record<BaseAdapterSignalV3, CapabilitySupportV3>
+> = {
   "claude-code": {
     ...SHARED_SIGNAL_SUPPORT,
     session_end: "native",
@@ -110,11 +115,32 @@ const BASE_SIGNAL_SUPPORT: Record<Adapter, Record<BaseAdapterSignalV3, Capabilit
     post_compaction: "unsupported",
     context_usage: "conditional",
   },
+  openclaw: {
+    session_start: "conditional",
+    session_end: "native",
+    prompt: "native",
+    turn_id: "native",
+    turn_completion: "native",
+    assistant_reply_text: "unsupported",
+    tool_request: "native",
+    tool_result: "native",
+    tool_failure: "conditional",
+    tool_call_id: "native",
+    tool_duration: "unsupported",
+    permission: "unsupported",
+    subagent: "unsupported",
+    shell: "native",
+    pre_compaction: "unsupported",
+    post_compaction: "unsupported",
+    context_usage: "unsupported",
+    model_identity: "unsupported",
+  },
 };
 
 function profile(
-  adapter: Adapter,
+  adapter: EventAdapterIdV3,
   economics: Pick<Record<AdapterSignalV3, CapabilitySupportV3>, "model_usage" | "inference_timing">,
+  harnessTiming: CapabilitySupportV3 = "derived",
 ): AdapterCapabilityProfileV3 {
   return {
     format: "harnery-v3-adapter-capabilities",
@@ -123,56 +149,80 @@ function profile(
     signals: {
       ...BASE_SIGNAL_SUPPORT[adapter],
       ...economics,
-      harness_timing: "derived",
+      harness_timing: harnessTiming,
       capability_drift: "derived",
     },
   };
 }
 
-export const ADAPTER_CAPABILITY_PROFILES_V3: Record<Adapter, AdapterCapabilityProfileV3> = {
-  "claude-code": profile("claude-code", {
-    model_usage: "conditional",
-    inference_timing: "unsupported",
-  }),
-  codex: profile("codex", {
-    model_usage: "conditional",
-    inference_timing: "unsupported",
-  }),
-  cursor: profile("cursor", {
-    model_usage: "unsupported",
-    inference_timing: "unsupported",
-  }),
-};
+export const ADAPTER_CAPABILITY_PROFILES_V3: Record<EventAdapterIdV3, AdapterCapabilityProfileV3> =
+  {
+    "claude-code": profile("claude-code", {
+      model_usage: "conditional",
+      inference_timing: "unsupported",
+    }),
+    codex: profile("codex", {
+      model_usage: "conditional",
+      inference_timing: "unsupported",
+    }),
+    cursor: profile("cursor", {
+      model_usage: "unsupported",
+      inference_timing: "unsupported",
+    }),
+    openclaw: profile(
+      "openclaw",
+      {
+        model_usage: "unsupported",
+        inference_timing: "unsupported",
+      },
+      "unsupported",
+    ),
+  };
 
-export function adapterCapabilityProfileV3(adapter: Adapter): AdapterCapabilityProfileV3 {
+export function adapterCapabilityProfileV3(adapter: EventAdapterIdV3): AdapterCapabilityProfileV3 {
   return ADAPTER_CAPABILITY_PROFILES_V3[adapter];
 }
 
-export function adapterCapabilityProfileDigestV3(adapter: Adapter): `cap_${string}` {
+export function adapterCapabilityProfileDigestV3(adapter: EventAdapterIdV3): `cap_${string}` {
   return `cap_${sha256V3(canonicalJsonV3(adapterCapabilityProfileV3(adapter))).slice(7)}`;
 }
 
 export function adapterSignalSupportV3(
-  adapter: Adapter,
+  adapter: EventAdapterIdV3,
   signal: AdapterSignalV3,
 ): CapabilitySupportV3 {
   return adapterCapabilityProfileV3(adapter).signals[signal];
 }
 
+/**
+ * Duration support for terminal spans. Tool duration is part of the digested
+ * adapter profile. Turn duration predates that profile dimension, so keep its
+ * compatibility-preserving classification here until the next contract major.
+ */
+export function adapterDurationSupportV3(
+  adapter: EventAdapterIdV3,
+  capability: AdapterDurationCapabilityV3,
+): CapabilitySupportV3 {
+  if (capability === "tool_duration") {
+    return adapterSignalSupportV3(adapter, "tool_duration");
+  }
+  return adapter === "openclaw" ? "unsupported" : "derived";
+}
+
 /**
  * Adapter hooks only expose permission waits today. Other wait kinds can be
  * authored by coordination producers, but they are not observable from an
  * adapter's native turn channel.
  */
 export function adapterWaitKindSupportV3(
-  adapter: Adapter,
+  adapter: EventAdapterIdV3,
   kind: AdapterWaitKindV3,
 ): CapabilitySupportV3 {
   return kind === "permission" ? adapterSignalSupportV3(adapter, "permission") : "unsupported";
 }
 
