@ccmsg/cli 0.12.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccmsg/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "The ccmsg daemon, CLI and agent plugins for one instance (= one config home)",
   "license": "MIT",
   "author": "kawaz",
@@ -20,7 +20,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ccmsg/protocol": "1.22.0"
+    "@ccmsg/protocol": "1.23.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",

package/src/auth/admin.ts

@@ -51,7 +51,10 @@ export interface Administered {
 }
 
 /** Run one administrative request. */
-export function handleAdmin(at: Administered, request: AdminRequest): DispatchResult {
+export async function handleAdmin(
+  at: Administered,
+  request: AdminRequest,
+): Promise<DispatchResult> {
   const auth = at.auth;
   try {
     switch (request.admin) {
@@ -77,7 +80,7 @@ export function handleAdmin(at: Administered, request: AdminRequest): DispatchRe
       case "passkey_list":
         return reply(request.request_id, { credentials: auth.list() });
       case "passkey_remove": {
-        const { closed } = auth.remove(request.sub);
+        const { closed } = await auth.remove(request.sub);
         return reply(request.request_id, { sub: request.sub, closed });
       }
     }

package/src/auth/auth.ts

@@ -316,8 +316,8 @@ export class Auth {
   }
 
   /** Remove one person: the tombstones, and every connection they hold. */
-  remove(sub: Subject): { records: AuthRecord[]; closed: number } {
-    const records = this.deps.records.remove(sub);
+  async remove(sub: Subject): Promise<{ records: AuthRecord[]; closed: number }> {
+    const records = await this.deps.records.remove(sub);
     return { records, closed: this.disconnect(sub) };
   }
 
@@ -340,8 +340,8 @@ export class Auth {
   }
 
   /** Take what a peer wrote on `auth.records`, and act on the removals in it. */
-  merge(records: readonly AuthRecord[]): void {
-    const { removed } = this.deps.records.merge(records);
+  async merge(records: readonly AuthRecord[]): Promise<void> {
+    const { removed } = await this.deps.records.merge(records);
     for (const sub of removed) this.disconnect(sub);
   }
 
@@ -479,7 +479,7 @@ export class Auth {
       ...(from.ip === undefined ? {} : { registered_ip: from.ip }),
       ...(from.userAgent === undefined ? {} : { registered_user_agent: from.userAgent }),
     };
-    this.deps.records.write(credentialKey(claims.sub, verified.credentialId), record, at);
+    await this.deps.records.write(credentialKey(claims.sub, verified.credentialId), record, at);
     return this.mint(claims.sub);
   }
 
@@ -488,7 +488,7 @@ export class Auth {
    * Only its issuer can say, because only the issuer holds the secret that
    * signed it — and the six digits are held beside that secret. So the digits
    * travel there unjudged: an instance that decided them itself would let
-   * somebody spread guesses across the cluster without any of them counting
+   * somebody spread guesses across the mesh without any of them counting
    * against the URL (contract, `AuthResolveArgs`). Nothing is spent here.
    *
    * The claims come back from the issuer having been checked and consumed, and
@@ -589,7 +589,7 @@ export class Auth {
     );
     await this.#spendAnywhere(args.challenge);
     const at = this.#now();
-    this.deps.records.write(
+    await this.deps.records.write(
       credentialKey(record.sub, record.credential_id),
       {
         ...record,
@@ -654,7 +654,7 @@ export class Auth {
   // --- tokens (DR-0001 §2.4) ---
 
   /** Make a family for this person, minted by this instance. */
-  mint(sub: Subject): MintedSession {
+  async mint(sub: Subject): Promise<MintedSession> {
     const at = this.#now();
     const family: TokenFamily = {
       kind: "token_family",
@@ -664,7 +664,7 @@ export class Auth {
       refresh: { value: token(), expires_at: at + REFRESH_TTL_MS },
     };
     const id = randomBytes(8).toString("hex");
-    this.deps.records.write(familyKey(sub, id), family, at);
+    await this.deps.records.write(familyKey(sub, id), family, at);
     return { session: { sub, access: family.access }, refresh: family.refresh };
   }
 
@@ -698,7 +698,7 @@ export class Auth {
       } satisfies AuthRotateArgs)) as AuthRotateResult;
       return { session: { sub: answer.sub, access: answer.access }, refresh: answer.refresh };
     }
-    const rotated = this.rotate(value, from);
+    const rotated = await this.rotate(value, from);
     return { session: { sub: rotated.sub, access: rotated.access }, refresh: rotated.refresh };
   }
 
