hikoutei 0.8.1 → 0.8.2

package/dist/application/sync/service/serviceOptions.js

@@ -15,7 +15,6 @@ import { randomUUID } from "node:crypto";
 import { GOOGLE_SHEETS_API_DEFAULTS } from "../../../adapter/sheets/providers/google-sheets-api/constants.js";
 import { DEFAULT_EFFECT_LEASE_DURATION_MS, DEFAULT_WRITER_LEASE_DURATION_MS, EFFECT_LEASE_PROVIDER_HEADROOM_MS, } from "@hikoutei/ikisaki";
 import { SYNC_SERVICE_ERROR_CODES, SyncServiceError, } from "./errors.js";
-import { internalPositiveSafeIntegerSchema, internalSyncRouteSchema, internalSyncTextSchema, } from "./serviceOptionSchemas.js";
 /**
  * Maps a structured descriptor-registry failure to the internal
  * `SyncServiceError` contract with unchanged `INVALID_OPTIONS` messages.
@@ -31,16 +30,16 @@ export function throwSyncResolutionError(failure) {
     }
 }
 export function validateServiceOptions(options, descriptors) {
-    if (!internalSyncTextSchema.safeParse(options.dbName).success) {
+    if (options.dbName.trim() === "") {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service dbName is required.");
     }
     validateEffectLeaseHeadroom(options);
     if (options.pollingFullScanIntervalMs !== undefined &&
-        !internalPositiveSafeIntegerSchema.safeParse(options.pollingFullScanIntervalMs).success) {
+        (!Number.isSafeInteger(options.pollingFullScanIntervalMs) || options.pollingFullScanIntervalMs < 1)) {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service pollingFullScanIntervalMs must be a positive safe integer.");
     }
     if (options.reconciliationIntervalMs !== undefined &&
-        !internalPositiveSafeIntegerSchema.safeParse(options.reconciliationIntervalMs).success) {
+        (!Number.isSafeInteger(options.reconciliationIntervalMs) || options.reconciliationIntervalMs < 1)) {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service reconciliationIntervalMs must be a positive safe integer.");
     }
     requireText(options.projections.spreadsheetId, "sync service spreadsheetId");
@@ -72,7 +71,8 @@ export function validateServiceOptions(options, descriptors) {
 }
 function validateEffectLeaseHeadroom(options) {
     const effectLeaseDurationMs = options.effectLeaseDurationMs ?? DEFAULT_EFFECT_LEASE_DURATION_MS;
-    if (!internalPositiveSafeIntegerSchema.safeParse(effectLeaseDurationMs).success) {
+    if (!Number.isSafeInteger(effectLeaseDurationMs) ||
+        effectLeaseDurationMs < 1) {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service effectLeaseDurationMs must be a positive safe integer.");
     }
     if (effectLeaseDurationMs >= DEFAULT_WRITER_LEASE_DURATION_MS) {
@@ -92,10 +92,17 @@ function validateEffectLeaseHeadroom(options) {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service googleSheetsApi requestTimeoutMs must be between 1 second and 120 seconds.");
     }
     // A direct-mode dispatch performs up to THREE sequential paced transport
-    // calls (two preflight reads plus one write), each with its own timeout;
-    // the lease must cover the whole sequence, so the headroom check sums
-    // the write timeout and two read timeouts. Defaults: 60 + 2x10 + 30 =
-    // 110 s, inside the 120 s default effect lease.
+    // calls (two preflight/postcondition reads plus one write), each with its
+    // own timeout; the lease must cover the whole sequence. The request-start
+    // limiter keeps consecutive starts at least `intervalMs` apart, and a
+    // dispatch can wait up to one FULL interval for its first slot because
+    // the shared limiter may hold a prior reservation, so the paced worst
+    // case is the write timeout plus ONE interval (the first-slot wait) plus
+    // TWO more slots of the LARGER of the read timeout and the interval (a
+    // read duration covers its own interval wait when it is the larger term,
+    // and the interval covers it when it is not; the two never add on top of
+    // each other). Defaults with the 2,500 ms interval: 60 + 2.5 + 2x10 + 30
+    // = 112.5 s, inside the 120 s default effect lease.
