sintbot 1.0.16 → 1.3.0

package/src/core/c2startuprecovery.js

@@ -0,0 +1,105 @@
+'use strict'
+
+const { isDeepStrictEqual } = require('node:util')
+const { validatePersistentRelation, validatePersistentReceipts } = require('./c2persistrelation')
+
+const JOB_PREFIX = 'receipt:job:'
+const MEMBER_PREFIX = 'receipt:member:'
+
+function queuedIds(queue) {
+  const jobIds = queue.map(job => job.id)
+  const receiptIds = []
+  const seen = new Set()
+  for (const job of queue) {
+    for (const id of [job.id.slice(JOB_PREFIX.length),
+      ...(job.batch || []).map(member => member.id.slice(MEMBER_PREFIX.length))]) {
+      if (!seen.has(id)) { seen.add(id); receiptIds.push(id) }
+    }
+  }
+  return { jobIds, receiptIds }
+}
+
+// Startup has no job bodies, reply contexts, controllers or runner handles.
+// Keep ingress shut and persist queue interruption before handing receipts to
+// the existing notification protocol. This routine never sends or settles one.
+function recoverMissingPayload({ gate, journal, coordinator, scope = null } = {}) {
+  if (!gate || typeof gate.close !== 'function' || typeof gate.isClosed !== 'function' ||
+      !journal || typeof journal.snapshot !== 'function' || typeof journal.hasEvent !== 'function' ||
+      !coordinator || typeof coordinator.snapshot !== 'function' ||
+      typeof coordinator.transition !== 'function') {
+    throw new TypeError('C2 startup recovery needs gate, journal and coordinator')
+  }
+  if (scope !== null && (typeof scope !== 'string' ||
+      !/^[A-Za-z0-9_-]{1,128}$/.test(scope) || gate.scope !== scope)) {
+    throw new TypeError('C2 scoped startup recovery needs matching scoped gate')
+  }
+  gate.close()
+  if (gate.isClosed() !== true) throw new Error('C2 startup ingress is not closed')
+
+  const initial = journal.snapshot()
+  validatePersistentReceipts(initial.receipts)
+  validatePersistentRelation(initial.state, initial.receipts)
+  if (initial.cursor !== initial.state.seq ||
+      !isDeepStrictEqual(coordinator.snapshot(), initial.state)) {
+    throw new Error('C2 startup state differs from durable authority')
+  }
+
+  const interrupted = []
+  const scopes = scope === null ? Object.keys(initial.state.lanes.queue || {}).sort() : [scope]
+  for (const scope of scopes) {
+    const prior = journal.snapshot()
+    const queue = prior.state.lanes.queue?.[scope]?.queue
+    if (queue === undefined && scopes.length === 1 && gate.scope === scope) continue
+    if (!Array.isArray(queue)) throw new Error('C2 startup queue scope changed')
+    if (!queue.length) continue
+    validatePersistentRelation(prior.state, prior.receipts)
+    if (prior.cursor !== prior.state.seq ||
+        !isDeepStrictEqual(coordinator.snapshot(), prior.state)) {
+      throw new Error('C2 startup cursor changed during recovery')
+    }
+    const expected = queuedIds(queue)
+    const eventId = `sbot-c2-startup-queue-v1:${scope}:${prior.cursor}`
+    const expectedEffectId = `sbot-c2-effect-v1:${Buffer.byteLength(eventId)}:${eventId}:0`
+    if (Buffer.byteLength(eventId) > 256 || journal.hasEvent(eventId)) {
+      throw new Error('C2 startup queue event identity conflict')
+    }
+    const candidateState = structuredClone(prior.state)
+    candidateState.seq++
+    candidateState.lastEventId = eventId
+    candidateState.lanes.queue[scope].queue = []
+    const result = coordinator.transition({ id: eventId, domain: 'queue', scope,
+      payload: { type: 'recoverMissingPayload' }, validate(candidate) {
+        if (!isDeepStrictEqual(candidate.state, candidateState) ||
