modelrig 0.0.1 → 0.1.0

package/dist/savings/swaps-client.d.ts

@@ -0,0 +1,41 @@
+/**
+ * swap_events control-plane client — Phase 4 WS4. One row per approved,
+ * EXECUTED swap; the baseline snapshot is the odometer's fixed comparison
+ * point. Same PostgREST transport as proposals/exporter.
+ */
+export interface SwapBaseline {
+    /** Incumbent's effective $ per 1K conformant from the evidence bake-off. */
+    readonly effective_usd_per_1k_conformant: number;
+    readonly conform_rate: number;
+    readonly samples: number;
+    readonly bakeoff_id: string;
+    /** Pre-swap candidate order — lets a revert be emitted later. */
+    readonly incumbent_candidates?: ReadonlyArray<{
+        provider: string;
+        model: string;
+    }>;
+}
+export interface SwapEventRecord {
+    readonly id: string;
+    readonly proposalId: string | null;
+    readonly route: string;
+    readonly fromVariant: string;
+    readonly toVariant: string;
+    readonly baseline: SwapBaseline;
+    readonly executedAt: string;
+    readonly approvedBy: string;
+    readonly revertedAt: string | null;
+}
+export interface SwapsClientConfig {
+    readonly supabaseUrl: string;
+    readonly serviceRoleKey: string;
+    readonly fetchFn?: typeof fetch;
+}
+export interface SwapsClient {
+    record(event: SwapEventRecord): Promise<void>;
+    list(): Promise<SwapEventRecord[]>;
+    get(id: string): Promise<SwapEventRecord | null>;
+    markReverted(id: string, revertedAt: string): Promise<void>;
+}
+export declare function createSwapsClient(config: SwapsClientConfig): SwapsClient;
+//# sourceMappingURL=swaps-client.d.ts.map

package/dist/savings/swaps-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"swaps-client.d.ts","sourceRoot":"","sources":["../../src/savings/swaps-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AA4BD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACjD,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAkExE"}

package/dist/savings/swaps-client.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * swap_events control-plane client — Phase 4 WS4. One row per approved,
+ * EXECUTED swap; the baseline snapshot is the odometer's fixed comparison
+ * point. Same PostgREST transport as proposals/exporter.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSwapsClient = createSwapsClient;
+function toRecord(r) {
+    return {
+        id: r.id,
+        proposalId: r.proposal_id,
+        route: r.route,
+        fromVariant: r.from_variant,
+        toVariant: r.to_variant,
+        baseline: r.baseline,
+        executedAt: r.executed_at,
+        approvedBy: r.approved_by,
+        revertedAt: r.reverted_at,
+    };
+}
+function createSwapsClient(config) {
+    const fetchFn = config.fetchFn ?? fetch;
+    const base = config.supabaseUrl.replace(/\/$/, "");
+    async function request(path, init) {
+        const response = await fetchFn(`${base}/rest/v1/${path}`, {
+            ...init,
+            headers: {
+                "content-type": "application/json",
+                apikey: config.serviceRoleKey,
+                authorization: `Bearer ${config.serviceRoleKey}`,
+                ...(init.headers ?? {}),
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`swap_events ${init.method ?? "GET"} ${path} → ${response.status} ` +
+                `${await response.text().catch(() => "")}`);
+        }
+        return response;
+    }
+    return {
+        async record(event) {
+            await request("swap_events", {
+                method: "POST",
+                headers: { prefer: "resolution=ignore-duplicates,return=minimal" },
+                body: JSON.stringify([
+                    {
+                        id: event.id,
+                        proposal_id: event.proposalId,
+                        route: event.route,
+                        from_variant: event.fromVariant,
+                        to_variant: event.toVariant,
+                        baseline: event.baseline,
+                        executed_at: event.executedAt,
+                        approved_by: event.approvedBy,
+                        reverted_at: event.revertedAt,
+                    },
+                ]),
+            });
+        },
+        async list() {
+            const response = await request("swap_events?select=*&order=executed_at.desc", {
+                method: "GET",
+            });
+            return (await response.json()).map(toRecord);
+        },
+        async get(id) {
+            const response = await request(`swap_events?select=*&id=eq.${encodeURIComponent(id)}`, {
+                method: "GET",
+            });
+            const rows = (await response.json());
+            return rows.length > 0 ? toRecord(rows[0]) : null;
+        },
+        async markReverted(id, revertedAt) {
+            await request(`swap_events?id=eq.${encodeURIComponent(id)}`, {
+                method: "PATCH",
+                body: JSON.stringify({ reverted_at: revertedAt }),
+            });
+        },
+    };
+}