     const readTimeoutMs = options.googleSheetsApi.readTimeoutMs
         ?? GOOGLE_SHEETS_API_DEFAULTS.READ_TIMEOUT_MS;
     if (!Number.isSafeInteger(readTimeoutMs) ||
@@ -103,9 +110,16 @@ function validateEffectLeaseHeadroom(options) {
         readTimeoutMs > GOOGLE_SHEETS_API_DEFAULTS.MAX_READ_TIMEOUT_MS) {
         throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service googleSheetsApi readTimeoutMs must be between 1 second and 60 seconds.");
     }
-    if (effectLeaseDurationMs <= requestTimeoutMs + 2 * readTimeoutMs +
+    const intervalMs = options.googleSheetsApi.rateLimitIntervalMs
+        ?? GOOGLE_SHEETS_API_DEFAULTS.REQUEST_START_INTERVAL_MS;
+    if (!Number.isSafeInteger(intervalMs) || intervalMs < 0) {
+        throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service googleSheetsApi rateLimitIntervalMs must be a non-negative safe integer.");
+    }
+    if (effectLeaseDurationMs <= requestTimeoutMs +
+        intervalMs +
+        2 * Math.max(readTimeoutMs, intervalMs) +
         EFFECT_LEASE_PROVIDER_HEADROOM_MS) {
-        throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service effectLeaseDurationMs must exceed Google Sheets API requestTimeoutMs plus two read timeouts by 30 seconds before supervisors start.");
+        throw new SyncServiceError(SYNC_SERVICE_ERROR_CODES.INVALID_OPTIONS, "sync service effectLeaseDurationMs must exceed Google Sheets API requestTimeoutMs plus the request-start interval and two paced request slots (the larger of readTimeoutMs and the request-start interval) by 30 seconds before supervisors start.");
     }
 }
 function validateEntityConfig(entityName, descriptor, config, routes, spreadsheetId) {
@@ -130,12 +144,8 @@ function validateRoute(entityName, projection, route) {
     if (route === null || typeof route !== "object") {
         throwInvalidProjection(`sync route ${entityName}.${projection} must be an object.`);
     }
-    const parsed = internalSyncRouteSchema.safeParse(route);
-    if (!parsed.success) {
-        const candidate = route;
-        requireText(candidate.tabName, `sync route ${entityName}.${projection}.tabName`);
-        requireText(candidate.registeredRange, `sync route ${entityName}.${projection}.registeredRange`);
-    }
+    requireText(route.tabName, `sync route ${entityName}.${projection}.tabName`);
+    requireText(route.registeredRange, `sync route ${entityName}.${projection}.registeredRange`);
 }
 function addRoute(routes, spreadsheetId, tabName, entityName, projection) {
     const key = JSON.stringify([spreadsheetId, tabName.trim()]);
@@ -151,7 +161,7 @@ export function createWriterOptions(options) {
     };
 }
 function requireText(value, label) {
-    if (!internalSyncTextSchema.safeParse(value).success) {
+    if (typeof value !== "string" || value.trim() === "") {
         throwInvalidProjection(`${label} must be a non-empty string.`);
     }
 }

package/dist/application/sync/service/serviceOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceOptions.js","sourceRoot":"","sources":["../../../../src/application/sync/service/serviceOptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,iCAAiC,GAGlC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAmEnC;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA0C;IAE1C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,6EAA6E,CAC9E,CAAC;QACJ,KAAK,gBAAgB;YACnB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,wBAAwB,OAAO,CAAC,UAAU,iCAAiC,CAC5E,CAAC;QACJ,KAAK,iBAAiB;YACpB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,uBAAuB,OAAO,CAAC,SAAS,mBAAmB,OAAO,CAAC,eAAe,UAAU,OAAO,CAAC,gBAAgB,IAAI,CACzH,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAmC,EACnC,WAAkE;IAElE,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC3G,CAAC;IACD,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,IACE,OAAO,CAAC,yBAAyB,KAAK,SAAS;QAC/C,CAAC,iCAAiC,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,OAAO,EACvF,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,wBAAwB,KAAK,SAAS;QAC9C,CAAC,iCAAiC,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,OAAO,EACtF,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;IAC7E,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,sBAAsB,CAAC,yCAAyC,UAAU,IAAI,CAAC,CAAC;QAClF,CAAC;QACD,oBAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,sBAAsB,CAAC,+CAA+C,UAAU,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,oBAAoB,EAC7C,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAmC;IACtE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,IAAI,CAAC,iCAAiC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC;QAChF,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,IAAI,gCAAgC,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO;IAElD,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,gBAAgB;WAC5D,0BAA0B,CAAC,kBAAkB,CAAC;IACnD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACvC,gBAAgB,GAAG,0BAA0B,CAAC,sBAAsB;QACpE,gBAAgB,GAAG,0BAA0B,CAAC,sBAAsB,EACpE,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,aAAa;WACtD,0BAA0B,CAAC,eAAe,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,GAAG,0BAA0B,CAAC,sBAAsB;QACjE,aAAa,GAAG,0BAA0B,CAAC,mBAAmB,EAC9D,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IACE,qBAAqB,IAAI,gBAAgB,GAAG,CAAC,GAAG,aAAa;QAC3D,iCAAiC,EACnC,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,kJAAkJ,CACnJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,UAA4C,EAC5C,MAAgC,EAChC,MAAmB,EACnB,aAAqB;IAErB,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACvF,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvE,sBAAsB,CAAC,mDAAmD,UAAU,IAAI,KAAK,IAAI,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtG,sBAAsB,CACpB,mBAAmB,UAAU,2BAA2B,UAAU,CAAC,UAAU,IAAI,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB,EAAE,KAAqE;IAClI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,cAAc,UAAU,IAAI,UAAU,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,KAA2C,CAAC;QAC9D,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,UAAU,IAAI,UAAU,UAAU,CAAC,CAAC;QACjF,WAAW,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,UAAU,IAAI,UAAU,kBAAkB,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,MAAmB,EACnB,aAAqB,EACrB,OAAe,EACf,UAAkB,EAClB,UAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,sBAAsB,CAAC,cAAc,UAAU,IAAI,UAAU,sBAAsB,OAAO,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB,UAAU,EAAE,EAAE;QAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,sBAAsB,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAC1F,CAAC"}