+            candidate.effects?.length !== 1 ||
+            candidate.effects[0].type !== 'interruptMissingPayload' ||
+            candidate.effects[0].effectId !== expectedEffectId ||
+            !isDeepStrictEqual(candidate.effects[0].jobIds, expected.jobIds) ||
+            !isDeepStrictEqual(candidate.effects[0].receiptIds, expected.receiptIds) ||
+            candidate.decision?.runLen !== 0 || candidate.decision?.visibleQueue !== 0) {
+          throw new Error('C2 startup queue interruption mismatch')
+        }
+      } })
+    if (!journal.hasEvent(eventId) || journal.cursor !== prior.cursor + 1 ||
+        !isDeepStrictEqual(coordinator.snapshot(), journal.snapshot().state) ||
+        !isDeepStrictEqual(result.state, journal.snapshot().state)) {
+      throw new Error('C2 startup queue interruption was not durably committed')
+    }
+    interrupted.push(...expected.receiptIds)
+  }
+
+  const final = journal.snapshot()
+  validatePersistentRelation(final.state, final.receipts)
+  if (!isDeepStrictEqual(coordinator.snapshot(), final.state) ||
+      (scope === null
+        ? Object.values(final.state.lanes.queue || {}).some(lane => lane.queue.length)
+        : (final.state.lanes.queue?.[scope]?.queue?.length || 0) > 0)) {
+    throw new Error('C2 startup queue remains unresolved')
+  }
+  const pending = final.receipts.pending.filter(item => scope === null || item.chatId === scope)
+    .map(item => ({ id: item.id,
+    chatId: item.chatId, quiet: item.quiet }))
+    .sort((a, b) => a.chatId.localeCompare(b.chatId) || a.id.localeCompare(b.id))
+  return { interruptedReceiptIds: [...new Set(interrupted)], pending, ingressClosed: true }
+}
+
+module.exports = { recoverMissingPayload }

package/src/core/c2successorbridge.js

@@ -0,0 +1,151 @@
+'use strict'
+
+// Same-process continuation after a settled v2 terminal effect. The prior
+// answer is already externally visible; only internal handoff effects may be
+// acknowledged here. A crash loses raw queued jobs and startup recovery must
+// interrupt them rather than replaying a model run.
+const { isDeepStrictEqual } = require('node:util')
+const { C2DurableRuntime } = require('./c2durableruntime')
+const { C2DurableJournal } = require('./c2durablejournal')
+const { C2PayloadHandles } = require('./c2payloadhandles')
+
+const RECEIPT_ID = /^[0-9a-f]{32}$/
+
+function continueC2Successor({ runtime, journal, payloadHandles, chatId,
+  priorReceiptId, priorTurnToken, terminalResult, generation,
+  assertWriterLock, now = Date.now } = {}) {
+  if (!(runtime instanceof C2DurableRuntime) ||
+      !(journal instanceof C2DurableJournal) ||
+      !(payloadHandles instanceof C2PayloadHandles) ||
+      typeof chatId !== 'string' || !chatId ||
+      !RECEIPT_ID.test(priorReceiptId || '') ||
+      !Number.isSafeInteger(priorTurnToken) || priorTurnToken <= 0 ||
+      !RECEIPT_ID.test(generation || '') ||
+      typeof assertWriterLock !== 'function' ||
+      assertWriterLock.constructor?.name === 'AsyncFunction' ||
+      typeof now !== 'function' || now.constructor?.name === 'AsyncFunction') {
+    throw new TypeError('C2 successor bridge needs exact live authority')
+  }
+  const locked = () => {
+    if (assertWriterLock() !== true) throw new Error('C2 successor lost writer lock')
+  }
+  try {
+    locked()
+    const before = runtime.snapshot()
+    if (runtime.blocked || journal.blocked || payloadHandles.blocked ||
+        !isDeepStrictEqual(before, journal.snapshot()) ||
+        terminalResult?.receiptId !== priorReceiptId ||
+        !RECEIPT_ID.test(terminalResult?.nextReceiptId || '') ||