package/dist/telemetry/capture.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Local-only replay capture — Phase 3 spec WS4. Opt-in per route
+ * (bundle `capture: true`). PRIVACY INVARIANT: captures NEVER leave the
+ * machine — this store is a SEPARATE handle the exporter cannot reach
+ * (ExportableTelemetryStore has no capture accessors; export-isolation is a
+ * C3 acceptance criterion with structural + runtime tests).
+ */
+export interface CaptureRow {
+    readonly inferenceId: string;
+    readonly ts: string;
+    readonly route: string;
+    readonly routeVersion: number;
+    readonly variablesJson: string;
+    readonly outputText: string;
+}
+export interface CaptureStore {
+    record(row: CaptureRow): void;
+    /** Most recent N captures for a route (replay's read path). */
+    readLast(route: string, n: number): CaptureRow[];
+    close(): void;
+}
+/**
+ * Separate better-sqlite3 handle over the same telemetry file. Deliberately
+ * NOT part of ExportableTelemetryStore — never add capture accessors there;
+ * see telemetry/export-isolation.test.ts.
+ */
+export declare function openCaptureStore(dbPath: string): CaptureStore;
+//# sourceMappingURL=capture.d.ts.map

package/dist/telemetry/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/telemetry/capture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;IACjD,KAAK,IAAI,IAAI,CAAC;CACf;AAyBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA2C7D"}

package/dist/telemetry/capture.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Local-only replay capture — Phase 3 spec WS4. Opt-in per route
+ * (bundle `capture: true`). PRIVACY INVARIANT: captures NEVER leave the
+ * machine — this store is a SEPARATE handle the exporter cannot reach
+ * (ExportableTelemetryStore has no capture accessors; export-isolation is a
+ * C3 acceptance criterion with structural + runtime tests).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openCaptureStore = openCaptureStore;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Idempotent — matches SCHEMA_SQL in store.ts (a fresh capture handle may
+ * open before the telemetry store has run the v3 migration). */
+const CAPTURES_SQL = `
+CREATE TABLE IF NOT EXISTS captures (
+  inference_id   TEXT PRIMARY KEY,
+  ts             TEXT NOT NULL,
+  route          TEXT NOT NULL,
+  route_version  INTEGER NOT NULL,
+  variables_json TEXT NOT NULL,
+  output_text    TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_captures_route_ts ON captures (route, ts);
+`;
+/**
+ * Separate better-sqlite3 handle over the same telemetry file. Deliberately
+ * NOT part of ExportableTelemetryStore — never add capture accessors there;
+ * see telemetry/export-isolation.test.ts.
+ */
+function openCaptureStore(dbPath) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(dbPath), { recursive: true });
+    const db = new better_sqlite3_1.default(dbPath);
+    db.pragma("journal_mode = WAL"); // matches store.ts; safe on an already-WAL file
+    db.exec(CAPTURES_SQL);
+    const insert = db.prepare(`
+    INSERT OR REPLACE INTO captures (
+      inference_id, ts, route, route_version, variables_json, output_text
+    ) VALUES (@inference_id, @ts, @route, @route_version, @variables_json, @output_text)
+  `);
+    const selectLast = db.prepare(`
+    SELECT * FROM captures WHERE route = ? ORDER BY ts DESC, rowid DESC LIMIT ?
+  `);
+    return {
+        record(row) {
+            insert.run({
+                inference_id: row.inferenceId,
+                ts: row.ts,
+                route: row.route,
+                route_version: row.routeVersion,
+                variables_json: row.variablesJson,
+                output_text: row.outputText,
+            });
+        },
+        readLast(route, n) {
+            const rows = selectLast.all(route, n);
+            return rows.map((r) => ({
+                inferenceId: r.inference_id,
+                ts: r.ts,
+                route: r.route,
+                routeVersion: r.route_version,
+                variablesJson: r.variables_json,
+                outputText: r.output_text,
+            }));
+        },
+        close() {
+            db.close();
+        },
+    };
+}

