instar 1.3.409 → 1.3.411

package/dist/messaging/MessageProcessingLedger.js

@@ -41,10 +41,30 @@ CREATE TABLE IF NOT EXISTS message_ledger (
   reply_idempotency_key TEXT,
   reply_epoch INTEGER,
   input_snapshot TEXT,
-  attempts INTEGER NOT NULL DEFAULT 0
+  attempts INTEGER NOT NULL DEFAULT 0,
+  sender_envelope TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_message_ledger_state ON message_ledger(state);
+CREATE INDEX IF NOT EXISTS idx_message_ledger_topic_committed ON message_ledger(topic, reply_committed_at);
 `;
+/**
+ * Apply the schema, then idempotently add columns introduced after a DB was
+ * first created. ALTER TABLE ADD COLUMN throws "duplicate column name" on a DB
+ * that already has it — caught and ignored. This keeps existing agents' ledgers
+ * upgrading in place with no PostUpdateMigrator step (SQLite schema, per the
+ * file-header contract).
+ */
+function ensureSchema(db) {
+    db.exec(SCHEMA);
+    for (const col of ['sender_envelope TEXT']) {
+        try {
+            db.exec(`ALTER TABLE message_ledger ADD COLUMN ${col}`);
+        }
+        catch {
+            /* column already exists — idempotent */
+        }
+    }
+}
 export function resolveMessageLedgerPath(stateDir, agentId) {
     const safe = agentId.replace(/[^A-Za-z0-9._-]/g, '_') || 'default';
     return path.join(stateDir, 'state', `message-ledger.${safe}.sqlite`);
@@ -81,14 +101,14 @@ export class MessageProcessingLedger {
         db.pragma('journal_mode = WAL');
         db.pragma('synchronous = NORMAL');
         db.pragma('busy_timeout = 5000');
-        db.exec(SCHEMA);
+        ensureSchema(db);
         return new MessageProcessingLedger(db, dbPath);
     }
     /** Open an in-memory ledger (tests). */
     static openMemory() {
         const db = new Database(':memory:');
         db.pragma('busy_timeout = 5000');
-        db.exec(SCHEMA);
+        ensureSchema(db);
         return new MessageProcessingLedger(db, ':memory:');
     }
     /**
@@ -98,10 +118,11 @@ export class MessageProcessingLedger {
      */
     record(dedupeKey, opts) {
         const now = new Date().toISOString();
+        const senderJson = opts.sender ? JSON.stringify(opts.sender) : null;
         const info = this.db
-            .prepare(`INSERT OR IGNORE INTO message_ledger (dedupe_key, platform, topic, state, received_at, input_snapshot)
-         VALUES (?, ?, ?, 'received', ?, ?)`)
-            .run(dedupeKey, opts.platform, opts.topic ?? null, now, opts.input ?? null);
+            .prepare(`INSERT OR IGNORE INTO message_ledger (dedupe_key, platform, topic, state, received_at, input_snapshot, sender_envelope)
+         VALUES (?, ?, ?, 'received', ?, ?, ?)`)
+            .run(dedupeKey, opts.platform, opts.topic ?? null, now, opts.input ?? null, senderJson);
         const row = this.get(dedupeKey);
         return { firstSeen: info.changes === 1, state: row.state };
     }
@@ -183,6 +204,25 @@ export class MessageProcessingLedger {
             return !Number.isNaN(startedMs) && nowMs - startedMs > maxProcessingMs;
         });
     }
+    /**
+     * Reply-evidence check (the no-DUPLICATE-re-run half of stuck recovery): has
+     * ANY inbound on this topic been reply_committed at/after `sinceISO`? If so the
+     * agent already answered this topic since the stuck entry arrived, so re-running
+     * it would re-deliver an already-handled message (the 2026-06-07 every-~10-min
+     * "from Unknown" replay loop). Durable across restarts (reads the ledger, not
+     * in-memory state). Cheap: indexed on (topic, reply_committed_at).
+     */
+    hasReplyCommittedForTopicSince(topic, sinceISO) {
+        const row = this.db
+            .prepare(`SELECT 1 FROM message_ledger
+         WHERE topic = ?
+           AND state IN ('reply_committed','cursor_advanced')
+           AND reply_committed_at IS NOT NULL
+           AND reply_committed_at >= ?
+         LIMIT 1`)
+            .get(topic, sinceISO);
+        return !!row;
+    }
     get(dedupeKey) {
         const row = this.db.prepare(`SELECT * FROM message_ledger WHERE dedupe_key = ?`).get(dedupeKey);
         return row ? rowToEntry(row) : null;
@@ -208,6 +248,18 @@ function rowToEntry(row) {
         replyEpoch: row.reply_epoch ?? null,
         inputSnapshot: row.input_snapshot ?? null,
         attempts: row.attempts ?? 0,
+        senderEnvelope: parseSender(row.sender_envelope),
     };
 }
+function parseSender(raw) {
+    if (typeof raw !== 'string' || !raw)
+        return null;
+    try {
+        const v = JSON.parse(raw);
+        return v && typeof v === 'object' ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=MessageProcessingLedger.js.map