+        typeof terminalResult?.terminalEffectId !== 'string' ||
+        !Array.isArray(terminalResult.pendingEffects) ||
+        terminalResult.pendingEffects.length !== 2 ||
+        new Set(terminalResult.pendingEffects).size !== 2) {
+      throw new Error('C2 successor lacks settled prior terminal authority')
+    }
+    const nextReceiptId = terminalResult.nextReceiptId
+    const settlement = journal.terminalSettlement(terminalResult.terminalEffectId)
+    const terminal = journal.effectDescriptor(terminalResult.terminalEffectId)
+    const [holdId, scheduleId] = terminalResult.pendingEffects
+    const hold = journal.effectDescriptor(holdId)
+    const schedule = journal.effectDescriptor(scheduleId)
+    const handoff = before.state?.lanes?.handoff?.[chatId]
+    const turn = before.state?.lanes?.turn?.[chatId]
+    const nextReceipt = before.receipts?.pending?.find(item => item.id === nextReceiptId)
+    if (settlement?.receiptId !== priorReceiptId ||
+        settlement.chatId !== chatId || settlement.turnToken !== priorTurnToken ||
+        terminal?.receiptId !== priorReceiptId || terminal.scope !== chatId ||
+        !['finalReply', 'quietCompletion'].includes(terminal.type) ||
+        journal.effectStatus(terminalResult.terminalEffectId) !== 'acked' ||
+        !before.receipts.completed.some(item => item.id === priorReceiptId) ||
+        before.receipts.pending.some(item => item.id === priorReceiptId) ||
+        nextReceipt?.chatId !== chatId || nextReceipt.source !== 'message' ||
+        handoff?.phase !== 'handoff' || handoff.turnToken !== priorTurnToken ||
+        handoff.nextJobId !== nextReceiptId || turn?.active !== null ||
+        hold?.domain !== 'atomicHandoff' || hold.scope !== chatId ||
+        hold.type !== 'holdHandoff' || hold.turnToken !== priorTurnToken ||
+        hold.receiptId !== null || hold.targetId !== null ||
+        schedule?.domain !== 'atomicHandoff' || schedule.scope !== chatId ||
+        schedule.type !== 'scheduleDispatch' ||
+        schedule.turnToken !== priorTurnToken ||
+        schedule.receiptId !== nextReceiptId || schedule.targetId !== null ||
+        journal.effectStatus(holdId) !== 'pending' ||
+        journal.effectStatus(scheduleId) !== 'pending') {
+      throw new Error('C2 successor effects differ from durable handoff')
+    }
+    payloadHandles.peekHandoff(nextReceiptId)
+    locked()
+    runtime.recordEffect(holdId, 'acked')
+    if (journal.effectStatus(holdId) !== 'acked' ||
+        !isDeepStrictEqual(runtime.snapshot(), journal.snapshot())) {
+      throw new Error('C2 successor hold ACK differs from runtime')
+    }
+    locked()
+    runtime.recordEffect(scheduleId, 'acked')
+    if (journal.effectStatus(scheduleId) !== 'acked' ||
+        !isDeepStrictEqual(runtime.snapshot(), journal.snapshot())) {
+      throw new Error('C2 successor schedule ACK differs from runtime')
+    }
+    const registeredAt = now()
+    if (!Number.isSafeInteger(registeredAt) || registeredAt <= 0) {
+      throw new TypeError('C2 successor callback time invalid')
+    }
+    locked()
+    runtime.registerHandoffBeginCallback({ receiptId: nextReceiptId,
+      generation, registeredAt })
+    locked()
+    const begun = runtime.commitHandoffBegin({ receiptId: nextReceiptId,
+      generation, priorTurnToken, payloadHandles })
+    const [clear, dispatch] = begun.effects || []
+    const token = begun.decision?.turnToken
+    if (!Number.isSafeInteger(token) || token <= priorTurnToken ||
+        !Array.isArray(begun.jobReceiptIds) || begun.jobReceiptIds.length === 0 ||