package/dist/telemetry/exporter.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Async batch exporter: SQLite telemetry → wherever this rig's telemetry goes.
+ * Spec §5 (cloud sink) + §6 criteria 8–9. Fire-and-forget from the run loop:
+ * the inference path NEVER blocks on, or fails because of, this sink.
+ * At-least-once delivery with idempotent ids; unexported rows queue locally in
+ * SQLite (the inferences table itself, behind a rowid watermark) and flush on
+ * recovery; watermark bookkeeping per source instance.
+ *
+ * ── ONE LOOP, TWO TRANSPORTS (Phase 6 WS2) ───────────────────────────────
+ * Everything below is transport-agnostic. Batching, watermarks, backoff,
+ * once-per-process mirrors — all of it runs identically whether the batch
+ * leaves as a service-role PostgREST write (self-host) or as a `rig_sk_`-
+ * authenticated POST to api.modelrig.ai (hosted). That is not a tidiness
+ * preference: telemetry-ingestion-boundary.md §4 makes it a requirement, so
+ * that moving between self-host and hosted is a config change rather than a
+ * data-model change. `sinks.ts` holds the two transports; `ingest-protocol.ts`
+ * holds the one mapper both of them write rows through.
+ */
+import type { RigManifest } from "../routes/manifest";
+import type { ServeabilityWarning } from "../routes/serveability";
+import type { TelemetrySink } from "./sinks";
+import type { ExportableTelemetryStore } from "./store";
+export interface ExportedRouteMirror {
+    readonly route: string;
+    readonly version: number;
+    readonly candidates: ReadonlyArray<{
+        readonly provider: string;
+        readonly model: string;
+    }>;
+    /** Capture opt-in FLAG (Phase 3 WS4) — status only; capture content never
+     * has a cloud surface. */
+    readonly capture?: boolean;
+}
+export interface ExporterConfig {
+    /** Where batches go. `sinks.ts` builds one of these from config. */
+    readonly sink: TelemetrySink;
+    readonly sourceId: string;
+    readonly batchSize?: number;
+    readonly intervalMs?: number;
+    /** Loaded route bundles, mirrored to the `routes` table for the console. */
+    readonly routes?: readonly ExportedRouteMirror[];
+    /** Rig manifest, mirrored to the `rig_manifests` table for the console
+     * (dimension NAMES only — tag values never leave the telemetry rows). */
+    readonly manifest?: RigManifest | null;
+    /** Inert-candidate warnings for THIS deployment (F1) — mirrored onto the
+     * manifest row so console /setup can say "2 candidates inert here, set
+     * XAI_API_KEY" instead of the fact living only in a boot log. Names only:
+     * route, provider, model, env var. */
+    readonly serveability?: readonly ServeabilityWarning[];
+}
+export interface Exporter {
+    /** Which lane this rig's telemetry is travelling in. Read by the boot
+     * banner — WS1's lesson was that a mode nobody can observe gets asked
+     * about instead of answered. */
+    readonly mode: "direct" | "api";
+    start(): void;
+    /** Flush pending rows now (used by tests and process-exit hooks). */
+    flush(): Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function createTelemetryExporter(store: ExportableTelemetryStore, config: ExporterConfig): Exporter;
+//# sourceMappingURL=exporter.d.ts.map

package/dist/telemetry/exporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exporter.d.ts","sourceRoot":"","sources":["../../src/telemetry/exporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F;8BAC0B;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD;6EACyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC;;;0CAGsC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB;;oCAEgC;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC,KAAK,IAAI,IAAI,CAAC;IACd,qEAAqE;IACrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAoDD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,cAAc,GACrB,QAAQ,CAuKV"}