@@ -714,7 +714,7 @@ export class Auth {
     const owner = this.deps.records.owning(value, digestOf(value));
     if (owner === undefined) return;
     if (owner.body.iss === this.deps.self) {
-      this.#failReused(value);
+      await this.#failReused(value);
       return;
     }
     try {
@@ -730,10 +730,10 @@ export class Auth {
 
   /** Rotate a family this instance minted. The one writer's own operation, and
    * what `auth.rotate` runs on its behalf. */
-  rotate(value: Base64Url, from: RefreshFrom = {}): AuthRotateResult {
+  async rotate(value: Base64Url, from: RefreshFrom = {}): Promise<AuthRotateResult> {
     const held = this.deps.records.byRefresh(value);
     if (held === undefined) {
-      this.#failReused(value);
+      await this.#failReused(value);
       throw new OpError("auth_invalid", "この refresh token は使えません");
     }
     if (held.body.iss !== this.deps.self) {
@@ -777,7 +777,7 @@ export class Auth {
       // holds wherever the reused value is presented (contract, `TokenFamily`).
       retired: retire(held.body, at),
     };
-    this.deps.records.write(held.key, rotated, at);
+    await this.deps.records.write(held.key, rotated, at);
     return { sub: rotated.sub, access: rotated.access, refresh: rotated.refresh };
   }
 
@@ -789,7 +789,7 @@ export class Auth {
    * before it past its grace, and any generation this instance rotated away
    * while it has been running. A value older than what any of those covers
    * matches nothing and is refused as a stranger. */
-  #failReused(value: Base64Url): void {
+  async #failReused(value: Base64Url): Promise<void> {
     const digest = digestOf(value);
     const now = this.#now();
     for (const held of this.deps.records.families()) {
@@ -805,7 +805,7 @@ export class Auth {
       this.deps.log?.("a refresh token was reused after it was rotated away", {
         sub: held.body.sub,
       });
-      this.deps.records.fail(held.key);
+      await this.deps.records.fail(held.key);
       // The tokens are gone, and so is what they were holding open: a
       // connection that outlived the family it was admitted on would be the
       // stolen token still working.
@@ -932,7 +932,7 @@ export function authHandlers(auth: Auth) {
       // the URL and the count of tries against it (DR-0001 §2.2).
       return { kind: "register", claims: auth.resolveRegistration(args.token, args.code) };
     },
-    "auth.rotate": (input: HandlerInput): AuthRotateResult => {
+    "auth.rotate": (input: HandlerInput): Promise<AuthRotateResult> => {
       const args = input.args as unknown as AuthRotateArgs;
       // The receiving instance's account of the person, taken as stated: it is
       // the only one that saw them, and `last_refresh` is a hint nothing is

package/src/auth/records.ts

@@ -1,5 +1,6 @@
-import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
+import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import type {
   AuthRecord,
   AuthTombstone,
@@ -81,9 +82,13 @@ export interface RecordsDeps {
  * and in the authenticator, and losing a family logs its person out. */
 export class AuthRecords {
   readonly #records = new Map<string, AuthRecord>();
-  #loaded = false;
 
-  constructor(private readonly deps: RecordsDeps) {}
+  /** The writes already asked for, as one chain. */
+  #writing: Promise<void> = Promise.resolve();
+
+  constructor(private readonly deps: RecordsDeps) {
+    this.#read();
+  }
 
   #now(): Timestamp {
     return (this.deps.now ?? Date.now)();
@@ -94,7 +99,6 @@ export class AuthRecords {
    * Answers whether the set moved, which is what decides whether the change is
    * worth writing down and passing on. */
   accept(record: AuthRecord): boolean {
-    this.#load();
     const held = this.#records.get(record.key);
     if (held !== undefined && held.updated_at >= record.updated_at) return false;
     if (this.#refused(record)) return false;
@@ -127,7 +131,7 @@ export class AuthRecords {
     }
   }
 