 /** No current adapter supplies an independent completed-turn wait aggregate. */
-export function adapterTurnWaitCountSupportV3(_adapter: Adapter): CapabilitySupportV3 {
+export function adapterTurnWaitCountSupportV3(_adapter: EventAdapterIdV3): CapabilitySupportV3 {
   return "unsupported";
 }
 
@@ -182,7 +232,7 @@ export function adapterTurnWaitCountSupportV3(_adapter: Adapter): CapabilitySupp
  * never proves that an absent span means zero.
  */
 export function adapterWaitCoverageMatrixV3(
-  adapter: Adapter,
+  adapter: EventAdapterIdV3,
 ): Record<AdapterWaitKindV3, WaitKindCapabilityV3> {
   return Object.fromEntries(
     ADAPTER_WAIT_KINDS_V3.map((kind) => [

package/src/core/events/v3/capability-drift.ts

@@ -1,4 +1,4 @@
-import type { Adapter } from "../../adapter.ts";
+import type { EventAdapterIdV3 } from "./adapter-id.ts";
 import {
   type AdapterSignalV3,
   adapterSignalSupportV3,
@@ -23,7 +23,7 @@ export type CapabilityDriftPayloadV3 = EventPayloadV3<"health.capability_drift">
  * failures.
  */
 export function capabilityDriftPayloadsV3(
-  adapter: Adapter,
+  adapter: EventAdapterIdV3,
   events: readonly EventV3[],
   options: { generation_ended?: boolean } = {},
 ): CapabilityDriftPayloadV3[] {

package/src/core/events/v3/control-witness.ts

@@ -28,15 +28,23 @@ import {
 
 export { EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH };
 
-interface EventV3ControlWitnessPayload {
+/**
+ * A witness answers one question cheaply: does an authenticated record already
+ * name this exact control pair over this exact storage? Both control states get
+ * one, because a hook must never pay a whole-history parse for either.
+ *
+ * `control_state` is the discriminator, and it is authenticated with the rest of
+ * the payload. A candidate witness therefore cannot be replayed as an active
+ * one, and an active witness cannot survive its activation being removed.
+ */
+export type EventV3ControlWitnessControlStateV3 = "active" | "candidate";
+
+interface EventV3ControlWitnessPayloadCommonV3 {
   format: "harnery-event-v3-control-witness";
-  format_version: 1;
+  format_version: 2;
   genesis_id: `gex_${string}`;
-  activation_id: `act_${string}`;
   genesis_event_id: `evt_${string}`;
-  activation_event_id: `evt_${string}`;
   genesis_manifest_digest: `sha256:${string}`;
-  activation_manifest_digest: `sha256:${string}`;
   candidate_manifest_digest: `sha256:${string}`;
   privacy_key_epoch: `pep_${string}`;
   root_id: `root_${string}`;
@@ -44,6 +52,21 @@ interface EventV3ControlWitnessPayload {
   checkpoint_digest: `sha256:${string}`;
 }
 
+interface EventV3ActiveControlWitnessPayloadV3 extends EventV3ControlWitnessPayloadCommonV3 {
+  control_state: "active";
+  activation_id: `act_${string}`;
+  activation_event_id: `evt_${string}`;
+  activation_manifest_digest: `sha256:${string}`;
+}
+
+interface EventV3CandidateControlWitnessPayloadV3 extends EventV3ControlWitnessPayloadCommonV3 {
+  control_state: "candidate";
+}
+
+type EventV3ControlWitnessPayload =
+  | EventV3ActiveControlWitnessPayloadV3
+  | EventV3CandidateControlWitnessPayloadV3;
+
 interface EventV3ControlWitness {
   payload: EventV3ControlWitnessPayload;
   authentication: FingerprintV3;
@@ -55,22 +78,43 @@ export interface ActiveControlWitnessBindingV3 {
   candidate_manifest_digest: `sha256:${string}`;
 }
 