+{"version":3,"file":"serviceOptions.js","sourceRoot":"","sources":["../../../../src/application/sync/service/serviceOptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,iCAAiC,GAGlC,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAmErB;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA0C;IAE1C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,6EAA6E,CAC9E,CAAC;QACJ,KAAK,gBAAgB;YACnB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,wBAAwB,OAAO,CAAC,UAAU,iCAAiC,CAC5E,CAAC;QACJ,KAAK,iBAAiB;YACpB,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,uBAAuB,OAAO,CAAC,SAAS,mBAAmB,OAAO,CAAC,eAAe,UAAU,OAAO,CAAC,gBAAgB,IAAI,CACzH,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAmC,EACnC,WAAkE;IAElE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC3G,CAAC;IACD,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,IACE,OAAO,CAAC,yBAAyB,KAAK,SAAS;QAC/C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,yBAAyB,GAAG,CAAC,CAAC,EACnG,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,wBAAwB,KAAK,SAAS;QAC9C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,wBAAwB,GAAG,CAAC,CAAC,EACjG,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;IAC7E,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,sBAAsB,CAAC,yCAAyC,UAAU,IAAI,CAAC,CAAC;QAClF,CAAC;QACD,oBAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,sBAAsB,CAAC,+CAA+C,UAAU,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,oBAAoB,EAC7C,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAmC;IACtE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC;QAC5C,qBAAqB,GAAG,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,IAAI,gCAAgC,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO;IAElD,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,gBAAgB;WAC5D,0BAA0B,CAAC,kBAAkB,CAAC;IACnD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACvC,gBAAgB,GAAG,0BAA0B,CAAC,sBAAsB;QACpE,gBAAgB,GAAG,0BAA0B,CAAC,sBAAsB,EACpE,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,aAAa;WACtD,0BAA0B,CAAC,eAAe,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,GAAG,0BAA0B,CAAC,sBAAsB;QACjE,aAAa,GAAG,0BAA0B,CAAC,mBAAmB,EAC9D,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,mBAAmB;WACzD,0BAA0B,CAAC,yBAAyB,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IACE,qBAAqB,IAAI,gBAAgB;QACvC,UAAU;QACV,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC;QACvC,iCAAiC,EACnC,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,CAAC,eAAe,EACxC,oPAAoP,CACrP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,UAA4C,EAC5C,MAAgC,EAChC,MAAmB,EACnB,aAAqB;IAErB,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACvF,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvE,sBAAsB,CAAC,mDAAmD,UAAU,IAAI,KAAK,IAAI,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtG,sBAAsB,CACpB,mBAAmB,UAAU,2BAA2B,UAAU,CAAC,UAAU,IAAI,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB,EAAE,KAAqE;IAClI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,cAAc,UAAU,IAAI,UAAU,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,UAAU,IAAI,UAAU,UAAU,CAAC,CAAC;IAC7E,WAAW,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,UAAU,IAAI,UAAU,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,QAAQ,CACf,MAAmB,EACnB,aAAqB,EACrB,OAAe,EACf,UAAkB,EAClB,UAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,sBAAsB,CAAC,cAAc,UAAU,IAAI,UAAU,sBAAsB,OAAO,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB,UAAU,EAAE,EAAE;QAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,sBAAsB,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAC1F,CAAC"}

package/dist/application/sync/service/shutdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../../../src/application/sync/service/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAML,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,8BAA8B,EACtC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;IAChF,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAqCpF"}
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../../../src/application/sync/service/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mFAAmF,CAAC;AAC/H,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,0FAA0F,CAAC;AAC7I,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,8BAA8B,EACtC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;IAChF,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAqCpF"}

package/dist/application/sync/service/shutdown.js

@@ -7,8 +7,9 @@
  * releases mirrored from every claim site wired into the bootstrap.
  */
 import { DEFAULT_MAPPED_WRITER_ROLE, } from "../../orm/persistence/support/contracts.js";
-import { DEFAULT_WORKER_ROLE, LOOKUP_RESULT_KINDS, readWriterLeaseWithAdapter, releaseWriterLeaseWithAdapter, safeErrorMessage, } from "@hikoutei/ikisaki";
+import { DEFAULT_WORKER_ROLE, LOOKUP_RESULT_KINDS, readWriterLeaseWithAdapter, releaseWriterLeaseWithAdapter, } from "@hikoutei/ikisaki";
 import { RECONCILIATION_DEFAULTS } from "../outbound/reconciliation/ReconciliationScanner.js";
+import { stableConsoleErrorTag } from "../../../shared/observability/internalLog.js";
 /**
  * Expires this runtime's own writer leases on graceful shutdown.
  *
@@ -58,7 +59,10 @@ export async function expireRuntimeWriterLeases(storage, writer, effectWorkerId)
             }
         }
         catch (error) {
-            console.warn(`[sync-service] writer lease release failed for role "${role}": ${safeErrorMessage(error)}`);
+            // Default console diagnostics emit only the stable allowlisted
+            // class/code tag — never the raw message, which can embed provider
+            // payload fragments, spreadsheet IDs, emails, or paths.
