@passioncode-ai/passioncode 0.2.45 → 0.2.47

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-session.mjs

@@ -6,8 +6,10 @@ import { Backoff, HubError, normalProject } from './fabric-hub.mjs';
 import { acceptedRevisions, feedDataProblems, negotiateRevision } from './fabric-service.mjs';
 import { BoardError, CAPABILITY, LEASE_SECONDS, REQUEST_STATES, SUMMARY_MAX, Stopped, isInt, isObj, outcomeProblems, receiptProblems } from './fabric-board-shapes.mjs';
 import { BoardRequest, BoardSession, Checkpoint } from './fabric-board-link.mjs';
+import { HOLD_RETRY_MAX_SECONDS, LEASE_MARGIN_SECONDS, SESSION_CODES, SlotKeeper } from './fabric-board-slots.mjs';
 
 export { BoardRequest, BoardSession, Checkpoint }; // re-exported: callers import them from here since 0.40.0
+export { HOLD_RETRY_MAX_SECONDS, LEASE_MARGIN_SECONDS, SESSION_CODES }; // since 0.56.0 defined in fabric-board-slots.mjs
 
 export const RENEW_SECONDS = 20;
 
@@ -16,6 +18,8 @@ export const POLL_SECONDS = 15;
 export const POLL_JITTER_SECONDS = 5;
 
 export const DRAIN_SECONDS = 10;
+/** An idle responder's leave waits this long for the DELETE, so an idle stop ends within LC-01's 5 s (FAA-173). */
+export const IDLE_LEAVE_SECONDS = 3;
 
 export const EVENT_SCHEMA = 'urn:fabric:schema:board-responder-event:1';
 
@@ -26,15 +30,6 @@ const TERMINAL = new Set(['completed', 'failed_known', 'cancelled', 'expired']);
 // participant reply (DEC-0098, DEC-0102; not terminal, the requester may still cancel it, and nobody claims it).
 const NOT_OURS = new Set(['queued', 'claimed', 'answered']);
 
-// The answer may have been stored: send it again with the same key (BoardError).
-const LOST = ['unreachable', 'session-ended'];
-
-/** A lost call is sent again this long before the lease it keeps would lapse (FAA-77, finding 38). */
-export const LEASE_MARGIN_SECONDS = 10;
-
-/** How long a held slot waits before it asks again: doubling from the poll interval, never past this. */
-export const HOLD_RETRY_MAX_SECONDS = 900;
-
 /** What a handler may do while it works: progress(note), beginEffect(summary) before it spends or acts, and `stopped`. */
 export class WorkContext {
   #responder;
@@ -56,14 +51,26 @@ export class WorkContext {
 
 const clean = (text, max = SUMMARY_MAX) => String(text).split(/\s+/).filter(Boolean).join(' ').slice(0, max);
 
+/**
+ * A notice's subject ({type, id}): its request, else its capability, else its episode (a cause such as a block's code,
+ * so two causes are two episodes for a host), else the Project. 128 code points, as Python.
+ */
+function noticeSubject(value, project, episode) {
+  for (const [kind, id] of [['request', value.request], ['capability', value.capability], ['episode', episode]]) {
+    if (typeof id === 'string' && id.length > 0 && [...id].length <= 128) return { type: kind, id };
+  }
+  return { type: 'project', id: project };
+}
+
 /**
  * One service's responder for one Project and its capabilities, one request at a time. handler(request, ctx) answers
  * the outcome (may be async); admit(request) is the input gate; observe(entry) reads the world after a restart;
  * emit(kind, level, text, extra) receives events. run({signal}) ticks until aborted; step() is one tick.
  */
-export class Responder {
+export class Responder extends SlotKeeper {
   constructor({ hub, projectId, capabilities, credentialFile, checkpointFile, handler, admit, observe, emit, service = 'service',
     now = () => performance.now() / 1000, rand = Math.random, sessionFactory } = {}) {
+    super();
     if (typeof admit !== 'function' || typeof handler !== 'function') throw new BoardError('invalid_arguments', 'A responder needs the service\'s own input gate (admit) and a handler.');
     const caps = [...(capabilities ?? [])];
     if (!caps.length || caps.some((c) => typeof c !== 'string' || !CAPABILITY.test(c)) || new Set(caps).size !== caps.length) throw new BoardError('invalid_arguments', 'Name each capability once, [a-z][a-z0-9._-]{1,127}.');
@@ -91,6 +98,7 @@ export class Responder {
     this.fenceQueue = Promise.resolve();
     this.toResume = []; // transferred requests waiting until nothing runs (finding 39)
     this.suspect = new Set(); // capabilities a fenced call was refused on: com.status says whether they moved (FAA-155)
+    this.confirmed = {}; // this session's: the generation it held, or com.status showed unmoved
   }
 