+/** The candidate equivalent: a validated genesis with no activation yet. */
+export interface CandidateControlWitnessBindingV3 {
+  genesis: CandidateGenesisManifestV3;
+  candidate_manifest_digest: `sha256:${string}`;
+}
+
 /** True only when one authenticated witness names this exact active control pair and storage. */
 export function activeControlWitnessMatchesV3(
   coordRoot: string,
   binding: ActiveControlWitnessBindingV3,
 ): boolean {
-  try {
-    const before = eventV3AuthorityStorageVersionV3(coordRoot);
-    const witness = readAuthenticatedWitnessV3(coordRoot);
-    if (!witness) return false;
-    const expected = witnessPayloadV3(binding, before, witness.payload.checkpoint_digest);
-    if (canonicalJsonV3(witness.payload) !== canonicalJsonV3(expected)) return false;
-    const after = eventV3AuthorityStorageVersionV3(coordRoot);
-    return sameStorageVersion(before, after);
-  } catch {
-    return false;
-  }
+  return witnessMatchesV3(coordRoot, "active", (storage, checkpointDigest) =>
+    activeWitnessPayloadV3(binding, storage, checkpointDigest),
+  );
+}
+
+/**
+ * True only when one authenticated witness names this exact candidate control
+ * pair and storage.
+ *
+ * A candidate epoch is not a degraded active one: its gate is narrower, but a
+ * hook still has to resolve it, and paying a whole-history parse for that
+ * answer is what made a stranded epoch cost seconds and hundreds of megabytes
+ * per process. The tamper coverage is the active witness's, unchanged: the
+ * authenticated payload names the storage version, so a corrupt append, a
+ * same-size rewrite, a changed sealed segment, and a replaced inode all miss
+ * and fall back to canonical validation. Because `control_state` is inside the
+ * authenticated payload, an active witness can never answer here and a
+ * candidate witness can never answer the active gate.
+ */
+export function candidateControlWitnessMatchesV3(
+  coordRoot: string,
+  binding: CandidateControlWitnessBindingV3,
+): boolean {
+  return witnessMatchesV3(coordRoot, "candidate", (storage, checkpointDigest) =>
+    candidateWitnessPayloadV3(binding, storage, checkpointDigest),
+  );
 }
 
 /**
@@ -83,17 +127,31 @@ export function publishActiveControlWitnessV3(
   validatedStorage: EventV3AuthorityStorageVersionV3,
   checkpoint: EventV3AppendValidationCheckpointV3,
 ): boolean {
-  try {
-    const current = eventV3AuthorityStorageVersionV3(coordRoot);
-    if (!sameStorageVersion(validatedStorage, current)) return false;
-    return publishWitnessV3(
-      coordRoot,
-      witnessPayloadV3(binding, current, checkpointDigestV3(checkpoint)),
-      checkpoint,
-    );
-  } catch {
-    return false;
-  }
+  return publishControlWitnessV3(
+    coordRoot,
+    validatedStorage,
+    checkpoint,
+    (storage, checkpointDigest) => activeWitnessPayloadV3(binding, storage, checkpointDigest),
+  );
+}
+
+/**
+ * The candidate equivalent, published on the same terms: only when the storage
+ * the caller validated is still current, and silently skipped otherwise so the
+ * next read keeps the canonical full-scan fallback.
+ */
+export function publishCandidateControlWitnessV3(
+  coordRoot: string,
+  binding: CandidateControlWitnessBindingV3,
+  validatedStorage: EventV3AuthorityStorageVersionV3,
+  checkpoint: EventV3AppendValidationCheckpointV3,
+): boolean {
+  return publishControlWitnessV3(
+    coordRoot,
+    validatedStorage,
+    checkpoint,
+    (storage, checkpointDigest) => candidateWitnessPayloadV3(binding, storage, checkpointDigest),
+  );
 }
 