+            console.warn(`[sync-service] writer lease release failed for role "${role}": ${stableConsoleErrorTag(error)}`);
         }
     }
 }

package/dist/application/sync/service/shutdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../../../src/application/sync/service/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,0BAA0B,GAE3B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAI9F;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA8B,EAC9B,MAAsC,EACtC,cAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,mEAAmE;IACnE,6EAA6E;IAC7E,6EAA6E;IAC7E,mGAAmG;IACnG,qEAAqE;IACrE,qEAAqE;IACrE,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,SAAS,GAAwE;QACrF,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC/D,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE;QACvD,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE,IAAI,EAAE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;KAClE,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClF,iEAAiE;gBACjE,uCAAuC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,OAAO,EAAE;gBAC5D,IAAI;gBACJ,QAAQ;gBACR,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;gBACtC,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,wDAAwD,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CACV,wDAAwD,IAAI,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAEvF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAsC,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAkB,EAAE;QAC/B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QAClD,uEAAuE;QACvE,8DAA8D;QAC9D,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,mEAAmE;gBACnE,mDAAmD;gBACnD,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC;qBAC7D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../../../src/application/sync/service/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,0BAA0B,GAE3B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,GAE9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAIrF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA8B,EAC9B,MAAsC,EACtC,cAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,mEAAmE;IACnE,6EAA6E;IAC7E,6EAA6E;IAC7E,mGAAmG;IACnG,qEAAqE;IACrE,qEAAqE;IACrE,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,SAAS,GAAwE;QACrF,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC/D,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE;QACvD,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE,IAAI,EAAE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;KAClE,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClF,iEAAiE;gBACjE,uCAAuC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,OAAO,EAAE;gBAC5D,IAAI;gBACJ,QAAQ;gBACR,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;gBACtC,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,wDAAwD,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,+DAA+D;YAC/D,mEAAmE;YACnE,wDAAwD;YACxD,OAAO,CAAC,IAAI,CACV,wDAAwD,IAAI,MAAM,qBAAqB,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IAEvF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAsC,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAkB,EAAE;QAC/B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QAClD,uEAAuE;QACvE,8DAA8D;QAC9D,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,mEAAmE;gBACnE,mDAAmD;gBACnD,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC;qBAC7D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/application/sync/service/syncAutoStart.d.ts

@@ -3,11 +3,11 @@
  *
  * This internal module owns the mapping from environment variables to the
  * sync service bootstrap: spreadsheet URL parsing, service-account credentials
- * file validation, polling interval parsing, projection auto-generation from
- * entity descriptors, and fail-closed startup failure classification. It is
- * never re-exported from `src/index.ts`; the public factory calls it only when
- * `HIKOUTEI_SYNC_SPREADSHEET_URL` is set, so local-only users never load the
- * sync module graph.
+ * file validation, polling interval parsing, request-start pacing override
+ * parsing, projection auto-generation from entity descriptors, and fail-closed
+ * startup failure classification. It is never re-exported from `src/index.ts`;
+ * the public factory calls it only when `HIKOUTEI_SYNC_SPREADSHEET_URL` is
+ * set, so local-only users never load the sync module graph.
  *
  * The env reader, transport, and diagnostic sink are injectable so tests can
  * exercise every startup branch with a stub transport, a fake env, and a
@@ -35,14 +35,46 @@ export declare const SYNC_ENV_KEYS: {
     readonly POLLING_INTERVAL_MS: "HIKOUTEI_SYNC_POLLING_INTERVAL_MS";
     /** Optional metadata safety full-scan cadence in ms; defaults to 60 seconds. */
     readonly FULL_SCAN_INTERVAL_MS: "HIKOUTEI_SYNC_FULL_SCAN_INTERVAL_MS";
+    /**
+     * Optional request-start pacing in ms for the direct provider's ONE shared
+     * read+write limiter; absent uses the safe default (2,500 ms). Internal
+     * only — never part of the root public API.
+     */
+    readonly RATE_LIMIT_INTERVAL_MS: "HIKOUTEI_SYNC_RATE_LIMIT_INTERVAL_MS";
 };
 /** Default polling cadence applied when the interval env vars are absent. */
 export declare const DEFAULT_SYNC_POLLING_INTERVAL_MS = 60000;
 /** Default safety full-scan cadence applied when the interval env vars are absent. */
 export declare const DEFAULT_SYNC_FULL_SCAN_INTERVAL_MS = 60000;
+/** Lower bound for the sync request-start pacing env override (1 second). */
+export declare const MIN_SYNC_RATE_LIMIT_INTERVAL_MS = 1000;
+/**
+ * Upper bound for the sync request-start pacing env override.
+ *
+ * A worst-case effect dispatch performs THREE sequential paced transport
+ * calls (two preflight/postcondition reads plus one batch write). The effect
+ * lease must still cover the whole sequence with the 30-second provider
+ * headroom, and a dispatch can wait up to one FULL interval for its first
+ * slot because the shared limiter may hold a prior reservation — admission
+ * is BOUNDED to one interval, so a request whose slot lies further out is
+ * refused before any SDK call (delivery-uncertain, requeued durably)
+ * instead of waiting past the lease. With the DEFAULT lease, write timeout,
+ * and read timeout the interval must satisfy
+ * `120s > 60s + I + 2 * max(10s, I) + 30s`, i.e. `I < 10s`. Below
+ * the 10 s read timeout the two read slots cost 2 x 10 s and the interval
+ * adds once, so the bound is `I < 120 - 60 - 2x10 - 30 = 10 s`; at or
+ * above the read timeout the interval dominates (`3I < 30s` has no
+ * solution at or above 10 s), so the below-read-slot branch is binding.
+ * The ceiling below is derived from those defaults (10,000 - 1 = 9,999 ms)
+ * and the service-level lease-headroom validation applies the same math to
+ * the ACTIVE lease and timeouts, so an override that could let pacing push
+ * a dispatch past the lease is rejected with a stable startup failure
+ * instead of risking lease expiry and duplicate remote delivery.
+ */
+export declare const MAX_SYNC_RATE_LIMIT_INTERVAL_MS: number;
 /** Diagnostic log levels emitted by the auto-start bridge. */
 export type SyncDiagnosticLevel = "info" | "error";
-/** Diagnostic sink; defaults to console. Never receives secrets or full URLs. */
+/** Diagnostic sink; defaults to console. Receives only stable class/code summaries, never full failure messages. */
 export type SyncDiagnostic = (level: SyncDiagnosticLevel, message: string) => void;
 /** Internal auto-start options; none are part of the root application contract. */
 export interface SyncAutoStartOptions {
@@ -125,4 +157,37 @@ export declare function buildSyncProjections(entities: readonly HikouteiEntity[]
  * else (timeout, network, invalid options) maps to the generic startup code.
