Embed service health readback in tool invoke

epiphany-core/src/bin/epiphany-verse-query.rs

@@ -6038,6 +6038,55 @@ fn run_invoke_tool_command(args: &Args) -> Result<()> {
         .iter()
         .find(|cluster| cluster.cluster_id == written_intent.host_cluster_id)
         .unwrap_or(host_cluster_from_directory);
+    let (service_health_readback, service_health_readback_private_state_exposed) =
+        if is_service_health_capability(capability) {
+            let overview = load_swarm_overview_report(args)?;
+            let service_action_rows = overview
+                .swarm_action_rows
+                .iter()
+                .filter(|row| {
+                    row.family == "service-lifecycle" || row.family == "service-execution-authority"
+                })
+                .cloned()
+                .collect::<Vec<_>>();
+            let service_action_tui_rows = service_action_rows
+                .iter()
+                .map(swarm_action_tui_row)
+                .collect::<Vec<_>>();
+            let private_state_exposed = overview
+                .service_lifecycle_attention_rows
+                .iter()
+                .any(|row| row.private_state_exposed)
+                || overview
+                    .service_execution_failed_check_rows
+                    .iter()
+                    .any(|check| !check.private_state_sealed)
+                || service_action_rows
+                    .iter()
+                    .any(|row| row.private_state_exposed);
+            (
+                json!({
+                    "status": overview.recovery_status,
+                    "recommendedWrapperMode": overview.service_lifecycle_recommended_wrapper_mode,
+                    "recommendedWrapperCommand": overview.service_lifecycle_recommended_wrapper_command,
+                    "serviceLifecycleAttentionCount": overview.service_lifecycle_attention_rows.len(),
+                    "serviceLifecycleAttentionRows": overview.service_lifecycle_attention_rows,
+                    "serviceLifecycleAttentionTuiRows": overview.service_lifecycle_attention_tui_rows,
+                    "serviceExecutionFailedCheckCount": overview.service_execution_failed_check_count,
+                    "serviceExecutionMissingCheckCount": overview.service_execution_missing_check_count,
+                    "serviceExecutionFailedCheckRows": overview.service_execution_failed_check_rows,
+                    "serviceExecutionFailedCheckTuiRows": overview.service_execution_failed_check_tui_rows,
+                    "serviceActionRows": service_action_rows,
+                    "serviceActionTuiRows": service_action_tui_rows,
+                    "privateStateExposed": private_state_exposed,
+                }),
+                private_state_exposed,
+            )
+        } else {
+            (serde_json::Value::Null, false)
+        };
+    let private_state_exposed =
+        written_receipt.private_state_exposed || service_health_readback_private_state_exposed;
     let invocation_tui_row = daemon_tool_invocation_tui_row(DaemonToolInvocationTuiFields {
         requester: &requesting_cluster.display_name,
         requesting_agent_id: &written_intent.requesting_agent_id,
@@ -6058,7 +6107,7 @@ fn run_invoke_tool_command(args: &Args) -> Result<()> {
         authority_gate: &written_intent.authority_gate,
         all_agents: capability.available_to_all_agents,
         requires_receipt: written_intent.requires_receipt,
-        private_state_exposed: written_receipt.private_state_exposed,
+        private_state_exposed,
     });
     println!(
         "{}",
@@ -6091,7 +6140,9 @@ fn run_invoke_tool_command(args: &Args) -> Result<()> {
             "requiresReceipt": written_intent.requires_receipt,
             "authorityGate": written_intent.authority_gate,
             "privateStateRequested": written_intent.private_state_requested,
-            "privateStateExposed": written_receipt.private_state_exposed,
+            "serviceHealthReadback": service_health_readback,
+            "serviceHealthReadbackPrivateStateExposed": service_health_readback_private_state_exposed,
+            "privateStateExposed": private_state_exposed,
             "invocationRows": [invocation_tui_row.clone()],
             "tuiRows": [invocation_tui_row],
         }))?