package/dist/messaging/MessageProcessingLedger.js.map

@@ -1 +1 @@
-{"version":3,"file":"MessageProcessingLedger.js","sourceRoot":"","sources":["../../src/messaging/MessageProcessingLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;CAgBd,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,IAAI,SAAS,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,UAAkB;IAC9E,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,KAAK,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,OAAO,uBAAuB;IACjB,EAAE,CAAuB;IACjC,IAAI,CAAS;IAEtB,YAAoB,EAAwB,EAAE,MAAc;QAC1D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,sEAAsE;QACtE,8DAA8D;QAC9D,oBAAoB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO,IAAI,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,UAAU;QACf,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO,IAAI,uBAAuB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiB,EAAE,IAAiE;QAIzF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;4CACoC,CACrC;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED,iFAAiF;IACjF,SAAS,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,iBAAiB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,SAAiB,EAAE,KAAa;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrF,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;8BAEsB,CACvB;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,SAAiB,EAAE,mBAA2B,EAAE,KAAa;QACvE,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;qFAE6E,CAC9E;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;4DACoD,CACrD;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,SAAiB,EAAE,IAA6F;QACrI,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;oFAM4E,CAC7E;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,eAAuB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,EAAW,CAAC;QAClB,OAAO,IAAI;aACR,GAAG,CAAC,UAAU,CAAC;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,CAAC,CAAC,CAAC,mBAAmB;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,SAAS,GAAG,eAAe,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAQ,CAAC;QACvG,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,IAAI;QACtD,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,IAAI;QACtD,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"MessageProcessingLedger.js","sourceRoot":"","sources":["../../src/messaging/MessageProcessingLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAgC7B,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;CAkBd,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,EAAwB;IAC5C,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,IAAI,SAAS,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,UAAkB;IAC9E,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,KAAK,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,OAAO,uBAAuB;IACjB,EAAE,CAAuB;IACjC,IAAI,CAAS;IAEtB,YAAoB,EAAwB,EAAE,MAAc;QAC1D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,sEAAsE;QACtE,8DAA8D;QAC9D,oBAAoB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAe,EAAE,QAAgB;QAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,OAAO,IAAI,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,wCAAwC;IACxC,MAAM,CAAC,UAAU;QACf,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,OAAO,IAAI,uBAAuB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiB,EAAE,IAAiG;QAIzH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;+CACuC,CACxC;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED,iFAAiF;IACjF,SAAS,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,iBAAiB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,SAAiB,EAAE,KAAa;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrF,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;8BAEsB,CACvB;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,SAAiB,EAAE,mBAA2B,EAAE,KAAa;QACvE,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;qFAE6E,CAC9E;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;4DACoD,CACrD;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,SAAiB,EAAE,IAA6F;QACrI,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;oFAM4E,CAC7E;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,eAAuB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,EAAW,CAAC;QAClB,OAAO,IAAI;aACR,GAAG,CAAC,UAAU,CAAC;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,IAAI,CAAC,CAAC,CAAC,mBAAmB;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,SAAS,GAAG,eAAe,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACH,8BAA8B,CAAC,KAAa,EAAE,QAAgB;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN;;;;;iBAKS,CACV;aACA,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,GAAG,CAAC;IACf,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAQ,CAAC;QACvG,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,IAAI;QACtD,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAChD,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,IAAI;QACtD,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC;QAC3B,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/messaging/ingressDedup.d.ts