-  /** Write one record of this instance's own, and tell the cluster.
+  /** Write one record of this instance's own, and tell the mesh.
    *
    * A local write always displaces what the key holds. Last-write-wins settles
    * a disagreement between instances; this is not one — the writer is the
@@ -135,13 +139,18 @@ export class AuthRecords {
    * millisecond, which a rotation and the mint before it easily do, must not
    * silently drop the second. So the instant is moved past what is held rather
    * than compared against it. */
-  write(key: string, body: AuthRecord["body"], now: Timestamp = this.#now()): boolean {
-    this.#load();
+  async write(
+    key: string,
+    body: AuthRecord["body"],
+    now: Timestamp = this.#now(),
+  ): Promise<boolean> {
     const held = this.#records.get(key);
     const at = held === undefined ? now : Math.max(now, held.updated_at + 1);
     const record: AuthRecord = { key, updated_at: at, body };
     if (!this.accept(record)) return false;
-    this.#persist();
+    // Handed to the peers once it is written down, so no peer holds a record
+    // this instance would not have after a restart.
+    await this.#persist();
     this.deps.publish([record]);
     return true;
   }
@@ -156,7 +165,7 @@ export class AuthRecords {
    * This instance is its only writer, so a copy coming back is a copy of an
    * older state — which is exactly what a failed family looks like from a peer
    * that has not heard yet, and taking it would undo the failure. */
-  merge(records: readonly AuthRecord[]): { changed: number; removed: Subject[] } {
+  async merge(records: readonly AuthRecord[]): Promise<{ changed: number; removed: Subject[] }> {
     let changed = 0;
     const removed: Subject[] = [];
     for (const record of records) {
@@ -165,7 +174,7 @@ export class AuthRecords {
       changed += 1;
       if (record.body.kind === "tombstone") removed.push(record.body.sub);
     }
-    if (changed > 0) this.#persist();
+    if (changed > 0) await this.#persist();
     return { changed, removed };
   }
 
@@ -175,7 +184,7 @@ export class AuthRecords {
    * lengths of time. A family expires with its refresh token, so the mark over
    * it only has to outlive the longest one; a credential has no expiry of its
    * own, so the mark over it has none either (DR-0001 §2.6). */
-  remove(sub: Subject): AuthRecord[] {
+  async remove(sub: Subject): Promise<AuthRecord[]> {
     const at = this.#now();
     const credential: AuthTombstone = { kind: "tombstone", sub, deleted_at: at };
     const family: AuthTombstone = {
@@ -189,7 +198,7 @@ export class AuthRecords {
       { key: familyPrefix(sub), updated_at: at, body: family },
     ];
     for (const mark of marks) this.accept(mark);
-    this.#persist();
+    await this.#persist();
     this.deps.publish(marks);
     return marks;
   }
@@ -197,13 +206,11 @@ export class AuthRecords {
   /** Whether this subject has been removed, which is what a registration for
    * one has to be refused by. */
   removed(sub: Subject): boolean {
-    this.#load();
     const held = this.#records.get(credentialPrefix(sub));
     return held?.body.kind === "tombstone";
   }
 
   credentials(): CredentialRecord[] {
-    this.#load();
     const found: CredentialRecord[] = [];
     for (const record of this.#records.values()) {
       if (record.body.kind === "credential") found.push(record.body);
@@ -228,7 +235,6 @@ export class AuthRecords {
   }
 
   families(): { key: string; body: TokenFamily }[] {
-    this.#load();
     const found: { key: string; body: TokenFamily }[] = [];
     for (const record of this.#records.values()) {
       if (record.body.kind === "token_family") found.push({ key: record.key, body: record.body });
@@ -275,12 +281,11 @@ export class AuthRecords {
    * the key, which is exactly what a revoked family needs. It is kept for the
    * same seven days a removal's is: past the longest refresh token, there is
    * nothing left for a returning peer to revive. */
-  fail(key: string): void {
-    this.#load();
+  async fail(key: string): Promise<void> {
     const held = this.#records.get(key);
     if (held === undefined || held.body.kind !== "token_family") return;
     const at = this.#now();
-    this.write(key, {
+    await this.write(key, {
       kind: "tombstone",
       sub: held.body.sub,
       deleted_at: at,
@@ -306,7 +311,6 @@ export class AuthRecords {
 
   /** Every record, for the snapshot a peer's subscription is answered with. */
   all(): AuthRecord[] {
-    this.#load();
     this.#expire();
     return [...this.#records.values()];
   }
@@ -330,9 +334,19 @@ export class AuthRecords {
     }
   }
 