 /**
@@ -155,21 +213,87 @@ export function advanceControlWitnessV3(
   }
 }
 
-function witnessPayloadV3(
+type WitnessPayloadBuilderV3 = (
+  storage: EventV3AuthorityStorageVersionV3,
+  checkpointDigest: `sha256:${string}`,
+) => EventV3ControlWitnessPayload;
+
+/**
+ * One matcher for both control states. The witness on disk must authenticate,
+ * carry the requested `control_state`, and canonicalize identically to the
+ * payload this exact binding would produce over the storage observed both
+ * before and after the read.
+ */
+function witnessMatchesV3(
+  coordRoot: string,
+  controlState: EventV3ControlWitnessControlStateV3,
+  build: WitnessPayloadBuilderV3,
+): boolean {
+  try {
+    const before = eventV3AuthorityStorageVersionV3(coordRoot);
+    const witness = readAuthenticatedWitnessV3(coordRoot);
+    if (!witness || witness.payload.control_state !== controlState) return false;
+    const expected = build(before, witness.payload.checkpoint_digest);
+    if (canonicalJsonV3(witness.payload) !== canonicalJsonV3(expected)) return false;
+    const after = eventV3AuthorityStorageVersionV3(coordRoot);
+    return sameStorageVersion(before, after);
+  } catch {
+    return false;
+  }
+}
+
+function publishControlWitnessV3(
+  coordRoot: string,
+  validatedStorage: EventV3AuthorityStorageVersionV3,
+  checkpoint: EventV3AppendValidationCheckpointV3,
+  build: WitnessPayloadBuilderV3,
+): boolean {
+  try {
+    const current = eventV3AuthorityStorageVersionV3(coordRoot);
+    if (!sameStorageVersion(validatedStorage, current)) return false;
+    return publishWitnessV3(coordRoot, build(current, checkpointDigestV3(checkpoint)), checkpoint);
+  } catch {
+    return false;
+  }
+}
+
+function activeWitnessPayloadV3(
   binding: ActiveControlWitnessBindingV3,
   storage: EventV3AuthorityStorageVersionV3,
   checkpointDigest: `sha256:${string}`,
-): EventV3ControlWitnessPayload {
+): EventV3ActiveControlWitnessPayloadV3 {
+  return {
+    ...commonWitnessPayloadV3(binding, storage, checkpointDigest),
+    control_state: "active",
+    activation_id: binding.activation.activation_id,
+    activation_event_id: binding.activation.event.event_id as `evt_${string}`,
+    activation_manifest_digest: sha256V3(canonicalJsonV3(binding.activation)),
+  };
+}
+
+function candidateWitnessPayloadV3(
+  binding: CandidateControlWitnessBindingV3,
+  storage: EventV3AuthorityStorageVersionV3,
+  checkpointDigest: `sha256:${string}`,
+): EventV3CandidateControlWitnessPayloadV3 {
+  return {
+    ...commonWitnessPayloadV3(binding, storage, checkpointDigest),
+    control_state: "candidate",
+  };
+}
+
+function commonWitnessPayloadV3(
+  binding: CandidateControlWitnessBindingV3,
+  storage: EventV3AuthorityStorageVersionV3,
+  checkpointDigest: `sha256:${string}`,
+): EventV3ControlWitnessPayloadCommonV3 {
   const scope = binding.genesis.event.scope as { root_id: `root_${string}` };
   return {
     format: "harnery-event-v3-control-witness",
-    format_version: 1,
+    format_version: 2,
     genesis_id: binding.genesis.event.payload.genesis_id as `gex_${string}`,
-    activation_id: binding.activation.activation_id,
     genesis_event_id: binding.genesis.event.event_id as `evt_${string}`,
-    activation_event_id: binding.activation.event.event_id as `evt_${string}`,
     genesis_manifest_digest: sha256V3(canonicalJsonV3(binding.genesis)),
-    activation_manifest_digest: sha256V3(canonicalJsonV3(binding.activation)),
     candidate_manifest_digest: binding.candidate_manifest_digest,
     privacy_key_epoch: binding.genesis.profile.privacy_key_epoch,
     root_id: scope.root_id,
@@ -265,12 +389,14 @@ function parseWitnessV3(value: unknown): EventV3ControlWitness {
     throw new Error("control witness envelope is invalid");
   }
   const payload = object(envelope.payload);
-  const expectedPayloadKeys = [
-    "activation_event_id",
-    "activation_id",
-    "activation_manifest_digest",
+  const controlState = payload.control_state;
+  if (controlState !== "active" && controlState !== "candidate") {
+    throw new Error("control witness control state is invalid");
+  }
+  const commonPayloadKeys = [
     "candidate_manifest_digest",
     "checkpoint_digest",
+    "control_state",
     "format",
     "format_version",
     "genesis_event_id",
@@ -280,6 +406,10 @@ function parseWitnessV3(value: unknown): EventV3ControlWitness {
     "root_id",
     "storage",
   ];
+  const expectedPayloadKeys =
+    controlState === "active"
+      ? [...commonPayloadKeys, "activation_event_id", "activation_id", "activation_manifest_digest"]
+      : commonPayloadKeys;
   if (Object.keys(payload).sort().join("\0") !== expectedPayloadKeys.sort().join("\0")) {
     throw new Error("control witness payload shape is invalid");
   }
@@ -289,13 +419,14 @@ function parseWitnessV3(value: unknown): EventV3ControlWitness {
   }
   if (
     payload.format !== "harnery-event-v3-control-witness" ||
-    payload.format_version !== 1 ||
+    payload.format_version !== 2 ||
     !token(payload.genesis_id, "gex_") ||
-    !token(payload.activation_id, "act_") ||
     !token(payload.genesis_event_id, "evt_") ||
-    !token(payload.activation_event_id, "evt_") ||
+    (controlState === "active" &&
+      (!token(payload.activation_id, "act_") ||
+        !token(payload.activation_event_id, "evt_") ||
+        !digest(payload.activation_manifest_digest))) ||
     !digest(payload.genesis_manifest_digest) ||
-    !digest(payload.activation_manifest_digest) ||
     !digest(payload.candidate_manifest_digest) ||
     !digest(payload.checkpoint_digest) ||
     !token(payload.privacy_key_epoch, "pep_") ||