@@ -21,7 +21,7 @@
  * safe on its own — worst case it drops nothing it shouldn't (the gate only ever
  * drops an event the ledger shows was already handled or is actively in flight).
  */
-import { MessageProcessingLedger } from './MessageProcessingLedger.js';
+import { MessageProcessingLedger, type SenderEnvelope } from './MessageProcessingLedger.js';
 /** Stable provider-level identity for an inbound event (spec §2 contract item 4). */
 export declare function dedupeKeyFor(platform: string, topicId: number | string, eventId: number | string): string;
 export type IngressAction = 'process' | 'drop';
@@ -35,6 +35,8 @@ export interface DecideIngressOpts {
     topic?: string | null;
     /** The raw inbound text/context, stored so a future replay can re-run it. */
     input?: string;
+    /** Inbound sender, stored so a stuck re-run replays as the real user (not "Unknown"). */
+    sender?: SenderEnvelope | null;
     /** The lease fencing epoch this machine holds (0 if no lease). */
     epoch: number;
     /** A 'processing' entry older than this was abandoned by a fenced holder. */

package/dist/messaging/ingressDedup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingressDedup.d.ts","sourceRoot":"","sources":["../../src/messaging/ingressDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEzG;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,WAAW,CAAC;CAC5E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,iBAAiB,GACtB,eAAe,CA8BjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,SAAI,GACb,IAAI,CAGN"}
+{"version":3,"file":"ingressDedup.d.ts","sourceRoot":"","sources":["../../src/messaging/ingressDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,uBAAuB,EAEvB,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEzG;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,WAAW,CAAC;CAC5E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,iBAAiB,GACtB,eAAe,CA8BjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,SAAI,GACb,IAAI,CAGN"}

package/dist/messaging/ingressDedup.js

@@ -34,7 +34,7 @@ export function dedupeKeyFor(platform, topicId, eventId) {
 export function decideIngress(ledger, dedupeKey, opts) {
     const now = opts.now ?? Date.now;
     // Idempotent insert — firstSeen tells us if this is a brand-new event.
-    ledger.record(dedupeKey, { platform: opts.platform, topic: opts.topic ?? null, input: opts.input });
+    ledger.record(dedupeKey, { platform: opts.platform, topic: opts.topic ?? null, input: opts.input, sender: opts.sender ?? null });
     const entry = ledger.get(dedupeKey);
     // Defensive: record() just inserted-or-found it, so entry is non-null.
     if (!entry) {

package/dist/messaging/ingressDedup.js.map

@@ -1 +1 @@
-{"version":3,"file":"ingressDedup.js","sourceRoot":"","sources":["../../src/messaging/ingressDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAEL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAwB,EAAE,OAAwB;IAC/F,OAAO,GAAG,QAAQ,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;AAC7C,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,SAAiB,EACjB,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,uEAAuE;IACvE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAEpG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACjC,oEAAoE;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1F,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;QACnF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1D,CAAC;QACD,iEAAiE;QACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA+B,EAC/B,SAAiB,EACjB,KAAa,EACb,UAAU,GAAG,CAAC;IAEd,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"ingressDedup.js","sourceRoot":"","sources":["../../src/messaging/ingressDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAEL,0BAA0B,GAE3B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAwB,EAAE,OAAwB;IAC/F,OAAO,GAAG,QAAQ,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;AAC7C,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,SAAiB,EACjB,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,uEAAuE;IACvE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAEjI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACjC,oEAAoE;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1F,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;QACnF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1D,CAAC;QACD,iEAAiE;QACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA+B,EAC/B,SAAiB,EACjB,KAAa,EACb,UAAU,GAAG,CAAC;IAEd,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/messaging/stuckMessageRecovery.d.ts