-  #load(): void {
-    if (this.#loaded) return;
-    this.#loaded = true;
+  /** Settle once every write asked for so far has landed. What a stop waits on
+   * before it lets go of the config home (DESIGN §8.5 step 4). */
+  async flush(): Promise<void> {
+    await this.#writing;
+  }
+
+  /** The file, read as this is built — before the instance is accepting
+   * anything, so nobody is waiting on it (DR-0015). Reading it when the first
+   * authentication asked would put the read inside the turn that answers it,
+   * and the `auth.records` snapshot is answered from what is held rather than
+   * from a promise. A file that is not there is an instance nobody has
+   * registered against, which is what an empty set says. */
+  #read(): void {
     let text: string;
     try {
       text = readFileSync(this.#file(), "utf8");
@@ -356,21 +370,34 @@ export class AuthRecords {
     this.#expire();
   }
 
-  #persist(): void {
+  /** The set as it stands, written whole.
+   *
+   * The body is taken here, before anything is awaited, so what is written is
+   * the set as it was when the change was answered; the writes are chained so
+   * that two of them cannot be racing for one file and the older land last
+   * (DR-0015). */
+  #persist(): Promise<void> {
     this.#expire();
-    mkdirSync(this.deps.dir, { recursive: true, mode: 0o700 });
-    const file = this.#file();
-    const temporary = `${file}.ccmsg-${String(process.pid)}-${String(Date.now())}`;
-    // The set holds tokens, so the file is the instance's own to read: it is
-    // created with the mode rather than fixed afterwards, so there is no
-    // instant at which it stands readable by anyone else.
-    writeFileSync(temporary, JSON.stringify([...this.#records.values()]), { mode: 0o600 });
-    try {
-      renameSync(temporary, file);
-    } catch (cause) {
-      unlinkSync(temporary);
-      throw cause;
-    }
+    const body = JSON.stringify([...this.#records.values()]);
+    const written = this.#writing.then(async () => {
+      await mkdir(this.deps.dir, { recursive: true, mode: 0o700 });
+      const file = this.#file();
+      const temporary = `${file}.ccmsg-${String(process.pid)}-${String(Date.now())}`;
+      // The set holds tokens, so the file is the instance's own to read: it is
+      // created with the mode rather than fixed afterwards, so there is no
+      // instant at which it stands readable by anyone else.
+      await writeFile(temporary, body, { mode: 0o600 });
+      try {
+        await rename(temporary, file);
+      } catch (cause) {
+        await unlink(temporary);
+        throw cause;
+      }
+    });
+    // The chain carries the order, not the outcome: a write that failed is
+    // answered to its own caller, and the ones behind it still go.
+    this.#writing = written.catch(() => {});
+    return written;
   }
 
   #file(): string {
@@ -383,11 +410,6 @@ export function recordsDir(stateDir: string): string {
   return join(stateDir, AUTH_DIR);
 }
 
-/** The parent of a path, made when a caller wants to write into it. */
-export function ensureDir(file: string): void {
-  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
-}
-
 /** Whether an instance is the one allowed to write this family (DR-0001 §2.4). */
 export function writes(family: TokenFamily, self: InstanceId): boolean {
   return family.iss === self;

package/src/cli.ts

@@ -434,7 +434,7 @@ const ROOT: Command = {
     {
       name: "dump",
       summary: "セッション (か配下の worker 1 体) の transcript を型ごとの表示で書き出す",
-      usage: "ccmsg dump <sid>[/agent-<id>] [--preset <名前>] [--types <選択>]",
+      usage: "ccmsg dump <sid>[/agent-<id>] [--preset <名前>] [--types <選択>] [--format <形式>]",
       options: [
         ["--preset <名前>", "instance が持つ選択 (ccmsg dump presets で一覧)"],
         ["--types <選択>", "型をカンマ区切りで。prefix 可、-で除外、@名前で preset 展開"],
@@ -444,6 +444,10 @@ const ROOT: Command = {
         ],
         ["--until <at|ago|uuid>", "上限。同上"],
         ["--max-chars <n>", "1 アイテムの本文をこの文字数で切る (既定は切らない)"],
+        [
+          "--format <形式>",
+          "instance に書かせる形式: items (型付き JSON) / records (元の jsonl) / text (markdown)",
+        ],
         ["--json", "markdown ではなく dump file の中身をそのまま出す"],
         ["--out <path>", "標準出力ではなくこの path に書く"],
       ],
@@ -1181,7 +1185,7 @@ function agents(args: readonly string[]): Promise<unknown> {
   });
 }
 