state/map.yaml

@@ -123,7 +123,7 @@ active_subgoals:
 
 accepted_design:
   - Distributed Epiphany dreaming is a CultMesh typed-document problem, not prompt folklore. CultCache owns local typed documents, Epiphany owns export/import/adoption policy, CultNet owns wire/provenance/shard delivery, and CultMesh owns Verses, peer exchange, leases, shard logs, replicas, and watchable runtime surfaces. Start with local dream document types and a local store before public Verse wiring.
-  - The local CultMesh daemon tool directory now has both discovery and invocation receipts at the operator edge. `epiphany-verse-query tools` lists globally available, receipt-gated daemon capabilities; `epiphany-verse-query invoke-tool --capability-id <id>` records `epiphany.cultmesh.daemon_tool_invocation_intent.v0` plus `epiphany.cultmesh.daemon_tool_invocation_receipt.v0` from the advertised capability, reports requesting/host display names, body domains, private Verse ids, and Eve surfaces from cluster topology, and refuses when the host daemon is not ready. `tools/epiphany_local_run.ps1 -Mode tool-invoke` wraps the same path with explicit requester/capability/intent/receipt parameters; wrapper proof routed Persona to Hands `repo-action` and returned `availableToAllAgents=true`, `requiresReceipt=true`, and `privateStateExposed=false`. Tool availability is global across local agents, but execution and authority remain with the hosting daemon and its typed receipt contract.
+  - The local CultMesh daemon tool directory now has both discovery and invocation receipts at the operator edge. `epiphany-verse-query tools` lists globally available, receipt-gated daemon capabilities; `epiphany-verse-query invoke-tool --capability-id <id>` records `epiphany.cultmesh.daemon_tool_invocation_intent.v0` plus `epiphany.cultmesh.daemon_tool_invocation_receipt.v0` from the advertised capability, reports requesting/host display names, body domains, private Verse ids, and Eve surfaces from cluster topology, and refuses when the host daemon is not ready. `tools/epiphany_local_run.ps1 -Mode tool-invoke` wraps the same path with explicit requester/capability/intent/receipt parameters; wrapper proof routed Persona to Hands `repo-action` and returned `availableToAllAgents=true`, `requiresReceipt=true`, and `privateStateExposed=false`. Tool availability is global across local agents, but execution and authority remain with the hosting daemon and its typed receipt contract. The Self-hosted `service-health` tool now embeds `serviceHealthReadback` in the invocation result instead of only pointing at receipt-directory: live wrapper proof `local-20260619-013750-366-f5ad69b0` returned status `attention`, two service lifecycle attention rows, four service action rows, eleven failed checks, zero missing checks, and no private-state exposure.
   - The local Verse swarm brake is now operator-writable from the same CLI surface and enforced at the main local wrapper plus direct coordinator/heartbeat runner edges. `epiphany-verse-query swarm-brake --brake-status engaged|released` writes the typed `epiphany.cultmesh.swarm_brake.v0` document with scope, reason, operator id, affected clusters, protected surfaces, expiry, and private-state seal. `tools/epiphany_local_run.ps1` queries that document before live `plan`, `run`, or `mvp` work and fails closed when engaged; `status` remains readable. `epiphany-mvp-coordinator --local-verse-store <path>` refuses before app-server startup when the brake is engaged, and `epiphany-heartbeat-store tick|pump|heat|queue-mention|routine --local-verse-store <path>` refuses heartbeat-driving work while leaving init/status/complete/repair-stale outside that live-run brake.