@@ -17,7 +17,7 @@
  * `attempts < maxReplayAttempts` (a message the agent legitimately never
  * answered is not re-run forever). Lease-gated: a standby never re-injects.
  */
-import type { MessageProcessingLedger } from './MessageProcessingLedger.js';
+import type { MessageProcessingLedger, SenderEnvelope } from './MessageProcessingLedger.js';
 export interface StuckRecoveryDeps {
     ledger: MessageProcessingLedger;
     /** Only the awake machine recovers; a standby must not inject. */
@@ -28,14 +28,25 @@ export interface StuckRecoveryDeps {
     maxProcessingMs: number;
     /** Give up re-running an entry after this many attempts (avoid storms). Default 3. */
     maxReplayAttempts?: number;
+    /**
+     * Reply-evidence guard (no-DUPLICATE-re-run half): true if the agent already
+     * replied to `topic` at/after `sinceISO`. When true, a stuck entry is treated
+     * as already-handled — committed, NOT re-injected. Defaults to the ledger's own
+     * `hasReplyCommittedForTopicSince`; injectable for tests. This is what stops the
+     * 2026-06-07 "re-run an already-answered message every ~10 min" loop, even when
+     * the original reply failed to commit its own entry (server flap / dup orphan).
+     */
+    hasRepliedSince?: (topic: string, sinceISO: string) => boolean;
     /** Re-route the stored input as the holder (set current-inbound key, then inject). */
-    reinject: (topicId: string, dedupeKey: string, text: string) => void;
+    reinject: (topicId: string, dedupeKey: string, text: string, sender: SenderEnvelope | null) => void;
     now?: () => number;
     logger?: (msg: string) => void;
 }
 export interface StuckRecoveryResult {
     recovered: number;
     skipped: number;
+    /** Entries recognized as already-answered (reply evidence) and committed, not re-run. */
+    alreadyHandled: number;
 }
 /**
  * Re-run inbound events stranded in `processing`. Idempotent-safe to call

package/dist/messaging/stuckMessageRecovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stuckMessageRecovery.d.ts","sourceRoot":"","sources":["../../src/messaging/stuckMessageRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,kEAAkE;IAClE,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CA0BjF"}
+{"version":3,"file":"stuckMessageRecovery.d.ts","sourceRoot":"","sources":["../../src/messaging/stuckMessageRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG5F,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,kEAAkE;IAClE,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/D,sFAAsF;IACtF,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,KAAK,IAAI,CAAC;IACpG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CA2CjF"}

package/dist/messaging/stuckMessageRecovery.js

@@ -17,6 +17,7 @@
  * `attempts < maxReplayAttempts` (a message the agent legitimately never
  * answered is not re-run forever). Lease-gated: a standby never re-injects.
  */
+import { computeReplyIdempotencyKey } from './MessageProcessingLedger.js';
 /**
  * Re-run inbound events stranded in `processing`. Idempotent-safe to call
  * repeatedly (boot + on a cadence): a re-run re-claims under the current epoch,
@@ -25,15 +26,29 @@
 export function recoverStuckMessages(deps) {
     const maxAttempts = deps.maxReplayAttempts ?? 3;
     if (!deps.holdsLease())
-        return { recovered: 0, skipped: 0 };
+        return { recovered: 0, skipped: 0, alreadyHandled: 0 };
+    const repliedSince = deps.hasRepliedSince ?? ((topic, sinceISO) => deps.ledger.hasReplyCommittedForTopicSince(topic, sinceISO));
     const stuck = deps.ledger.reclaimStuck(deps.maxProcessingMs, deps.now ? deps.now() : undefined);
     let recovered = 0;
     let skipped = 0;
+    let alreadyHandled = 0;
     for (const entry of stuck) {
         if (!entry.inputSnapshot || !entry.topic) {
             skipped++;
             continue;
         }
+        // Reply-evidence guard: if the agent already answered this topic since the
+        // stuck entry arrived, the entry is a duplicate/superseded inbound that was
+        // effectively handled (its own reply just failed to commit — server flap, or
+        // a same-topic dup orphaned by the current-inbound overwrite). Commit it so
+        // it leaves 'processing' for good; do NOT re-inject (that is the replay loop).
+        if (repliedSince(entry.topic, entry.receivedAt)) {
+            deps.ledger.commitReply(entry.dedupeKey, computeReplyIdempotencyKey(entry.dedupeKey, 0), deps.epoch);
+            deps.ledger.advanceCursor(entry.dedupeKey);
+            deps.logger?.(`stuck-recovery: ${entry.dedupeKey} already answered on its topic since receipt — committing, not re-running`);
+            alreadyHandled++;
+            continue;
+        }
         if (entry.attempts >= maxAttempts) {
             // Re-run budget exhausted — leave it (a message that legitimately never
             // got a reply, or a persistently failing turn) rather than loop forever.
@@ -41,12 +56,13 @@ export function recoverStuckMessages(deps) {
             skipped++;
             continue;
         }
-        // Re-claim under the current epoch (bumps attempts) and re-route the turn.
+        // Re-claim under the current epoch (bumps attempts) and re-route the turn,
+        // preserving the real sender so the replay is not "from Unknown".
         deps.ledger.beginProcessing(entry.dedupeKey, deps.epoch);
-        deps.reinject(entry.topic, entry.dedupeKey, entry.inputSnapshot);
+        deps.reinject(entry.topic, entry.dedupeKey, entry.inputSnapshot, entry.senderEnvelope);
         deps.logger?.(`stuck-recovery: re-ran ${entry.dedupeKey} (attempt ${entry.attempts + 1})`);
         recovered++;
     }
-    return { recovered, skipped };
+    return { recovered, skipped, alreadyHandled };
 }
 //# sourceMappingURL=stuckMessageRecovery.js.map