-/** Read the current value of a cluster topic and answer with it.
+/** Read the current value of a mesh topic and answer with it.
  *
  * One entry per instance, carrying the topic's payload exactly as the contract
  * defines it: a whole value per instance is not something to merge into one
@@ -1221,7 +1225,11 @@ async function topic(
  *
  * `--json` hands over the file as it stands, for a reader that is a program. */
 async function dump(args: readonly string[]): Promise<unknown> {
-  const parsed = options(args, ["preset", "types", "since", "until", "out", "max-chars"], ["json"]);
+  const parsed = options(
+    args,
+    ["preset", "types", "since", "until", "out", "max-chars", "format"],
+    ["json"],
+  );
   const subject = parsed.rest[0];
   if (subject === undefined) {
     throw new CommandError(
@@ -1234,6 +1242,11 @@ async function dump(args: readonly string[]): Promise<unknown> {
     ...dumpArgs(subject, parsed.named),
   })) as unknown as SessionDumpWriteResult;
   const body = readFileSync(written.path, "utf8");
+  // A format the instance was asked for is a file it wrote for that purpose,
+  // so it is handed over as it stands: rendering it again here would be this
+  // command deciding what a caller already decided.
+  const format = parsed.named.get("format");
+  if (format !== undefined) return await handed(body, parsed.named.get("out"));
   // What the heading states is where the cut fell, not the words it was asked
   // for in: a dump read next week cannot work out what "10 minutes ago" was.
   const since = spelled(resolved("since", parsed.named.get("since")));
@@ -1269,6 +1282,16 @@ async function dump(args: readonly string[]): Promise<unknown> {
  * two apart so that a sid stays a validated sid, and the joined spelling is
  * the CLI's own convenience — it is how the file the agent's records live in
  * is named, which is what makes the two halves tellable apart by eye. */
+/** Write out what the instance wrote, wherever the caller wanted it. */
+async function handed(body: string, out: string | undefined): Promise<undefined> {
+  if (out === undefined) {
+    process.stdout.write(body.endsWith("\n") ? body : `${body}\n`);
+    return undefined;
+  }
+  await Bun.write(out, body);
+  return undefined;
+}
+
 export function dumpArgs(
   subject: string,
   named: ReadonlyMap<string, string> = new Map(),
@@ -1278,8 +1301,13 @@ export function dumpArgs(
   const agent = at === -1 ? undefined : subject.slice(at + AGENT_MARK.length);
   const types = named.get("types");
   const preset = named.get("preset");
+  const format = named.get("format");
+  if (format !== undefined && format !== "items" && format !== "records" && format !== "text") {
+    throw new CommandError("invalid_args", "--format は items / records / text のどれかです");
+  }
   return {
     sid,
+    ...(format === undefined ? {} : { format }),
     ...(agent === undefined || agent === "" ? {} : { agent_id: agent }),
     ...(preset === undefined ? {} : { preset }),
     ...(types === undefined
@@ -1418,16 +1446,21 @@ function reply(args: readonly string[]): Promise<unknown> {
  * line on the page they are watching, and the machine saying it aloud. Both
  * run whatever the tool itself decided to do with it. */
 export async function notify(args: readonly string[], read?: Read): Promise<unknown> {
-  const parsed = options(args, ["sid", "about"], ["hook"]);
+  const parsed = options(args, ["sid", "about", "reply-to"], ["hook"]);
   if (parsed.flags.has("hook")) return await pushed(await hookEvent(read));
   const [text] = parsed.rest;
   if (text === undefined) {
-    throw new CommandError("invalid_args", "使い方: ccmsg notify <text> [--about <sid>] | --hook");
+    throw new CommandError(
+      "invalid_args",
+      "使い方: ccmsg notify <text> [--about <sid>] [--reply-to <mid>] | --hook",
+    );
   }
   const about = parsed.named.get("about");
+  const answering = parsed.named.get("reply-to");
   return await announce(parsed.named.get("sid"), {
     text,
     ...(about === undefined ? {} : { sid: about }),
+    ...(answering === undefined ? {} : { reply_to: answering as NotifySendArgs["reply_to"] }),
   });
 }
 

package/src/daemon/snapshot.ts

@@ -6,7 +6,7 @@ import { CommandError } from "./link.ts";
  *
  * The pair rather than the payload alone, because two instances state the same
  * topic name: a payload with the name of its author taken off could not be told
- * from the other's, and which instance said it is half of what a cluster read
+ * from the other's, and which instance said it is half of what a mesh read
  * answers. */
 export interface Snapshot {
   readonly instance: InstanceId;
@@ -31,7 +31,7 @@ interface Frame {
   readonly data?: unknown;
 }
 