   - The first Rust CultMesh integration slice is landed and repaired to compile from repo-contained vendored crates. `vendor/cultmesh-rs` is a small Rust node/database facade over vendored CultCache and CultNet with document-set registration and durable typed put/get/delete. `vendor/cultcache-rs` now reads and writes the `cultcache.store.v1` snapshot format used by `state/ledgers.msgpack`, so `epiphany-state status` is a working re-entry rite again. `epiphany-core` depends on `vendor/cultcache-rs`, `vendor/cultnet-rs`, and `vendor/cultmesh-rs`, exposes an `EpiphanyCultMeshStatusEntry`, records typed `EpiphanyCultMeshVersePolicyEntry` documents for the internal/local-area/global Verse tiers, and records typed `EpiphanyCultMeshGlobalRoomPolicyEntry` documents for threaded public global rooms such as dreams, architecture, research, Personas, GameCult, and governance. Native operator status is now a typed `EpiphanyCultMeshOperatorStatusEntry` in the internal Verse; it names Codex as bridge transport, Epiphany as authority owner, prompt-authority separation, and the quarantined Rider/Unity optional surfaces. Native operator snapshots are typed `EpiphanyCultMeshOperatorSnapshotEntry` documents distilled from operator-safe status artifacts; local status runs write operator run intent, operator snapshot, and run receipt into `.epiphany-run/cultmesh/local-verse.ccmp`, leaving JSON artifacts as display/evidence rather than the local-run read authority.
   - Mind's CultNet contract surface is native enough for the next Aquarium/CultMesh cut: `epiphany-core::mind_gateway` defines thought, state-effect proposal, gateway-review, commit-receipt, rejection-receipt, and Verse-adoption document contracts; runtime-spine advertises those mutation/read contracts; CultMesh persists matching `EpiphanyCultMeshMindContractEntry` policy documents so the private state guardian boundary is inspectable as typed state.
@@ -618,7 +618,7 @@ current_status:
   - `epiphany-verse-query restart-policy-directory` and `tools/epiphany_local_run.ps1 -Mode service-policy-directory` provide the compact scheduler coverage sight organ. It reads daemon topology/status plus durable `epiphany.cultmesh.daemon_restart_policy.v0` rows through a narrow CultMesh restart-policy directory loader, reports each daemon as `ENABLED`, `DISABLED`, or `MISSING`, treats disabled and missing policies as recovery attention, returns covered/enabled/disabled/missing/attention counts, and publishes explicit policy-write plus scheduler-tick follow-up commands without creating or mutating policies. Compact TUI rows now expose `owner=Idunn`, `hostedBody=Epiphany`, cooldown, reconcile interval, heartbeat stale threshold, failure count, last result, `followUp=<command>`, and `private=false`; wrapper proof `local-20260619-003720-135-799146f3` prints the Rust-owned `tuiRows` directly for all seven faculties as `ENABLED` with `owner=Idunn`, `hostedBody=Epiphany`, `last=ready`, `cooldown=30s`, `reconcile=60s`, `stale=300s`, `followUp=tools/epiphany_local_run.ps1 -Mode service-tick`, and `private=false`, instead of rebuilding policy text in PowerShell. Direct and wrapper proof now report seven daemons, seven covered policies, seven enabled policies, zero disabled, zero missing, zero attention, `status=ok`, `lifecycleOwner=Idunn`, `hostedBody=Epiphany`, and `privateStateExposed=false`. This is a real Idunn-owned daemon heartbeat body with non-mutating per-organ launch and install artifacts, but not yet executed installed per-organ OS services.
   - `https://gamecult.org/Blog/purge-the-heretek-from-our-daemonic-swarm` is a public doctrine receipt for the Perfect Machine audit pressure: organs must not borrow each other's crowns, witnesses need owning mouths, surfaces reflect rather than rule, and cross-repo purification needs Bifrost-shaped ledger evidence instead of relying on recoverable transcripts or commit trails alone.
   - `tools/epiphany_local_run.ps1` now uses collision-resistant local run ids (`local-YYYYMMDD-HHMMSS-fff-<guid8>`) for artifact roots and operator run receipts. Same-second parallel compact wrapper proofs for `collaboration-feedback` and `bifrost-publication` produce separate artifact drawers and both complete, so operator rites no longer collide on second-resolution run ids.
-  - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns seventeen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits, authority gate, and advertised payload/review contract types, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | authority=hands | input=epiphany.hands.action_intent | receiptType=epiphany.hands.action_review | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260618-233719-320-e38a5549` prints all seventeen rows in the one-line `toolRows` summary, including Self `service-health` as `readServiceLifecycleStatus` with `authority=daemon.service_lifecycle`, `input=epiphany.cultmesh.daemon_service_lifecycle_query`, and `receiptType=epiphany.cultmesh.daemon_service_lifecycle_receipt`, plus Eve connection tools, Hands `repo-action`, and Soul `verify`. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; live wrapper proof `local-20260618-181426-520-e3b051b8` routed Persona to Hands `repo-action` and printed the full compact row.