+        !begun.jobReceiptIds.includes(nextReceiptId) ||
+        begun.effects.length !== 2 || clear?.type !== 'clearHandoff' ||
+        dispatch?.type !== 'dispatch' || dispatch.jobId !== nextReceiptId ||
+        dispatch.turnToken !== token ||
+        journal.effectDescriptor(clear.effectId)?.type !== 'clearHandoff' ||
+        journal.effectDescriptor(dispatch.effectId)?.type !== 'dispatch' ||
+        journal.effectStatus(clear.effectId) !== 'pending' ||
+        journal.effectStatus(dispatch.effectId) !== 'pending' ||
+        !isDeepStrictEqual(runtime.snapshot(), journal.snapshot())) {
+      throw new Error('C2 successor begin differs from durable dispatch')
+    }
+    locked()
+    runtime.recordEffect(clear.effectId, 'acked')
+    if (journal.effectStatus(clear.effectId) !== 'acked' ||
+        !isDeepStrictEqual(runtime.snapshot(), journal.snapshot())) {
+      throw new Error('C2 successor clear ACK differs from runtime')
+    }
+    locked()
+    const jobs = payloadHandles.consumeCommittedDispatch({ eventId: begun.eventId,
+      turnToken: token, receiptIds: begun.jobReceiptIds })
+    if (jobs.length !== begun.jobReceiptIds.length ||
+        jobs.some((job, index) => job.msg?._c2ReceiptId !== begun.jobReceiptIds[index] ||
+          job.msg.chatId !== chatId)) {
+      throw new Error('C2 successor jobs differ from durable dispatch')
+    }
+    const after = runtime.snapshot()
+    const queue = after.state?.lanes?.queue?.[chatId]?.queue
+    if (!Array.isArray(queue) ||
+        !queue.every(item => typeof item.id === 'string' &&
+          /^receipt:job:[0-9a-f]{32}$/.test(item.id)) ||
+        after.state?.lanes?.turn?.[chatId]?.active !== token ||
+        after.state?.lanes?.handoff?.[chatId]?.phase !== 'running' ||
+        after.state.lanes.handoff[chatId].turnToken !== token ||
+        after.effects.get(dispatch.effectId) !== 'pending') {
+      throw new Error('C2 successor dispatch is no longer live')
+    }
+    locked()
+    return Object.freeze({ receiptId: nextReceiptId, turnToken: token,
+      effectId: dispatch.effectId, eventId: begun.eventId, cursor: begun.cursor,
+      jobReceiptIds: Object.freeze([...begun.jobReceiptIds]),
+      batchReceiptIds: Object.freeze([...begun.batchReceiptIds]),
+      jobs: Object.freeze([...jobs]),
+      queuedReceiptIds: Object.freeze(queue.map(item => item.id.slice('receipt:job:'.length))) })
+  } catch (error) {
+    runtime.close()
+    throw error
+  }
+}
+
+module.exports = { continueC2Successor }

package/src/core/c2terminaleffectbridge.js

@@ -0,0 +1,154 @@
+'use strict'
+
+// Opt-in host bridge for one single-receipt terminal effect. The three callback
+// identities are fsynced before a runner completion callback may be exposed.
+// Text and platform targets stay in the caller's process; the runtime/journal
+// receive only the v2 decision and stable effect/receipt identities.
+const { C2DurableRuntime } = require('./c2durableruntime')
+const { C2PayloadHandles } = require('./c2payloadhandles')
+
+const RECEIPT_ID = /^[0-9a-f]{32}$/
+const GENERATION = /^[0-9a-f]{32}$/
+const LOCAL_EFFECTS = new Set(['markTainted', 'clearTainted',
+  'clearExhausted', 'verifyTurn'])
+
+// The legacy final delivery keeps the answer after the last tool when one
+// exists, otherwise the full streamed text. Codex may emit several assistant
+// messages while result.text contains only the last one. Keep this projection
+// process-local: the durable terminal payload is validated by the core and
+// never stores model text in the journal.