  */
 export declare function classifySyncStartupFailure(error: unknown, spreadsheetId: string, clientEmail: string): HikouteiError;
+/**
+ * Resolves the sync request-start pacing env override, or undefined.
+ *
+ * `HIKOUTEI_SYNC_RATE_LIMIT_INTERVAL_MS` is the internal override for the
+ * direct provider's ONE shared read+write request-start limiter. Absent or
+ * blank means the provider's safe default (2,500 ms) applies; a present
+ * value must be a plain decimal integer between 1,000 ms and
+ * `MAX_SYNC_RATE_LIMIT_INTERVAL_MS` (~10 s). The ceiling is the largest
+ * interval whose worst-case three-request paced dispatch still finishes
+ * inside the default effect lease (120 s) with the default write timeout
+ * (60 s), read timeout (10 s), and provider headroom (30 s): a dispatch
+ * can wait up to one full interval for its first slot because the shared
+ * limiter may hold a prior reservation, so the strict default-safe bound
+ * is `120s > 60s + I + 2 * max(10s, I) + 30s` and a larger interval could
+ * let pacing push the dispatch past the lease and risk duplicate remote
+ * delivery. Values outside those bounds (including hex,
+ * exponent, signed, padded, fractional, and non-numeric forms) fail closed
+ * with the stable startup code so a mistyped override can never silently
+ * drop pacing to a burst or outlive the effect lease. The key stays internal
+ * and is never part of the root public API.
+ */
+export declare function resolveSyncRateLimitIntervalMs(env: Readonly<Record<string, string | undefined>>): number | undefined;
+/**
+ * Stable redacted startup summary for diagnostic sinks: class and code
+ * only, each checked against the shared stable allowlists.
+ *
+ * `failure.name` and `failure.code` are runtime strings that could carry
+ * secret-like text (paths, emails, tokens) if an unexpected error shape
+ * ever reached the sink path, so unknown or malformed values collapse to
+ * the fixed `unknown` class/code. The full public message is carried by
+ * the thrown HikouteiError alone and never reaches any sink.
+ */
+export declare function stableStartupDiagnostic(failure: HikouteiError): string;
 //# sourceMappingURL=syncAutoStart.d.ts.map

package/dist/application/sync/service/syncAutoStart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncAutoStart.d.ts","sourceRoot":"","sources":["../../../../src/application/sync/service/syncAutoStart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,aAAa,EACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAU7G,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAMnC,uDAAuD;AACvD,eAAO,MAAM,aAAa;IACxB,sEAAsE;;IAEtE,0DAA0D;;IAE1D,yEAAyE;;IAEzE,gFAAgF;;CAExE,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEnD,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAEnF,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAC9C,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;CACxC;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;AAQ1F;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAczE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CA6DpC;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,aAAa,EAAE,MAAM,GACpB,4BAA4B,CAuB9B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,aAAa,CA8Cf"}
+{"version":3,"file":"syncAutoStart.d.ts","sourceRoot":"","sources":["../../../../src/application/sync/service/syncAutoStart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,aAAa,EACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AA2B7G,OAAO,KAAK,EAEV,4BAA4B,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,uDAAuD;AACvD,eAAO,MAAM,aAAa;IACxB,sEAAsE;;IAEtE,0DAA0D;;IAE1D,yEAAyE;;IAEzE,gFAAgF;;IAEhF;;;;OAIG;;CAEK,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AACrD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,+BAA+B,QAQ3C,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEnD,oHAAoH;AACpH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAEnF,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAC9C,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;CACxC;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,gFAAgF;AAChF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;AAQ1F;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAczE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAmFpC;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAgD3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,aAAa,EAAE,MAAM,GACpB,4BAA4B,CAuB9B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,aAAa,CA8Cf;AA8BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,MAAM,GAAG,SAAS,CAuBpB;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAStE"}

package/dist/application/sync/service/syncAutoStart.js

@@ -3,11 +3,11 @@
  *
  * This internal module owns the mapping from environment variables to the
  * sync service bootstrap: spreadsheet URL parsing, service-account credentials
- * file validation, polling interval parsing, projection auto-generation from
- * entity descriptors, and fail-closed startup failure classification. It is
- * never re-exported from `src/index.ts`; the public factory calls it only when
- * `HIKOUTEI_SYNC_SPREADSHEET_URL` is set, so local-only users never load the
- * sync module graph.
+ * file validation, polling interval parsing, request-start pacing override
+ * parsing, projection auto-generation from entity descriptors, and fail-closed
+ * startup failure classification. It is never re-exported from `src/index.ts`;
+ * the public factory calls it only when `HIKOUTEI_SYNC_SPREADSHEET_URL` is
+ * set, so local-only users never load the sync module graph.
  *
  * The env reader, transport, and diagnostic sink are injectable so tests can
  * exercise every startup branch with a stub transport, a fake env, and a
@@ -20,17 +20,19 @@
  * failure never leaves a half-open runtime behind.