package/dist/messaging/stuckMessageRecovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"stuckMessageRecovery.js","sourceRoot":"","sources":["../../src/messaging/stuckMessageRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyBH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;YAClC,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC,MAAM,EAAE,CAAC,gCAAgC,KAAK,CAAC,SAAS,UAAU,KAAK,CAAC,QAAQ,WAAW,CAAC,CAAC;YAClG,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,EAAE,CAAC,0BAA0B,KAAK,CAAC,SAAS,aAAa,KAAK,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3F,SAAS,EAAE,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"stuckMessageRecovery.js","sourceRoot":"","sources":["../../src/messaging/stuckMessageRecovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAkC1E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAE/E,MAAM,YAAY,GAChB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,8BAA8B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7G,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC,mBAAmB,KAAK,CAAC,SAAS,2EAA2E,CAAC,CAAC;YAC7H,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;YAClC,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC,MAAM,EAAE,CAAC,gCAAgC,KAAK,CAAC,SAAS,UAAU,KAAK,CAAC,QAAQ,WAAW,CAAC,CAAC;YAClG,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC,0BAA0B,KAAK,CAAC,SAAS,aAAa,KAAK,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3F,SAAS,EAAE,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC"}

package/dist/monitoring/SessionWatchdog.d.ts

@@ -142,7 +142,7 @@ export declare class SessionWatchdog extends EventEmitter {
      *   5. server.ts checks message history before activating triage (data-level guard)
      *   6. TriageOrchestrator Pattern 2b re-validates before reinjecting (redundant check)
      */
-    checkCompactionIdle(tmuxSession: string): void;
+    checkCompactionIdle(tmuxSession: string): Promise<void>;
     private handleEscalation;
     /**
      * LLM gate: Before entering escalation, ask whether the command is

package/dist/monitoring/SessionWatchdog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionWatchdog.d.ts","sourceRoot":"","sources":["../../src/monitoring/SessionWatchdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAe3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAQ3E,oBAAY,eAAe;IACzB,UAAU,IAAI;IACd,KAAK,IAAI;IACT,OAAO,IAAI;IACX,OAAO,IAAI;IACX,WAAW,IAAI;CAChB;AAQD,UAAU,eAAe;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AA4ED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,iBAAiB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,QAAQ,CAA+C;IAC/D,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,mBAAmB,CAA2B;IACtD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,OAAO,CAAS;IAExB,+EAA+E;IAC/E,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAQ;IAEjD,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,yEAAyE;IACzE,OAAO,CAAC,gBAAgB,CAAK;IAE7B,sEAAsE;IACtE,OAAO,CAAC,oBAAoB,CAAwC;IAEpE,4EAA4E;IAC5E,OAAO,CAAC,uBAAuB,CAA6B;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAW;IAE9D,yEAAyE;IACzE,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAA0C;IAChE,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;IAerF,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAOZ,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAOlC,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAKxC,SAAS,IAAI;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,eAAe,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KAC1C;YAgBa,IAAI;YAkBJ,YAAY;IAiH1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAyC3C;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;YA4ChC,gBAAgB;IAwF9B;;;;;;;;OAQG;YACW,cAAc;IAkE5B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;IAgDvB,OAAO,CAAC,iBAAiB;IA8BzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAwDhC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAO9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAkBvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAgB9C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa;IA8BzC;;OAEG;IACH,SAAS,IAAI,IAAI;CAwBlB"}
+{"version":3,"file":"SessionWatchdog.d.ts","sourceRoot":"","sources":["../../src/monitoring/SessionWatchdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAQ3E,oBAAY,eAAe;IACzB,UAAU,IAAI;IACd,KAAK,IAAI;IACT,OAAO,IAAI;IACX,OAAO,IAAI;IACX,WAAW,IAAI;CAChB;AAQD,UAAU,eAAe;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AA4ED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,iBAAiB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACzC,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,QAAQ,CAA+C;IAC/D,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,mBAAmB,CAA2B;IACtD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,OAAO,CAAS;IAExB,+EAA+E;IAC/E,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAQ;IAEjD,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,yEAAyE;IACzE,OAAO,CAAC,gBAAgB,CAAK;IAE7B,sEAAsE;IACtE,OAAO,CAAC,oBAAoB,CAAwC;IAEpE,4EAA4E;IAC5E,OAAO,CAAC,uBAAuB,CAA6B;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAW;IAE9D,yEAAyE;IACzE,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAA0C;IAChE,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;IAerF,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAOZ,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAOlC,SAAS,IAAI,OAAO;IAIpB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAKxC,SAAS,IAAI;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,eAAe,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KAC1C;YAgBa,IAAI;YAqBJ,YAAY;IAiH1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAyC3C;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA4C/C,gBAAgB;IAwF9B;;;;;;;;OAQG;YACW,cAAc;IAkE5B;;;;;;;;OAQG;YACW,YAAY;YAIZ,eAAe;YAgDf,iBAAiB;IA8B/B;;;;;;;;;;OAUG;YACW,wBAAwB;IAwDtC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAO9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAkBvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAgB9C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa;IA8BzC;;OAEG;IACH,SAAS,IAAI,IAAI;CAwBlB"}