   /** Runs fn after every fenced call queued before it (finding 36): an await inside a call never lets another in. */
@@ -100,17 +108,27 @@ export class Responder {
     return run;
   }
 
+  /** The generations this session confirmed (held, or compared with com.status and found unmoved), paused and retrying slots included: only their records a clean leave may forget (0.56.0 seam r2, r3). */
+  heldNow() {
+    // a fenced call (maybe moved) or a move withholds it
+    return Object.fromEntries(Object.entries(this.confirmed).filter(([c]) => !this.suspect.has(c) && this.slots[c]?.state !== 'moved'));
+  }
+
   // -- events --
-  emit(kind, level, text, { notify = false, episode, ...value } = {}) {
-    if (episode !== undefined) {
-      if (this.said[kind] === episode) return;
-      this.said[kind] = episode;
+  emit(kind, level, text, { notify = false, episode, saidAs, ...value } = {}) {
+    if (episode !== undefined) { // `saidAs` keeps one episode per key, such as one per capability
+      const key = saidAs ?? kind;
+      if (this.said[key] === episode) return;
+      this.said[key] = episode;
     }
     let data = { schema: EVENT_SCHEMA, value: Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined && v !== null)) };
     if (feedDataProblems(data).length) data = undefined; // FAC-SEM-101: drop the data, keep the sentence
     if (!this.emitTo) return;
+    // The thing the notice is about, so a host tells one request's or one capability's episode from another's
+    // (events-and-notifications.md, "Say who wants what"; 0.56.0 seam r30).
+    const subject = noticeSubject(value, this.project, episode);
     try {
-      this.emitTo(kind, level, text, { notify, ...(data ? { data } : {}) });
+      this.emitTo(kind, level, text, { notify, subject, ...(data ? { data } : {}) });
     } catch {
       // an event that cannot be written never stops the responder
     }
@@ -152,6 +170,8 @@ export class Responder {
 
   async connect() {
     this.state = 'connecting';
+    this.slots = {}; // the previous session's slots are not this one's: a refusal now reconnects (FAA-163)
+    this.confirmed = {}; // nor its confirmations: a slot may have moved between the two sessions
     const grant = await this.hub.joinBoard(this.project, this.credentialFile);
     const missing = this.capabilities.filter((c) => !grant.capabilities.includes(c));
     const session = this.sessionFactory(grant);
@@ -159,7 +179,7 @@ export class Responder {
     this.session = session;
     const status = await this.status();
     if (missing.length) {
-      this.emit('board.access.needed', 'warn', `The operator has not let this service answer ${missing.join(', ')} on this Project; ask in Fabric (Agents & access).`, { notify: true, episode: missing.join(','), capabilities: missing });
+      this.emit('board.access.needed', 'warning', `The operator has not let this service answer ${missing.join(', ')} on this Project; ask in Fabric (Agents & access).`, { notify: true, episode: missing.join(','), capabilities: missing });
     }
     this.slots = {};
     await this.recover(status, this.capabilities.filter((c) => grant.capabilities.includes(c)));
@@ -180,14 +200,14 @@ export class Responder {
       if (e.code === 'fenced') {
         if (await this.gone(capability)) return;
         this.slots[capability] = { state: 'contested', renewedAt: this.now() };
-        this.emit('board.slot.contested', 'warn', `Another responder holds the ${capability} slot on this Project; this service waits for it to lapse and never takes it over by itself.`, { notify: true, episode: capability, capability });
+        this.emit('board.slot.contested', 'warning', `Another responder holds the ${capability} slot on this Project; this service waits for it to lapse and never takes it over by itself.`, { notify: true, episode: capability, saidAs: `board.slot.contested:${capability}`, capability });
         return;
       }
       throw e;
     }
     this.slots[capability] = { state: 'held', generation: receipt.slot.generation, renewedAt: this.now() };
     this.heldAt(capability, receipt.slot.generation);
-    delete this.said['board.slot.contested'];
+    delete this.said[`board.slot.contested:${capability}`];
     this.lifted(capability);
   }
 