  */
 import { readFile } from "node:fs/promises";
-import { z } from "zod";
 import { getEntityDescriptor, } from "../../../api/entity.js";
 import { createLocalTypedSheetsRuntime, validateTypedSheetsOptions, } from "../../../api/Hikoutei.js";
 import { HIKOUTEI_ERROR_CODES, HikouteiError, } from "../../../api/errors.js";
 import { GoogleSheetsApiTransportError, } from "../../../adapter/sheets/providers/google-sheets-api/errors.js";
 import { columnLetters } from "../../../adapter/sheets/providers/google-sheets-api/model/valueNormalization.js";
+import { GOOGLE_SHEETS_API_DEFAULTS, } from "../../../adapter/sheets/providers/google-sheets-api/constants.js";
 import { PRESENCE_KINDS } from "../../../shared/state/index.js";
+import { DEFAULT_EFFECT_LEASE_DURATION_MS, EFFECT_LEASE_PROVIDER_HEADROOM_MS, } from "@hikoutei/ikisaki";
 import { SYNC_CONFLICT_PROJECTION_REGISTERED_RANGE, } from "../sheetsContract/conflictProjection.js";
 import { SyncSheetsContractError } from "../sheetsContract/errors.js";
+import { describeErrorForInternalLog, logHikouteiInternalEvent, } from "../../../shared/observability/internalLog.js";
+import { HIKOUTEI_LOG_COMPONENTS, HIKOUTEI_LOG_EVENTS, HIKOUTEI_LOG_STABLE_CLASSES, HIKOUTEI_LOG_STABLE_CODES, } from "../../../shared/observability/logEvents.js";
 import { createInternalSyncService, } from "./SyncServiceBootstrap.js";
-import { positiveDecimalMillisecondsSchema, syncCredentialsSchema, } from "./configSchemas.js";
 /** Env keys consumed by the sync auto-start bridge. */
 export const SYNC_ENV_KEYS = {
     /** Spreadsheet URL; absent means sync stays disabled (local-only). */
@@ -41,11 +43,46 @@ export const SYNC_ENV_KEYS = {
     POLLING_INTERVAL_MS: "HIKOUTEI_SYNC_POLLING_INTERVAL_MS",
     /** Optional metadata safety full-scan cadence in ms; defaults to 60 seconds. */
     FULL_SCAN_INTERVAL_MS: "HIKOUTEI_SYNC_FULL_SCAN_INTERVAL_MS",
+    /**
+     * Optional request-start pacing in ms for the direct provider's ONE shared
+     * read+write limiter; absent uses the safe default (2,500 ms). Internal
+     * only — never part of the root public API.
+     */
+    RATE_LIMIT_INTERVAL_MS: "HIKOUTEI_SYNC_RATE_LIMIT_INTERVAL_MS",
 };
 /** Default polling cadence applied when the interval env vars are absent. */
 export const DEFAULT_SYNC_POLLING_INTERVAL_MS = 60_000;
 /** Default safety full-scan cadence applied when the interval env vars are absent. */
 export const DEFAULT_SYNC_FULL_SCAN_INTERVAL_MS = 60_000;
+/** Lower bound for the sync request-start pacing env override (1 second). */
+export const MIN_SYNC_RATE_LIMIT_INTERVAL_MS = 1_000;
+/**
+ * Upper bound for the sync request-start pacing env override.
+ *
+ * A worst-case effect dispatch performs THREE sequential paced transport
+ * calls (two preflight/postcondition reads plus one batch write). The effect
+ * lease must still cover the whole sequence with the 30-second provider
+ * headroom, and a dispatch can wait up to one FULL interval for its first
+ * slot because the shared limiter may hold a prior reservation — admission
+ * is BOUNDED to one interval, so a request whose slot lies further out is
+ * refused before any SDK call (delivery-uncertain, requeued durably)
+ * instead of waiting past the lease. With the DEFAULT lease, write timeout,
+ * and read timeout the interval must satisfy
+ * `120s > 60s + I + 2 * max(10s, I) + 30s`, i.e. `I < 10s`. Below
+ * the 10 s read timeout the two read slots cost 2 x 10 s and the interval
+ * adds once, so the bound is `I < 120 - 60 - 2x10 - 30 = 10 s`; at or
+ * above the read timeout the interval dominates (`3I < 30s` has no
+ * solution at or above 10 s), so the below-read-slot branch is binding.
+ * The ceiling below is derived from those defaults (10,000 - 1 = 9,999 ms)
+ * and the service-level lease-headroom validation applies the same math to
+ * the ACTIVE lease and timeouts, so an override that could let pacing push
+ * a dispatch past the lease is rejected with a stable startup failure
+ * instead of risking lease expiry and duplicate remote delivery.
+ */
+export const MAX_SYNC_RATE_LIMIT_INTERVAL_MS = Math.max(MIN_SYNC_RATE_LIMIT_INTERVAL_MS, Math.floor(DEFAULT_EFFECT_LEASE_DURATION_MS -
+    GOOGLE_SHEETS_API_DEFAULTS.REQUEST_TIMEOUT_MS -
+    EFFECT_LEASE_PROVIDER_HEADROOM_MS -
+    2 * GOOGLE_SHEETS_API_DEFAULTS.READ_TIMEOUT_MS) - 1);
 /** Required service-account fields validated before any remote contact. */
 const REQUIRED_CREDENTIAL_FIELDS = ["type", "client_email", "private_key"];
 const SPREADSHEET_PATH_SEGMENT = "d";
@@ -112,20 +149,42 @@ export async function createTypedSheetsWithSync(options) {
         ({ clientEmail } = await validateSyncCredentialsFile(env[SYNC_ENV_KEYS.CREDENTIALS_FILE]));
         const pollingIntervalMs = parseIntervalEnv(env, SYNC_ENV_KEYS.POLLING_INTERVAL_MS, DEFAULT_SYNC_POLLING_INTERVAL_MS);
         const pollingFullScanIntervalMs = parseIntervalEnv(env, SYNC_ENV_KEYS.FULL_SCAN_INTERVAL_MS, DEFAULT_SYNC_FULL_SCAN_INTERVAL_MS);
+        // The pacing env override applies ONLY to the real Google Sheets
+        // provider: it is resolved and validated only when no fake transport is
+        // injected, so local/fake suites stay immune to a misconfigured or
+        // invalid override in the host env.