package/dist/monitoring/SessionWatchdog.js

@@ -12,15 +12,42 @@
  *   Level 3: SIGKILL the stuck child PID
  *   Level 4: Kill tmux session
  */
-import { spawnSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import path from 'node:path';
 import { maybeRotateJsonl } from '../utils/jsonl-rotation.js';
 import { evaluateThrottleSettle, RATE_LIMIT_SETTLED_CAPTURE_LINES, RATE_LIMIT_DEFAULT_SETTLE_MS, } from './rateLimitDetection.js';
-/** Drop-in replacement for execSync that avoids its security concerns. */
-function shellExec(cmd, timeout = 5000) {
-    return spawnSync('/bin/sh', ['-c', cmd], { encoding: 'utf-8', timeout }).stdout ?? '';
+const execFileAsync = promisify(execFile);
+/**
+ * ASYNC shell exec — the watchdog poll runs every 30s over EVERY running
+ * session, several `ps`/`pgrep` probes each. With the old `spawnSync` those
+ * probes blocked the single Node event loop for the full duration of each
+ * subprocess; under load (dozens of sessions, a busy box) the cumulative stall
+ * made the server miss its own /health window → false "server temporarily down"
+ * + a restart loop (2026-06-07 incident). execFile is non-blocking: the event
+ * loop (and /health) stays responsive while `ps` runs. Returns captured stdout
+ * (or '' on a non-zero exit / timeout), matching the old spawnSync semantics
+ * where a pgrep/egrep no-match simply yielded ''.
+ */
+async function shellExecAsync(cmd, timeout = 5000) {
+    try {
+        const { stdout } = await execFileAsync('/bin/sh', ['-c', cmd], {
+            encoding: 'utf-8',
+            timeout,
+            maxBuffer: 4 * 1024 * 1024,
+        });
+        return stdout ?? '';
+    }
+    catch (err) {
+        // @silent-fallback-ok — a failed process probe is not a degradation: a
+        // pgrep/egrep no-match, a dead PID, or a timeout legitimately means "no
+        // match", identical to the prior synchronous behavior where spawnSync simply
+        // yielded an empty stdout string. Return any captured stdout, else ''.
+        const e = err;
+        return e && typeof e.stdout === 'string' ? e.stdout : '';
+    }
 }
 import { createRequire } from 'node:module';
 // ESM module: a bare CJS `require` is undefined and throws at runtime. Bind a
@@ -203,6 +230,9 @@ export class SessionWatchdog extends EventEmitter {
                 catch (err) {
                     console.error(`[Watchdog] Error checking "${session.tmuxSession}":`, err);
                 }
+                // Yield to the event loop between sessions so a poll over many sessions
+                // can never monopolize the loop and starve /health (which shares it).
+                await new Promise((resolve) => setImmediate(resolve));
             }
         }
         finally {
@@ -219,12 +249,12 @@ export class SessionWatchdog extends EventEmitter {
         // the stuck-command path but still run compaction-idle detection —
         // that path is output-based and doesn't strictly need a PID (its own
         // process guard is null-safe).
-        const claudePid = this.getClaudePid(tmuxSession);
+        const claudePid = await this.getClaudePid(tmuxSession);
         if (!claudePid) {
-            this.checkCompactionIdle(tmuxSession);
+            await this.checkCompactionIdle(tmuxSession);
             return;
         }
-        const children = this.getChildProcesses(claudePid);
+        const children = await this.getChildProcesses(claudePid);
         const stuckChild = children.find(c => {
             if (this.isExcluded(c.command))
                 return false;
@@ -245,7 +275,7 @@ export class SessionWatchdog extends EventEmitter {
             // contain active sibling producers, the "stuck" process is just
             // waiting for upstream output from a legitimate long-running
             // pipeline. Skip escalation.
-            if (this.hasActivePipelineSibling(stuckChild.pid, stuckChild.command)) {