+  - `epiphany-verse-query tool-directory` and `tools/epiphany_local_run.ps1 -Mode tool-directory` provide the compact daemon tool sight organ over the same local Verse capability records used by `invoke-tool`. It returns seventeen globally available daemon-hosted capabilities, host readiness counts, direct `invocationCommand`, wrapper `wrapperInvocationCommand=tools/epiphany_local_run.ps1 -Mode tool-invoke -ToolCapabilityId <capability> -ToolRequestingAgentId <agent> -ToolRequestingClusterId <cluster>`, and the invariants `availableToAllAgents=true`, `requiresReceipt=true`, `privateStateExposed=false`. Agent-friendly TUI rows now carry the same contract bits, authority gate, and advertised payload/review contract types, e.g. `READY | Hands | repo-action | submitHandsActionIntent | epiphany.cluster.hands.tool.repo-action | eve://epiphany/hands | authority=hands | input=epiphany.hands.action_intent | receiptType=epiphany.hands.action_review | allAgents=true | receipt=true | private=false`; wrapper proof `local-20260618-233719-320-e38a5549` prints all seventeen rows in the one-line `toolRows` summary, including Self `service-health` as `readServiceLifecycleStatus` with `authority=daemon.service_lifecycle`, `input=epiphany.cultmesh.daemon_service_lifecycle_query`, and `receiptType=epiphany.cultmesh.daemon_service_lifecycle_receipt`, plus Eve connection tools, Hands `repo-action`, and Soul `verify`. `invoke-tool` runs through a smaller extracted command handler and emits compact invocation rows with requester/host display names, requesting/host private Verses and Eve surfaces, host daemon id, tool operation, capability id, intent id, receipt id/status, authority gate, `allAgents=true`, `receiptRequired=true`, and `private=false`; service-health invocation additionally embeds `serviceHealthReadback` with Idunn lifecycle attention/action/failed-check rows so agents get the readback through the advertised daemon tool without opening full local Verse state.
   - `epiphany-verse-query cluster-topology` and `tools/epiphany_local_run.ps1 -Mode cluster-topology` provide the compact cluster/body/private-Verse/daemon sight organ over local Verse topology rows through a narrow CultMesh loader. The report returns seven clusters, seven private Verse ids, seven daemon ids, one public Persona discussion cluster, agent-friendly TUI rows such as `PUBLIC | Persona | cluster=epiphany.cluster.persona | role=Persona | privateVerse=epiphany.cluster.persona.private | body=repo:E:/Projects/EpiphanyAgent | bodyKind=repository | daemon=epiphany-daemon-persona | surface=eve://epiphany/persona`, and `privateStateExposed=false`; `epiphany-verse-query smoke` source-proves the compact topology invariants, and wrapper proof `local-20260618-225347-337-cea74491` prints all seven standing-faculty rows in the one-line `topologyRows` summary.