-/** What a greeting answered, as the two fields a cluster read needs of it. */
+/** What a greeting answered, as the two fields a mesh read needs of it. */
 interface Greeted {
   readonly instance?: unknown;
   readonly instances?: unknown;
@@ -92,7 +92,7 @@ export async function snapshots(
   return [...held].map(([instance, data]) => ({ instance, data }));
 }
 
-/** The instances a greeting named, as the set a read of a cluster topic waits
+/** The instances a greeting named, as the set a read of a mesh topic waits
  * for.
  *
  * `all` is every instance the answering one can currently reach, itself

package/src/daemon/supervise.ts

@@ -275,18 +275,26 @@ export class Supervisor {
       }
       return await op(unit);
     }
-    const answers: (T | { dir: string; error: { code: string; msg: string } })[] = [];
     // Taken as a list first: each step below waits, and a request arriving in
     // between may add or remove one — what `--all` answers about is the set as
     // it stood when it was asked.
     const units = Array.from(this.#units.values());
-    for (const unit of units) {
-      try {
-        answers.push(await op(unit));
-      } catch (cause) {
-        if (!(cause instanceof CommandError)) throw cause;
-        answers.push({ dir: unit.target.dir, error: { code: cause.code, msg: cause.message } });
+    // Every config home at once. Each is a child process of its own, and a
+    // start that waits on one of them serving is not a reason the next one has
+    // not been asked to start yet (DR-0015). The answers are still the units in
+    // the order they were taken, because that is the list the caller asked
+    // about.
+    const settled = await Promise.allSettled(units.map((unit) => op(unit)));
+    const answers: (T | { dir: string; error: { code: string; msg: string } })[] = [];
+    for (const [index, outcome] of settled.entries()) {
+      if (outcome.status === "fulfilled") {
+        answers.push(outcome.value);
+        continue;
       }
+      const cause: unknown = outcome.reason;
+      if (!(cause instanceof CommandError)) throw cause;
+      const unit = units[index] as Supervised;
+      answers.push({ dir: unit.target.dir, error: { code: cause.code, msg: cause.message } });
     }
     return answers;
   }

package/src/dispatch/dispatch.ts

@@ -14,11 +14,11 @@ import { type DispatchResult, failure, OpError, reply } from "./result.ts";
 /** What dispatch needs from the instance around it. */
 export interface DispatchDeps {
   /** This instance's own id, compared with the destination of an
-   * `instance-local` op to decide whether the op is ours to run. */
+   * `owner_instance` op to decide whether the op is ours to run. */
   readonly self: InstanceId;
   /** The capabilities this instance has, as `hello` reports them. */
   readonly capabilities: ReadonlySet<Capability>;
-  /** The instance that owns the subject of an `instance-local` op, or
+  /** The instance that owns the subject of an `owner_instance` op, or
    * `undefined` when no other instance owns it and we answer ourselves.
    * The routing table behind this is the `peers` topic (DESIGN §7.3). */
   readonly resolveInstance: (op: OpName, frame: Record<string, unknown>) => InstanceId | undefined;
@@ -97,7 +97,7 @@ export async function dispatch(
     );
   }
 
-  // 6. an instance-local op whose subject belongs elsewhere goes to mesh.
+  // 6. an owner_instance op whose subject belongs elsewhere goes to mesh.
   //
   // A request that has already been here is dropped before that: a cycle in
   // the routing would otherwise send it round the same instances until every
@@ -108,7 +108,7 @@ export async function dispatch(
   if (Array.isArray(hops) && hops.includes(deps.self)) {
     return failure(requestId, "instance_unreachable", `${op} came back to ${deps.self}`);
   }
-  if (attrs.locality === "instance-local") {
+  if (attrs.locality === "owner_instance") {
     const asked = fields["to_instance"];
     const target = typeof asked === "string" ? asked : deps.resolveInstance(op, fields);
     if (target !== undefined && target !== deps.self) {