+            if (await this.hasActivePipelineSibling(stuckChild.pid, stuckChild.command)) {
                 console.log(`[Watchdog] "${tmuxSession}": ${stuckChild.command.slice(0, 60)} ` +
                     `is consuming an active pipeline — skipping escalation`);
                 this.temporaryExclusions.add(stuckChild.pid);
@@ -299,7 +329,7 @@ export class SessionWatchdog extends EventEmitter {
         // sitting at a bare prompt with no one at the terminal to nudge them.
         // This is the polling-based fallback for the PreCompact event path which
         // is unreliable (Claude Code doesn't always fire the event).
-        this.checkCompactionIdle(tmuxSession);
+        await this.checkCompactionIdle(tmuxSession);
         // Server-side throttle detection — catch sessions stopped at a prompt after
         // Anthropic's "temporarily limiting requests" throttle exhausted Claude's
         // own retries. Signal-only: emits 'rate-limited' for the RateLimitSentinel
@@ -369,7 +399,7 @@ export class SessionWatchdog extends EventEmitter {
      *   5. server.ts checks message history before activating triage (data-level guard)
      *   6. TriageOrchestrator Pattern 2b re-validates before reinjecting (redundant check)
      */
-    checkCompactionIdle(tmuxSession) {
+    async checkCompactionIdle(tmuxSession) {
         // Cooldown — don't re-emit for the same session within 5 minutes
         const lastEmitted = this.compactionIdleCooldowns.get(tmuxSession);
         if (lastEmitted && (Date.now() - lastEmitted) < SessionWatchdog.COMPACTION_IDLE_COOLDOWN_MS) {
@@ -377,9 +407,9 @@ export class SessionWatchdog extends EventEmitter {
         }
         // Guard 1: Structural process check — if Claude has active child processes,
         // it's executing tools/commands, not stalled. Skip entirely.
-        const claudePid = this.getClaudePid(tmuxSession);
+        const claudePid = await this.getClaudePid(tmuxSession);
         if (claudePid) {
-            const children = this.getChildProcesses(claudePid);
+            const children = await this.getChildProcesses(claudePid);
             const activeChildren = children.filter(c => !this.isExcluded(c.command));
             if (activeChildren.length > 0)
                 return;
@@ -545,13 +575,13 @@ export class SessionWatchdog extends EventEmitter {
      * @deprecated method name retained for v0.x compat — internal callers
      * use the framework-generic shape.
      */
-    getClaudePid(tmuxSession) {
+    async getClaudePid(tmuxSession) {
         return this.getFrameworkPid(tmuxSession);
     }
-    getFrameworkPid(tmuxSession) {
+    async getFrameworkPid(tmuxSession) {
         try {
             // Get pane PID
-            const panePidStr = shellExec(`${this.config.sessions.tmuxPath} list-panes -t "=${tmuxSession}" -F "#{pane_pid}" 2>/dev/null`).trim().split('\n')[0];
+            const panePidStr = (await shellExecAsync(`${this.config.sessions.tmuxPath} list-panes -t "=${tmuxSession}" -F "#{pane_pid}" 2>/dev/null`)).trim().split('\n')[0];
             if (!panePidStr)
                 return null;
             const panePid = parseInt(panePidStr, 10);
@@ -562,7 +592,7 @@ export class SessionWatchdog extends EventEmitter {
             // own command first — if it matches a known framework binary,
             // return it. Without this, pgrep -P finds no match and the
             // watchdog silently no-ops.
-            const paneCmd = shellExec(`ps -p ${panePid} -o comm= 2>/dev/null`).trim();
+            const paneCmd = (await shellExecAsync(`ps -p ${panePid} -o comm= 2>/dev/null`)).trim();
             // eslint-disable-next-line @typescript-eslint/no-var-requires
             const { listProcessSignals } = require('./frameworkProcessSignals.js');
             const signals = listProcessSignals();
@@ -581,7 +611,7 @@ export class SessionWatchdog extends EventEmitter {
             // Fallback: pane runs a shell wrapper that has a framework CLI as