+        const rateLimitIntervalMs = options.transport === undefined
+            ? resolveSyncRateLimitIntervalMs(env)
+            : undefined;
         const projections = buildSyncProjections(options.entities, spreadsheetId);
         const service = await createInternalSyncService({
             dbName: options.dbName,
             entities: [...options.entities],
             projections,
-            // Injected transports are a test-only affordance; the fast pacing keeps
-            // stub-based suites wall-clock cheap. Production builds the real
-            // ADC-backed transport with its default pacing.
+            // Injected transports are a test-only affordance; ZERO pacing keeps
+            // stub-based suites wall-clock cheap AND immune to the bounded
+            // admission (interval 0 never waits and never refuses). The pacing env
+            // override applies ONLY to the real Google Sheets provider (no injected
+            // transport): a valid override is plumbed through, and the production
+            // path builds the real ADC-backed transport with the provider's safe
+            // default (2,500 ms) when the override is absent. Fake transports never
+            // consult HIKOUTEI_SYNC_RATE_LIMIT_INTERVAL_MS, so local/fake suites
+            // stay immune to a misconfigured or invalid override in the host env.
             googleSheetsApi: options.transport === undefined
-                ? {}
-                : { transport: options.transport, rateLimitIntervalMs: 1 },
+                ? (rateLimitIntervalMs === undefined ? {} : { rateLimitIntervalMs })
+                : {
+                    transport: options.transport,
+                    rateLimitIntervalMs: 0,
+                },
             pollingIntervalMs,
             pollingFullScanIntervalMs,
         });
+        logHikouteiInternalEvent({
+            event: HIKOUTEI_LOG_EVENTS.SYNC_AUTOSTART_STARTED,
+            level: "info",
+            component: HIKOUTEI_LOG_COMPONENTS.SYNC_AUTOSTART,
+            counts: { entities: options.entities.length },
+        });
         return { kind: "sync", hikoutei: service.hikoutei, service };
     }
     catch (error) {
@@ -164,16 +223,15 @@ export async function validateSyncCredentialsFile(path) {
     catch {
         throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_CREDENTIALS_INVALID_JSON, `Credentials file is not valid JSON: ${path}`);
     }
-    const parsedRecord = z.record(z.string(), z.unknown()).safeParse(parsed);
-    if (!parsedRecord.success) {
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_CREDENTIALS_INVALID_JSON, `Credentials file is not valid JSON: ${path}`);
     }
-    const credentials = syncCredentialsSchema.safeParse(parsedRecord.data);
-    if (!credentials.success) {
-        const missing = REQUIRED_CREDENTIAL_FIELDS.filter((field) => credentials.error.issues.some((issue) => issue.path[0] === field));
+    const record = parsed;
+    const missing = REQUIRED_CREDENTIAL_FIELDS.filter((field) => typeof record[field] !== "string" || record[field].trim() === "");
+    if (missing.length > 0) {
         throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_CREDENTIALS_FIELD_MISSING, `Credentials file is missing required fields: ${missing.join(", ")}`);
     }
-    return { clientEmail: credentials.data.client_email };
+    return { clientEmail: record.client_email };
 }
 /**
  * Auto-generates the internal projection routes from public entity descriptors.
@@ -252,23 +310,132 @@ function parseIntervalEnv(env, key, fallback) {
     const raw = env[key];
     if (raw === undefined || raw.trim() === "")
         return fallback;
-    const value = positiveDecimalMillisecondsSchema.safeParse(raw);
-    if (!value.success) {
+    // Decimal-only shape: Number() would also accept hex ("0x10"), exponent
+    // ("1e3"), signed ("-1"), and whitespace-padded (" 60000") forms that
+    // violate the positive-integer-ms contract, so the raw string must match
+    // before conversion.
+    if (!/^\d+$/.test(raw)) {
+        throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_STARTUP_FAILED, `Sync start failed: ${key} must be a positive integer (ms) — current value: ${raw}`);
+    }
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < 1) {
         throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_STARTUP_FAILED, `Sync start failed: ${key} must be a positive integer (ms) — current value: ${raw}`);
     }
-    return value.data;
+    return value;
+}
+/**
+ * Resolves the sync request-start pacing env override, or undefined.
+ *
+ * `HIKOUTEI_SYNC_RATE_LIMIT_INTERVAL_MS` is the internal override for the
+ * direct provider's ONE shared read+write request-start limiter. Absent or
+ * blank means the provider's safe default (2,500 ms) applies; a present
+ * value must be a plain decimal integer between 1,000 ms and
+ * `MAX_SYNC_RATE_LIMIT_INTERVAL_MS` (~10 s). The ceiling is the largest
+ * interval whose worst-case three-request paced dispatch still finishes
+ * inside the default effect lease (120 s) with the default write timeout
+ * (60 s), read timeout (10 s), and provider headroom (30 s): a dispatch
+ * can wait up to one full interval for its first slot because the shared
+ * limiter may hold a prior reservation, so the strict default-safe bound
+ * is `120s > 60s + I + 2 * max(10s, I) + 30s` and a larger interval could
+ * let pacing push the dispatch past the lease and risk duplicate remote
+ * delivery. Values outside those bounds (including hex,
+ * exponent, signed, padded, fractional, and non-numeric forms) fail closed
+ * with the stable startup code so a mistyped override can never silently
+ * drop pacing to a burst or outlive the effect lease. The key stays internal
+ * and is never part of the root public API.