   - `epiphany-verse-query swarm-overview` and `tools/epiphany_local_run.ps1 -Mode swarm-overview` provide the one-command compact global-agent sight rite. It composes narrow cluster topology, liveness, Odin/Eve surface, daemon tool, restart-policy coverage, receipt-directory service-lifecycle attention, and the shared core service-execution audit report without full local Verse serialization, returning seven agents/daemons, seven clusters, seven private Verse ids, seven Eve surfaces, one public Persona discussion surface, sixteen globally invokable receipt-gated tools, command hints for topology/liveness/surfaces/tools/receipts/poke/connect/invoke/Bifrost-ledger/restart-policy coverage, wrapper command hints for overview/swarm-online-runbook/receipts/poke/connect/tool-invoke/Bifrost-ledger/service-policy-directory/service-execution-audit, sealed `toolHostAttentionRows`/TUI rows for blocked daemon-hosted capabilities, sealed `serviceLifecycleAttentionRows`/TUI rows copied from the receipt directory, `serviceExecutionFailedCheckRows`/TUI rows naming failed sealed execution checks, explicit `serviceLifecycleRecommended*` fields so service-manager follow-up remains visible even when global `recommendedWrapperMode` is occupied by liveness or policy, and ordered `swarmActionRows`/TUI rows with authority gates, effect class, wrapper command, mutation flag, elevation flag, sealed `operatorArtifactRef`, `operatorArtifactStatus`, `operatorArtifactSha256`, `operatorArtifactExecutionCommand`, `operatorAftercareCommand`, and `completionAuditWrapper*` for operator-runbook rows. Compact action TUI rows now also render `aftercare=<command>`, so the Rust-owned row itself names the post-run audit command instead of relying on wrapper compatibility summaries. Current live overview `local-20260619-001128-955-195f4e65` returns `status=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `recommendedWrapperMode=swarm-online-runbook`, `recommendedWrapperCommand=tools/epiphany_local_run.ps1 -Mode swarm-online-runbook`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `toolHostAttentionCount=0`, `serviceLifecycleAttentionCount=2`, `swarmActionCount=4`, non-mutating service lifecycle readback rows with `aftercare=none`, and elevated service authority rows with `aftercare=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` / `aftercare=tools/epiphany_local_run.ps1 -Mode service-execution-audit`, present runbook artifacts, SHA-256 provenance, failed/missing check counts, and `privateStateExposed=false`. `tools/epiphany_local_run.ps1 -Mode swarm-online-runbook` now prints and stores the swarm-level elevated command for its generated Idunn-owned artifact, and the generated parent runbook verifies each child runbook artifact exists and matches its advertised SHA-256 before launching it elevated, then runs aftercare audits through the known wrapper `ScriptPath` plus explicit argument arrays instead of string evaluation. The operator sees the exact `Start-Process PowerShell -Verb RunAs -Wait ...` command, parent artifact hash, child hash guard, aftercare, owner, hosted body, and private-state seal before granting service mutation authority; the wrapper JSON also carries structured `childRunbookRows` and `aftercareRows` with service ids, routes, SHA-256s, audit modes, authority gates, failed-check counts, and private-state seals. Live proof `local-20260619-013021-159-c93088be` generated the parent artifact with two child rows, two aftercare rows, `usesExplicitAftercareArguments=true`, no `Invoke-Expression`, child hash guards, and wrapper-path aftercare calls. If a local runbook artifact is missing, source smoke proves the same row is demoted to `status=runbook-artifact-missing`, `wrapperMode=cluster-service-execution-runbook`, `effectClass=service-lifecycle-runbook-regeneration`, `operatorArtifactSha256=none`, `operatorArtifactExecutionCommand=none`, `operatorAftercareCommand=none`, `mutatesState=false`, and `requiresElevatedAuthority=false` instead of pretending elevated service authority is actionable. Degraded daemon overview still routes global recommendation to `swarm-poke-down` first while independent action rows preserve the liveness/tool-host duties; liveness action rows are explicitly mutating typed lifecycle pokes but do not require elevation, while service execution authority rows make the operator grant boundary visible. `epiphany-verse-query` defaults to the shared `.epiphany-run\cultmesh\local-verse.ccmp` store for live query/readback, while bare `epiphany-verse-query smoke` now uses a disposable `.epiphany-smoke\verse-query-default\local-verse.ccmp` fixture unless an explicit `--store` is provided.