package/src/core/events/v3/control.ts

@@ -3,7 +3,12 @@ import { join } from "node:path";
 import { buildEventV3 } from "./builder.ts";
 import { canonicalJsonV3, sha256V3 } from "./canonical.ts";
 import type { EventV3 } from "./contract.ts";
-import { activeControlWitnessMatchesV3, publishActiveControlWitnessV3 } from "./control-witness.ts";
+import {
+  activeControlWitnessMatchesV3,
+  candidateControlWitnessMatchesV3,
+  publishActiveControlWitnessV3,
+  publishCandidateControlWitnessV3,
+} from "./control-witness.ts";
 import { EVENT_V3_SCHEMA_DIGEST } from "./generated.ts";
 import { activationIdV3, eventIdV3, genesisIdV3 } from "./ids.ts";
 import {
@@ -275,6 +280,19 @@ export function readEventV3ControlState(coordRoot: string): EventV3ControlState
       candidate_manifest_digest: candidateDigest,
     };
   }
+  // A candidate epoch answers from its own witness on the same terms. The
+  // absent activation manifest is part of the question, so the fast path is
+  // only taken when none is published: the moment one appears, this read goes
+  // back through canonical validation and can report the repairable window.
+  if (
+    !hasActivation &&
+    candidateControlWitnessMatchesV3(coordRoot, {
+      genesis,
+      candidate_manifest_digest: candidateDigest,
+    })
+  ) {
+    return { state: "candidate", genesis, candidate_manifest_digest: candidateDigest };
+  }
   const storageBeforeValidation = eventV3AuthorityStorageVersionV3(coordRoot);
   const ledger = readControlLedger(coordRoot);
   if (!ledger.complete) {
@@ -294,7 +312,21 @@ export function readEventV3ControlState(coordRoot: string): EventV3ControlState
     if (ledger.events.some(({ event }) => event.event_type === "ledger.activated")) {
       return { state: "invalid", reason: "activation_event_without_manifest" };
     }
-    return { state: "candidate", genesis, candidate_manifest_digest: candidateDigest };
+    const candidate: Extract<EventV3ControlState, { state: "candidate" }> = {
+      state: "candidate",
+      genesis,
+      candidate_manifest_digest: candidateDigest,
+    };
+    const candidateCheckpoint = readEventV3AppendValidationCheckpointV3(coordRoot);
+    if (candidateCheckpoint) {
+      publishCandidateControlWitnessV3(
+        coordRoot,
+        candidate,
+        storageBeforeValidation,
+        candidateCheckpoint,
+      );
+    }
+    return candidate;
   }
 
   const activationResult =

package/src/core/events/v3/index.ts

@@ -1,3 +1,4 @@
+export { EVENT_ADAPTER_IDS_V3, type EventAdapterIdV3 } from "./adapter-id.ts";
 export {
   type SchemaAdvanceEligibilityV3,
   validateAdditiveSchemaAdvanceV3,
@@ -45,10 +46,12 @@ export {
   ADAPTER_CAPABILITY_PROFILES_V3,
   ADAPTER_WAIT_KINDS_V3,
   type AdapterCapabilityProfileV3,
+  type AdapterDurationCapabilityV3,
   type AdapterSignalV3,
   type AdapterWaitKindV3,
   adapterCapabilityProfileDigestV3,
   adapterCapabilityProfileV3,
+  adapterDurationSupportV3,
   adapterSignalSupportV3,
   adapterWaitCoverageMatrixV3,
   adapterWaitKindSupportV3,