+ */
+export function resolveSyncRateLimitIntervalMs(env) {
+    const raw = env[SYNC_ENV_KEYS.RATE_LIMIT_INTERVAL_MS];
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    if (!/^\d+$/.test(raw)) {
+        throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_STARTUP_FAILED, `Sync start failed: ${SYNC_ENV_KEYS.RATE_LIMIT_INTERVAL_MS} must be an integer between ` +
+            `${MIN_SYNC_RATE_LIMIT_INTERVAL_MS} and ${MAX_SYNC_RATE_LIMIT_INTERVAL_MS} ms — current value: ${raw}`);
+    }
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) ||
+        value < MIN_SYNC_RATE_LIMIT_INTERVAL_MS ||
+        value > MAX_SYNC_RATE_LIMIT_INTERVAL_MS) {
+        throw new HikouteiError(HIKOUTEI_ERROR_CODES.SYNC_STARTUP_FAILED, `Sync start failed: ${SYNC_ENV_KEYS.RATE_LIMIT_INTERVAL_MS} must be an integer between ` +
+            `${MIN_SYNC_RATE_LIMIT_INTERVAL_MS} and ${MAX_SYNC_RATE_LIMIT_INTERVAL_MS} ms — current value: ${raw}`);
+    }
+    return value;
 }
 function raiseDiagnosed(diagnostic, failure) {
-    diagnostic("error", failure.message);
+    logHikouteiInternalEvent({
+        event: HIKOUTEI_LOG_EVENTS.SYNC_AUTOSTART_FAILED,
+        level: "error",
+        component: HIKOUTEI_LOG_COMPONENTS.SYNC_AUTOSTART,
+        ...describeErrorForInternalLog(failure),
+    });
+    // EVERY diagnostic sink — injected or default — receives only the
+    // stable class/code summary. Full failure messages can embed the
+    // service-account email, spreadsheet ID, credential path, or raw
+    // provider text and must never reach a sink; the thrown HikouteiError
+    // always carries the full public message regardless of the sink.
+    try {
+        diagnostic("error", stableStartupDiagnostic(failure));
+    }
+    catch {
+        // Fail-open: a throwing diagnostic sink (injected or default) can
+        // never replace the classified startup failure. The original
+        // HikouteiError — with its stable class and machine-readable code —
+        // is preserved and rethrown unchanged, exactly as if the sink had
+        // succeeded.
+    }
     throw failure;
 }
+/** Stable error-class allowlist backing sink diagnostics (see logEvents.ts). */
+const STABLE_CLASS_ALLOWLIST = new Set(HIKOUTEI_LOG_STABLE_CLASSES);
+/** Stable error-code allowlist backing sink diagnostics (see logEvents.ts). */
+const STABLE_CODE_ALLOWLIST = new Set(HIKOUTEI_LOG_STABLE_CODES);
+/**
+ * Stable redacted startup summary for diagnostic sinks: class and code
+ * only, each checked against the shared stable allowlists.
+ *
+ * `failure.name` and `failure.code` are runtime strings that could carry
+ * secret-like text (paths, emails, tokens) if an unexpected error shape
+ * ever reached the sink path, so unknown or malformed values collapse to
+ * the fixed `unknown` class/code. The full public message is carried by
+ * the thrown HikouteiError alone and never reaches any sink.
+ */
+export function stableStartupDiagnostic(failure) {
+    const described = describeErrorForInternalLog(failure);
+    const errorClass = STABLE_CLASS_ALLOWLIST.has(described.errorClass)
+        ? described.errorClass
+        : "unknown";
+    const code = described.code !== undefined && STABLE_CODE_ALLOWLIST.has(described.code)
+        ? described.code
+        : "unknown";
+    return `Hikoutei sync autostart failed (class=${errorClass}, code=${code})`;
+}
+/**
+ * Shape gate for the default sink's error line (defense in depth).
+ *
+ * The error path receives only the stable class/code summary built by
+ * `stableStartupDiagnostic`, but the gate re-validates the exact summary
+ * shape before printing: an unexpected raw message (which could embed a
+ * path, email, spreadsheet ID, or provider text) collapses to the
+ * level-only fallback and never reaches the console.
+ */
+const STABLE_SUMMARY_SHAPE = /^Hikoutei sync autostart failed \(class=(unknown|[A-Za-z][A-Za-z0-9]*), code=(unknown|[A-Za-z][A-Za-z0-9_]*)\)$/;
 function defaultDiagnostic(level, message) {
     if (level === "info") {
+        // The info path emits only the static local-mode notice.
         console.info(message);
+        return;
     }
-    else {
+    // The error path emits the already-redacted stable class/code summary
+    // (never the full failure message — that stays on the thrown
+    // HikouteiError). The shape gate above keeps the defense in depth:
+    // anything that is not the exact stable summary shape falls back to the
+    // level-only notice.
+    if (STABLE_SUMMARY_SHAPE.test(message)) {
         console.error(message);
     }
+    else {
+        console.error(`[hikoutei] sync autostart failed (level=${level})`);
+    }
 }
 function isNodeErrorWithCode(error, code) {
     return error !== null &&