   - `epiphany-verse-query swarm-triage` and `tools/epiphany_local_run.ps1 -Mode swarm-triage` compose the compact swarm overview with the existing brake-aware daemon poke receipt writer. Triage pokes only daemon liveness attention; service-manager lifecycle wounds are reflected from overview as sealed `serviceLifecycleAttentionRows`/TUI rows, `serviceExecutionFailedCheckRows`/TUI rows, explicit `serviceLifecycleRecommended*` fields, and ordered `swarmActionRows`, but do not cause daemon poke receipts, while blocked daemon-hosted tools ride as sealed `toolHostAttentionRows`/TUI rows so agents can see which advertised capabilities are unavailable because their host body is sick. Current live triage `local-20260618-150015-844-aba20563` returns `status=noop`, `overviewStatus=attention`, `livenessStatus=ready`, `recoveryStatus=attention`, `clusterCount=7`, `privateVerseCount=7`, `pokedDaemonCount=0`, `recommendedWrapperMode=cluster-service-execution-audit`, `serviceLifecycleRecommendedWrapperMode=cluster-service-execution-audit`, `swarmActionCount=2`, the same sealed service readback plus operator-elevated runbook rows, including `operatorArtifactStatus=present`, `operatorArtifactRef=E:\Projects\EpiphanyAgent\.epiphany-run\local-20260618-132257-139-26213a29\epiphany-cluster-daemon-services-execution-runbook.ps1`, and `completionAuditWrapperCommand=tools/epiphany_local_run.ps1 -Mode cluster-service-execution-audit` on the elevated row, empty daemon/tool-host attention arrays, `serviceLifecycleAttentionCount=2`, routes `epiphany-cluster-daemon-services::cluster-windows-service-execution-audit` and `epiphany-daemon-supervisor-service::windows-service-execution-audit`, direct and wrapper command hints including `wrapperInvokeTool` and `wrapperBifrostLedger=tools/epiphany_local_run.ps1 -Mode bifrost-ledger`, and `privateStateExposed=false`; degraded Hands proof returns `status=ok`, `overviewStatus=attention`, topology and daemon TUI rows, blocked Hands-hosted tool rows, one sealed topology-aware poke receipt for `epiphany-daemon-hands` with `bodyDomain=repo:E:/Projects/EpiphanyAgent`, `privateVerseId=epiphany.cluster.hands.private`, `eveSurfaceId=eve://epiphany/hands`, `observedStatus=degraded`, `attentionDaemonIds=[epiphany-daemon-hands]`, `attentionToolHostDaemonIds=[epiphany-daemon-hands]`, and liveness/tool-host action rows with no private-state exposure. Source smoke `verse-query-service-execution-failed-checks-clean` proves a physical synthetic written runbook plus incomplete service audit receipts expose both service lifecycle readback and failed-check anatomy with no Windows service mutation.

tools/epiphany_local_run.ps1

@@ -2066,7 +2066,11 @@ if ($resultPath -ne "" -and (Test-Path -LiteralPath $resultPath)) {
             if ($null -ne $result.invocationRows -and $result.invocationRows.Count -gt 0) {
                 $invocationRows = ($result.invocationRows -join "; ")
             }
-            Write-Host "Tool invoke: status=$($result.status), requester=$($result.requestingDisplayName), host=$($result.hostDisplayName), tool=$($result.toolName), receipt=$($result.receiptId), invocationRows=$invocationRows, privateStateExposed=$($result.privateStateExposed)"
+            $serviceHealth = "none"
+            if ($null -ne $result.serviceHealthReadback -and $null -ne $result.serviceHealthReadback.status) {
+                $serviceHealth = "status=$($result.serviceHealthReadback.status):attentionRows=$(@($result.serviceHealthReadback.serviceLifecycleAttentionRows).Count):actionRows=$(@($result.serviceHealthReadback.serviceActionRows).Count):failedChecks=$($result.serviceHealthReadback.serviceExecutionFailedCheckCount):missingChecks=$($result.serviceHealthReadback.serviceExecutionMissingCheckCount):private=$($result.serviceHealthReadback.privateStateExposed)"
+            }
+            Write-Host "Tool invoke: status=$($result.status), requester=$($result.requestingDisplayName), host=$($result.hostDisplayName), tool=$($result.toolName), receipt=$($result.receiptId), serviceHealth=$serviceHealth, invocationRows=$invocationRows, privateStateExposed=$($result.privateStateExposed)"
         } elseif ($Mode -eq "swarm-overview" -or $Mode -eq "gjallar") {
             $attention = "none"
             if ($null -ne $result.attentionDaemonIds -and $result.attentionDaemonIds.Count -gt 0) {