+function terminalReplyText(payload) {
+  if (!payload || typeof payload.resultText !== 'string' ||
+      typeof payload.bufferText !== 'string' ||
+      typeof payload.answerText !== 'string') {
+    throw new TypeError('C2 terminal reply text fields invalid')
+  }
+  return (payload.answerText.trim() ? payload.answerText : payload.bufferText) ||
+    payload.resultText
+}
+
+function prepareTerminalEffectBridge({ runtime, payloadHandles, receiptId, chatId,
+  turnToken, generation, verifyGeneration, applyLocalEffect, assertWriterLock,
+  now = Date.now } = {}) {
+  if (!(runtime instanceof C2DurableRuntime) ||
+      !(payloadHandles instanceof C2PayloadHandles) || payloadHandles.blocked ||
+      !RECEIPT_ID.test(receiptId) || typeof chatId !== 'string' || !chatId ||
+      !Number.isSafeInteger(turnToken) || turnToken <= 0 ||
+      !GENERATION.test(generation) || typeof verifyGeneration !== 'function' ||
+      verifyGeneration.constructor?.name === 'AsyncFunction' ||
+      typeof applyLocalEffect !== 'function' ||
+      applyLocalEffect.constructor?.name === 'AsyncFunction' ||
+      typeof now !== 'function') {
+    throw new TypeError('C2 terminal bridge needs exact live authority')
+  }
+  const snapshot = runtime.snapshot()
+  if (runtime.blocked ||
+      snapshot.receipts?.pending?.find(item => item.id === receiptId)?.chatId !== chatId ||
+      snapshot.state?.lanes?.turn?.[chatId]?.active !== turnToken ||
+      snapshot.state?.lanes?.handoff?.[chatId]?.phase !== 'running' ||
+      snapshot.state.lanes.handoff[chatId].turnToken !== turnToken ||
+      verifyGeneration({ chatId, receiptId, turnToken, generation }) !== true) {
+    throw new Error('C2 terminal bridge has no live running receipt')
+  }
+  const stamp = () => {
+    const value = now()
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new TypeError('C2 terminal bridge time invalid')
+    }
+    return value
+  }
+  try {
+    runtime.registerTerminalCallback({ receiptId, generation,
+      registeredAt: stamp() })
+    runtime.registerReleaseRequestedCallback({ receiptId, generation,
+      registeredAt: stamp() })
+    runtime.registerQueueReleaseCallback({ receiptId, generation,
+      registeredAt: stamp() })
+  } catch (error) { runtime.close(); throw error }
+
+  let completed = false
+  return Object.freeze({
+    async complete({ payload, replyText, resolveTarget, sendReply,
+      confirmReply, paused = false } = {}) {
+      if (completed) throw new Error('C2 terminal bridge already used')
+      completed = true
+      if (!payload || typeof payload !== 'object' || Array.isArray(payload) ||
+          payload.type !== 'finalizeEffectCommit' ||
+          payload.receiptId !== receiptId || payload.turnToken !== turnToken ||
+          typeof payload.resultText !== 'string' ||
+          typeof paused !== 'boolean') {
+        runtime.close()
+        throw new TypeError('C2 terminal bridge payload differs from running turn')
+      }
+      try {
+        const terminal = runtime.commitTerminalEffect({ receiptId,
+          generation, turnToken, payload })
+        const final = terminal.effects.at(-1)
+        if (!final || final.effectId !== terminal.terminalEffectId ||
+            !['finalReply', 'quietCompletion'].includes(final.type)) {
+          throw new Error('C2 terminal bridge has no exact terminal effect')
+        }
+        for (const effect of terminal.effects.slice(0, -1)) {
+          if (!LOCAL_EFFECTS.has(effect.type)) {
+            throw new Error('C2 terminal bridge cannot apply unknown local effect')
+          }
+          if (typeof applyLocalEffect.claim === 'function') {
+            runtime.performLocalTerminalEffect({ effect, receiptId, chatId,
+              turnToken, generation, verifyGeneration, assertWriterLock,
+              applyLocalEffect })
+          } else {
+            // Older isolated callers retain the development seam. Production
+            // must supply the claimed, write-ahead executor above.