             // a child. egrep alternation over every framework's bracket needle.
             const needle = signals.map((s) => s.psGrepNeedle).join('|');
-            const childPidStr = shellExec(`pgrep -P ${panePid} 2>/dev/null | xargs -I@ ps -p @ -o pid=,command= 2>/dev/null | egrep -i '${needle}' | head -1 | awk '{print $1}'`).trim();
+            const childPidStr = (await shellExecAsync(`pgrep -P ${panePid} 2>/dev/null | xargs -I@ ps -p @ -o pid=,command= 2>/dev/null | egrep -i '${needle}' | head -1 | awk '{print $1}'`)).trim();
             if (!childPidStr)
                 return null;
             const pid = parseInt(childPidStr, 10);
@@ -592,15 +622,15 @@ export class SessionWatchdog extends EventEmitter {
             return null;
         }
     }
-    getChildProcesses(pid) {
+    async getChildProcesses(pid) {
         try {
-            const childPidsStr = shellExec(`pgrep -P ${pid} 2>/dev/null`).trim();
+            const childPidsStr = (await shellExecAsync(`pgrep -P ${pid} 2>/dev/null`)).trim();
             if (!childPidsStr)
                 return [];
             const childPids = childPidsStr.split('\n').filter(Boolean).join(',');
             if (!childPids)
                 return [];
-            const output = shellExec(`ps -o pid=,etime=,command= -p ${childPids} 2>/dev/null`).trim();
+            const output = (await shellExecAsync(`ps -o pid=,etime=,command= -p ${childPids} 2>/dev/null`)).trim();
             if (!output)
                 return [];
             const results = [];
@@ -635,7 +665,7 @@ export class SessionWatchdog extends EventEmitter {
      * Returns true if this PID looks like a waiting consumer in an active
      * pipeline — in which case escalation should be skipped.
      */
-    hasActivePipelineSibling(pid, command) {
+    async hasActivePipelineSibling(pid, command) {
         // Step 1: is the command a stdin-consuming candidate at all?
         const consumer = STDIN_CONSUMER_PATTERNS.find(p => p.cmd.test(command));
         if (!consumer)
@@ -646,11 +676,11 @@ export class SessionWatchdog extends EventEmitter {
             return false;
         // Step 3: find the process group and peers.
         try {
-            const pgidStr = shellExec(`ps -o pgid= -p ${pid} 2>/dev/null`).trim();
+            const pgidStr = (await shellExecAsync(`ps -o pgid= -p ${pid} 2>/dev/null`)).trim();
             const pgid = parseInt(pgidStr, 10);
             // Check process group peers (pipelines share pgid on macOS/Linux).
             if (!isNaN(pgid) && pgid > 0) {
-                const peersOutput = shellExec(`ps -o pid=,command= -g ${pgid} 2>/dev/null`).trim();
+                const peersOutput = (await shellExecAsync(`ps -o pid=,command= -g ${pgid} 2>/dev/null`)).trim();
                 for (const line of peersOutput.split('\n')) {
                     const match = line.trim().match(/^(\d+)\s+(.+)$/);
                     if (!match)
@@ -669,11 +699,11 @@ export class SessionWatchdog extends EventEmitter {
             // Fallback: also check direct descendants of the consumer PID. In
             // some shell exec patterns the producer becomes a CHILD of the
             // exec'd consumer rather than a pgid sibling.
-            const childPidsStr = shellExec(`pgrep -P ${pid} 2>/dev/null`).trim();
+            const childPidsStr = (await shellExecAsync(`pgrep -P ${pid} 2>/dev/null`)).trim();
             if (childPidsStr) {
                 const childPids = childPidsStr.split('\n').filter(Boolean).join(',');
                 if (childPids) {
-                    const childOutput = shellExec(`ps -o pid=,command= -p ${childPids} 2>/dev/null`).trim();
+                    const childOutput = (await shellExecAsync(`ps -o pid=,command= -p ${childPids} 2>/dev/null`)).trim();
                     for (const line of childOutput.split('\n')) {
                         const match = line.trim().match(/^(\d+)\s+(.+)$/);
                         if (!match)