package/dist/telemetry/exporter.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * Async batch exporter: SQLite telemetry → wherever this rig's telemetry goes.
+ * Spec §5 (cloud sink) + §6 criteria 8–9. Fire-and-forget from the run loop:
+ * the inference path NEVER blocks on, or fails because of, this sink.
+ * At-least-once delivery with idempotent ids; unexported rows queue locally in
+ * SQLite (the inferences table itself, behind a rowid watermark) and flush on
+ * recovery; watermark bookkeeping per source instance.
+ *
+ * ── ONE LOOP, TWO TRANSPORTS (Phase 6 WS2) ───────────────────────────────
+ * Everything below is transport-agnostic. Batching, watermarks, backoff,
+ * once-per-process mirrors — all of it runs identically whether the batch
+ * leaves as a service-role PostgREST write (self-host) or as a `rig_sk_`-
+ * authenticated POST to api.modelrig.ai (hosted). That is not a tidiness
+ * preference: telemetry-ingestion-boundary.md §4 makes it a requirement, so
+ * that moving between self-host and hosted is a config change rather than a
+ * data-model change. `sinks.ts` holds the two transports; `ingest-protocol.ts`
+ * holds the one mapper both of them write rows through.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTelemetryExporter = createTelemetryExporter;
+const ingest_protocol_1 = require("./ingest-protocol");
+const DEFAULT_BATCH_SIZE = 200;
+const DEFAULT_INTERVAL_MS = 10000;
+/** After a sink failure, skip this many intervals, doubling per consecutive
+ * failure (simple exponential backoff, capped). */
+const BACKOFF_MAX_SKIPS = 32;
+function toWireInference(row) {
+    return {
+        id: row.id,
+        ts: row.ts,
+        route: row.route,
+        route_version: row.routeVersion,
+        provider: row.provider,
+        model: row.model,
+        requested_tier: row.requestedTier,
+        served_tier: row.servedTier,
+        tokens_in: row.tokensIn,
+        tokens_out: row.tokensOut,
+        tokens_cached: row.tokensCached,
+        cost_estimate_usd: row.costEstimateUsd,
+        latency_ms: row.latencyMs,
+        ttfb_ms: row.ttfbMs,
+        failure_class: row.failureClass,
+        attempts: JSON.parse(row.attemptsJson),
+        tags: JSON.parse(row.tagsJson),
+        fingerprint_cell: row.fingerprintCell,
+        served_variant: row.servedVariant,
+        repaired_by: row.repairedBy,
+        pricing_missing: row.pricingMissing,
+    };
+}
+function toWireFeedback(row) {
+    return {
+        id: row.id,
+        ts: row.ts,
+        inference_id: row.inferenceId,
+        episode_key: row.episodeKey,
+        verdict: row.verdict,
+        score: row.score,
+        note: row.note,
+        source: row.source,
+        created_by: row.createdBy,
+        // Present only when the verdict names its own org. Omitted (not null) so
+        // that `stampBatch` can fall back to the exporter's tenant without having
+        // to distinguish "no org" from "explicitly no org".
+        ...(row.orgId !== null ? { org_id: row.orgId } : {}),
+    };
+}
+function createTelemetryExporter(store, config) {
+    const batchSize = config.batchSize ?? DEFAULT_BATCH_SIZE;
+    const intervalMs = config.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const { sink, sourceId } = config;
+    let timer = null;
+    let flushing = false;
+    let skipsRemaining = 0;
+    let consecutiveFailures = 0;
+    let routesMirrored = false;
+    let manifestMirrored = false;
+    /**
+     * The once-per-process mirrors, folded into whichever batch goes out first.
+     *
+     * They ride along rather than travelling alone because in api mode a batch
+     * is an HTTP request, and three requests where one would do is three times
+     * the chance of a partial flush.
+     */
+    function pendingHeader() {
+        const header = {};
+        if (!routesMirrored && config.routes !== undefined && config.routes.length > 0) {
+            header.routes = config.routes.map((r) => ({
+                route: r.route,
+                version: r.version,
+                candidates: r.candidates,
+                capture: r.capture ?? false,
+            }));
+        }
+        if (!manifestMirrored && config.manifest !== undefined && config.manifest !== null) {
+            header.manifest = {
+                name: config.manifest.name,
+                dimensions: config.manifest.dimensions,
+                contribution: config.manifest.contribution,
+                // F1: names only — route, provider/model, and the env var to set.
+                serveability: (config.serveability ?? []).map((w) => ({
+                    route: w.route,
+                    inert: w.inert.map((c) => ({ provider: c.provider, model: c.model })),
+                    serveable_count: w.serveableCount,
+                    fix_hint: w.fixHint,
+                })),