+            if (applyLocalEffect(effect) !== true) {
+              throw new Error('C2 terminal local effect lacks confirmed projection')
+            }
+            runtime.recordEffect(effect.effectId, 'acked')
+          }
+        }
+        const effect = { effectId: final.effectId, receiptId, chatId,
+          turnToken, generation, verifyGeneration }
+        if (final.type === 'quietCompletion') {
+          if (replyText !== undefined || resolveTarget !== undefined ||
+              sendReply !== undefined || confirmReply !== undefined) {
+            throw new Error('C2 quiet terminal may not send a reply')
+          }
+          await runtime.executeTerminalEffect(effect)
+        } else {
+          if (typeof replyText !== 'string' || !replyText ||
+              replyText !== terminalReplyText(payload) ||
+              typeof resolveTarget !== 'function' ||
+              resolveTarget.constructor?.name === 'AsyncFunction' ||
+              typeof sendReply !== 'function' ||
+              typeof confirmReply !== 'function' ||
+              confirmReply.constructor?.name === 'AsyncFunction') {
+            throw new TypeError('C2 final reply needs exact process-local text and sender')
+          }
+          await runtime.executeTerminalEffect({ ...effect, resolveTarget,
+            perform: ({ target }) => sendReply(target, replyText),
+            confirm: confirmReply })
+        }
+        const requested = runtime.commitReleaseRequested({ receiptId,
+          generation, turnToken, payloadHandles })
+        if (requested.effects.length !== 1 ||
+            requested.effects[0].type !== 'attemptQueueRelease') {
+          throw new Error('C2 terminal bridge release request differs')
+        }
+        // This is an internal queue instruction. The actual queue transition
+        // follows immediately; a crash in between leaves ingress closed.
+        runtime.recordEffect(requested.effects[0].effectId, 'acked')
+        const released = runtime.commitQueueRelease({ receiptId, generation,
+          turnToken, paused, payloadHandles })
+        const settlement = runtime.settleTerminalEffect({ effectId: final.effectId,
+          receiptId, chatId, turnToken, generation })
+        if (settlement.status !== 'acked' || !settlement.pruned) {
+          throw new Error('C2 terminal bridge settlement incomplete')
+        }
+        return { terminalEffectId: final.effectId, receiptId,
+          nextReceiptId: released.decision.nextJobId,
+          pendingEffects: released.effects.map(item => item.effectId) }
+      } catch (error) { runtime.close(); throw error }
+    },
+  })
+}
+
+module.exports = { prepareTerminalEffectBridge, terminalReplyText }

package/src/core/c2terminalprune.js

@@ -0,0 +1,108 @@
+'use strict'
+
+const { createHash } = require('node:crypto')
+const { isDeepStrictEqual } = require('node:util')
+const { validatePersistentRelation } = require('./c2persistrelation')
+
+// Development-only cleanup after every terminal intent has a durable ACK.
+// A pending or unknown effect keeps the lane for operator review.
+function pruneConfirmedTerminal({ journal, coordinator, scope } = {}) {
+  if (!journal || typeof journal.snapshot !== 'function' ||
+      typeof journal.effectStatus !== 'function' || typeof journal.hasEvent !== 'function' ||
+      !coordinator || typeof coordinator.snapshot !== 'function' ||
+      typeof coordinator.transition !== 'function' ||
+      typeof scope !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(scope)) {
+    throw new TypeError('C2 terminal prune needs durable journal, coordinator and scope')
+  }
+  const durable = journal.snapshot()
+  validatePersistentRelation(durable.state, durable.receipts)
+  if (durable.cursor !== durable.state.seq ||
+      !isDeepStrictEqual(coordinator.snapshot(), durable.state)) {
+    throw new Error('C2 terminal prune state differs from authority')
+  }
+  const lane = durable.state.lanes.terminal?.[scope]
+  if (!lane) return false
+  if (!lane.finalized || typeof lane.finalEventId !== 'string' ||
+      !Array.isArray(lane.pendingEffectIds)) throw new Error('C2 terminal lane is not final')
+  for (const effectId of lane.pendingEffectIds) {
+    if (journal.effectStatus(effectId) !== 'acked') {
+      throw new Error('C2 terminal effect lacks durable ACK')
+    }
+  }
+  // A v2 runner-close session is not settled by queue release. The terminal
+  // prune is the first reducer cursor after the external final effect and
+  // receipt have been atomically ACKed. Bind that cursor to the exact closed
+  // child so restart recovery can finish a crash between ACK and prune.