package/src/core/events/v3/live-feed.ts

@@ -121,23 +121,40 @@ export function tryWriteLiveDisplayV3(
   }
 }
 
-/** Return every unexpired live-display row across generations. */
+/**
+ * Return every unexpired live-display row across generations.
+ *
+ * A generation file whose last write is older than the hard TTL cannot hold a
+ * live row, so it is skipped on the stat alone. Without that guard a directory
+ * that has not been swept turns every read into a parse of days of residue.
+ */
 export function listLiveDisplayV3(
   coordRoot: string,
   now: () => Date = () => new Date(),
 ): LiveDisplayRowV3[] {
   const root = liveRoot(coordRoot);
   if (!existsSync(root)) return [];
+  const nowMs = now().getTime();
   const rows: LiveDisplayRowV3[] = [];
   for (const name of readdirSync(root)) {
     if (!name.endsWith(".ndjson")) continue;
     const generationId = name.slice(0, -".ndjson".length);
     if (!GENERATION_PATTERN.test(generationId)) continue;
+    if (fileHardExpiredV3(join(root, name), nowMs)) continue;
     rows.push(...readLiveDisplayV3(coordRoot, generationId, now));
   }
   return rows;
 }
 
+/** True when the file's last write predates the hard TTL; a missing file counts as expired. */
+function fileHardExpiredV3(path: string, nowMs: number): boolean {
+  try {
+    return statSync(path).mtimeMs + HARD_MAX_TTL_MS <= nowMs;
+  } catch {
+    return true;
+  }
+}
+
 /** Return only unexpired, structurally valid rows. Expiry is enforced before cleanup. */
 export function readLiveDisplayV3(
   coordRoot: string,
@@ -180,10 +197,11 @@ export function janitorLiveDisplayV3(
     if (!name.endsWith(".ndjson")) continue;
     scanned += 1;
     const path = join(root, basename(name));
-    const visible = GENERATION_PATTERN.test(name.slice(0, -".ndjson".length))
-      ? readLiveDisplayV3(coordRoot, name.slice(0, -".ndjson".length), now)
-      : [];
-    const hardExpired = statSync(path).mtimeMs + HARD_MAX_TTL_MS <= nowMs;
+    const hardExpired = fileHardExpiredV3(path, nowMs);
+    const visible =
+      !hardExpired && GENERATION_PATTERN.test(name.slice(0, -".ndjson".length))
+        ? readLiveDisplayV3(coordRoot, name.slice(0, -".ndjson".length), now)
+        : [];
     if (visible.length === 0 || hardExpired) {
       rmSync(path, { force: true });
       removed += 1;

package/src/core/events/v3/live-routing.ts

@@ -1,6 +1,10 @@
 import type { Adapter } from "../../adapter.ts";
 import type { ParsedPayload } from "../../hooks/adapter/parse.ts";
-import { refreshIncompatibleEventLedgerV3, rotateOversizedEventLedgerV3 } from "./bootstrap.ts";
+import {
+  refreshIncompatibleEventLedgerV3,
+  repairStrandedEventLedgerV3Candidate,
+  rotateOversizedEventLedgerV3,
+} from "./bootstrap.ts";
 import type { EventV3 } from "./contract.ts";
 import { readEventV3ControlState } from "./control.ts";
 import { repairEventV3ControlPair } from "./control-writer.ts";
@@ -54,7 +58,15 @@ export function resolveLiveEventLedgerRouteV3(coordRoot: string): LiveEventLedge
       };
     }
   }
-  if (control.state === "active") {
+  if (control.state === "candidate") {
+    // An epoch is created and activated as one locked step, so a candidate on
+    // this boundary is a stranded epoch: a crashed or failed activation that
+    // every later hook would otherwise keep serving with a candidate-only
+    // write gate. Finish it here. A live bootstrap lease or any other refusal
+    // leaves the candidate serving and the next boundary retries.
+    control = repairStrandedEventLedgerV3Candidate(coordRoot).control;
+  }
+  if (control.state === "active" || control.state === "candidate") {
     // Bound the epoch every producer must re-validate: an oversized active
     // segment rotates into the archive here, on the shared route boundary.
     // Rotation failure never blocks recording; the current epoch stays live.