+            };
+        }
+        return header;
+    }
+    /** Mark the mirrors delivered — called ONLY after a confirmed send, so a
+     * failed first batch re-sends them rather than silently losing them. */
+    function markHeaderDelivered(header) {
+        if (header.routes !== undefined)
+            routesMirrored = true;
+        if (header.manifest !== undefined)
+            manifestMirrored = true;
+    }
+    async function flushOnce() {
+        let header = pendingHeader();
+        // Inferences past the watermark, in batches. The watermark advances ONLY
+        // after a confirmed send (at-least-once; the sink's upsert makes the
+        // duplicate harmless).
+        for (;;) {
+            const watermark = store.getExportWatermark(sourceId);
+            const pending = store.readInferencesAfter(watermark, batchSize);
+            if (pending.length === 0)
+                break;
+            await sink.send({
+                v: ingest_protocol_1.INGEST_PROTOCOL_VERSION,
+                source: sourceId,
+                ...header,
+                inferences: pending.map(({ row }) => toWireInference(row)),
+                watermarkAt: new Date().toISOString(),
+            });
+            markHeaderDelivered(header);
+            header = {};
+            store.setExportWatermark(sourceId, pending[pending.length - 1].rowid);
+            if (pending.length < batchSize)
+                break;
+        }
+        // Feedback: same at-least-once watermark dance, behind its own export_state
+        // key so the two streams never block each other.
+        const feedbackSource = `${sourceId}:feedback`;
+        for (;;) {
+            const watermark = store.getExportWatermark(feedbackSource);
+            const pending = store.readFeedbackAfter(watermark, batchSize);
+            if (pending.length === 0)
+                break;
+            await sink.send({
+                v: ingest_protocol_1.INGEST_PROTOCOL_VERSION,
+                source: sourceId,
+                ...header,
+                feedback: pending.map(({ row }) => toWireFeedback(row)),
+            });
+            markHeaderDelivered(header);
+            header = {};
+            store.setExportWatermark(feedbackSource, pending[pending.length - 1].rowid);
+            if (pending.length < batchSize)
+                break;
+        }
+        // Envelopes: small table, full upsert each flush. This send also carries
+        // any header the two loops above never got the chance to — a rig that has
+        // routes but has not run yet must still appear in the console.
+        const envelopes = store.listEnvelopes();
+        if (envelopes.length > 0 || Object.keys(header).length > 0) {
+            await sink.send({
+                v: ingest_protocol_1.INGEST_PROTOCOL_VERSION,
+                source: sourceId,
+                ...header,
+                ...(envelopes.length > 0
+                    ? {
+                        envelopes: envelopes.map((e) => ({
+                            envelope_key: e.envelopeKey,
+                            budget_usd: e.budgetUsd,
+                            spent_usd: e.spentUsd,
+                            status: e.status,
+                        })),
+                    }
+                    : {}),
+            });
+            markHeaderDelivered(header);
+        }
+    }
+    async function guardedFlush() {
+        if (flushing)
+            return;
+        flushing = true;
+        try {
+            await flushOnce();
+            consecutiveFailures = 0;
+        }
+        catch (err) {
+            // Swallow-and-log, ALWAYS — sink failures must never reach the run loop.
+            consecutiveFailures += 1;
+            skipsRemaining = Math.min(2 ** consecutiveFailures, BACKOFF_MAX_SKIPS);
+            console.warn(`[modelrig exporter] ${sink.mode} sink flush failed (attempt ${consecutiveFailures}, ` +
+                `backing off ${skipsRemaining} intervals): ` +
+                `${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            flushing = false;
+        }
+    }
+    return {
+        mode: sink.mode,
+        start() {
+            if (timer !== null)
+                return;
+            timer = setInterval(() => {
+                if (skipsRemaining > 0) {
+                    skipsRemaining -= 1;
+                    return;
+                }
+                void guardedFlush();
+            }, intervalMs);
+            // Never keep the process alive for telemetry export.
+            timer.unref?.();
+        },
+        async flush() {
+            await guardedFlush();
+        },
+        async stop() {
+            if (timer !== null) {
+                clearInterval(timer);
+                timer = null;
+            }
+            await guardedFlush();
+        },
+    };
+}