+  const finalEffectId = lane.pendingEffectIds.at(-1)
+  const finalDescriptor = journal.effectDescriptor(finalEffectId)
+  const v2Final = finalDescriptor?.domain === 'terminal' &&
+    ['finalReply', 'quietCompletion'].includes(finalDescriptor.type)
+  const session = durable.state.lanes.session?.[scope]
+  if (v2Final && !session) {
+    throw new Error('C2 terminal prune lacks closed session lane')
+  }
+  let sessionProof = null
+  if (session) {
+    const descriptor = finalDescriptor
+    const settlement = journal.terminalSettlement(finalEffectId)
+    const handoff = durable.state.lanes.handoff?.[scope]
+    const turn = durable.state.lanes.turn?.[scope]
+    const closed = typeof journal.runnerClosedProofs === 'function'
+      ? journal.runnerClosedProofs().filter(proof =>
+        proof.receiptId === descriptor?.receiptId && proof.chatId === scope &&
+        proof.turnToken === descriptor?.turnToken) : []
+    const proof = closed.length === 1 ? closed[0] : null
+    const completed = durable.receipts.completed.find(item =>
+      item.id === descriptor?.receiptId)
+    if (session.settled !== false || session.closeSeen !== true ||
+        session.epoch !== descriptor?.turnToken ||
+        turn?.epoch !== descriptor?.turnToken || turn?.active !== null ||
+        !handoff || !['idle', 'handoff'].includes(handoff.phase) ||
+        handoff.turnToken !== descriptor?.turnToken ||
+        descriptor?.domain !== 'terminal' || descriptor.scope !== scope ||
+        !['finalReply', 'quietCompletion'].includes(descriptor.type) ||
+        settlement?.receiptId !== descriptor.receiptId ||
+        settlement?.chatId !== scope ||
+        settlement?.turnToken !== descriptor.turnToken ||
+        completed?.settledAt !== settlement?.settledAt ||
+        !isDeepStrictEqual(settlement?.batchReceiptIds, lane.batchReceiptIds) ||
+        (lane.batchReceiptIds || [descriptor.receiptId]).some(id =>
+          !durable.receipts.completed.some(item =>
+            item.id === id && item.settledAt === settlement?.settledAt)) ||
+        !proof || !/^[0-9a-f]{32}$/.test(proof.generation || '') ||
+        proof.evidenceId !==
+          `sbot-c2-runner-closed-v1:${descriptor.receiptId}:${proof.generation}` ||
+        journal.lookupRunnerClosed(proof.evidenceId)?.dispatchEffectId !==
+          proof.dispatchEffectId ||
+        journal.effectStatus(proof.dispatchEffectId) !== 'acked' ||
+        !journal.hasEvent(`sbot-c2-session-close-v1:${descriptor.receiptId}:${proof.generation}`)) {
+      throw new Error('C2 terminal prune lacks settled receipt and closed session proof')
+    }
+    sessionProof = { receiptId: descriptor.receiptId,
+      turnToken: descriptor.turnToken, runnerGeneration: proof.generation,
+      closeEvidenceId: proof.evidenceId }
+  }
+  const eventId = `sbot-c2-terminal-prune-v1:${createHash('sha256')
+    .update(scope).update('\0').update(lane.finalEventId).digest('hex')}`
+  if (journal.hasEvent(eventId)) throw new Error('C2 terminal prune identity already committed')
+  const result = coordinator.transition({ id: eventId, domain: 'terminal', scope,
+    payload: { type: 'prune', finalEventId: lane.finalEventId,
+      effectsConfirmed: true, confirmedEffectIds: [...lane.pendingEffectIds],
+      ...(lane.batchReceiptIds ? { batchReceiptIds: [...lane.batchReceiptIds],
+        replyTargetReceiptId: lane.replyTargetReceiptId } : {}),
+      ...(sessionProof || {}) },
+    validate(candidate) {
+      if (candidate.effects?.length !== 0 || candidate.decision?.pruned !== true ||
+          candidate.state?.lanes?.terminal?.[scope] !== undefined ||
+          sessionProof && candidate.state?.lanes?.session?.[scope]?.settled !== true) {
+        throw new Error('C2 terminal prune returned invalid decision')
+      }
+    } })
+  if (journal.cursor !== durable.cursor + 1 ||
+      !isDeepStrictEqual(result.state, journal.snapshot().state)) {
+    throw new Error('C2 terminal prune was not durably committed')
+  }
+  return true
+}
+
+module.exports = { pruneConfirmedTerminal }