@@ -211,118 +231,6 @@ export class Responder {
     this.emit('board.slot.released', 'info', `The operator's hold on ${capability} was lifted; the service takes new work again.`, { capability });
   }
 
-  // -- a slot moved to another session (FAA-155, DEC-0140 PR-2) --
-  /** The generation this responder holds the slot at, kept beside its checkpoint; a failed write is retried at the next receipt. */
-  heldAt(capability, generation) {
-    this.note(capability, { project: this.project, generation });
-  }
-
-  /** The slot record, best effort: one that cannot be written now is written at the next receipt. */
-  note(capability, record) {
-    try {
-      this.checkpoint.slot(capability, record);
-    } catch {
-      // the request steps fail closed on their own
-    }
-  }
-
-  /**
-   * An enroll or replace is recorded with its key before it is sent, so a lost answer is never read as a move; a refusal
-   * drops the record, a receipt replaces it (heldAt), a record that cannot be written is skipped.
-   */
-  async ask(capability, op, args) {
-    let held = this.checkpoint.slots[capability] ?? {};
-    if (held.project !== this.project) return this.call(op, args); // no record: nothing a lost answer could be mistaken for
-    const slot = this.slots[capability] ?? {};
-    if (op === 'com.enroll' && slot.state === 'held' && slot.generation === held.generation
-      && this.now() - (slot.renewedAt ?? 0) < LEASE_SECONDS - LEASE_MARGIN_SECONDS && !('asking' in held)) {
-      return this.call(op, args); // a live holder's renew cannot change its generation: nothing to record
-    }
-    if (isObj(held.asking)) {
-      // An earlier lost ask is settled first; it may show the slot moved.
-      if (await this.gone(capability)) throw new BoardError('fenced', `The ${capability} slot moved to another session.`, false, op);
-      held = this.checkpoint.slots[capability] ?? {};
-    }
-    try {
-      this.checkpoint.slot(capability, { ...held, asking: { op, args } });
-    } catch {
-      return this.call(op, args);
-    }
-    try {
-      return await this.call(op, args);
-    } catch (e) {
-      if (!LOST.includes(e.code)) this.note(capability, held);
-      throw e;
-    }
-  }
-
-  /**
-   * Asks a lost enroll or replace again under its key. `repeated: true`: it landed, the generation is ours. Else it ran
-   * only now: if the slot had moved past the record (`before`), the record stays and the move is read (the slot just
-   * taken lapses unused). A refusal or an odd receipt drops the record; a lost answer keeps it.
-   */
-  async replay(capability, held, before) {
-    const { asking, ...rest } = held;
-    let record = rest;
-    if (isObj(asking) && ['com.enroll', 'com.responder_replace'].includes(asking.op)) {
-      try {
-        const answer = this.receipt(asking.op, await this.call(asking.op, asking.args));
-        const generation = answer.slot?.generation;
-        const moved = isInt(before, 1) && isInt(rest.generation, 1) && before > rest.generation;
-        if (isInt(generation, 1) && (answer.repeated === true || !moved)) record = { project: this.project, generation };
-      } catch (e) {
-        if (LOST.includes(e.code)) throw e;
-        if (e.code === 'idempotency_window_expired') record = {}; // a retired epoch: unknown, so a first start, no move
-      }
-    }
-    this.note(capability, Object.keys(record).length ? record : null);
-    return record;
-  }
-
-  /**
-   * True when com.status shows the slot's generation past the one recorded held: the operator or another session moved
-   * it. The slot is left `moved`. No record, another Project's, an odd value or no later generation: false.
-   */
-  async gone(capability, status = null) {
-    let held = this.checkpoint.slots[capability] ?? {};
-    if (held.project !== this.project || (!isInt(held.generation, 1) && !('asking' in held))) return false;
-    let now = ((status ?? await this.status()).responders ?? []).find((r) => isObj(r) && r.capability === capability)?.generation;
-    if ('asking' in held) held = await this.replay(capability, held, now); // its own lost ask first
-    if (isInt(held.moved, 1) /* a recorded move stays until takeBack */ && !(isInt(now, 1) && now > (held.generation ?? now))) now = held.moved;
-    if (!isInt(now, 1) || !isInt(held.generation, 1) || now <= held.generation) return false;
-    if (this.current?.entry.capability === capability) {
-      this.current.ctx.stopped = true;
-      this.current = null;
-    }
-    for (const entry of Object.values(this.checkpoint.entries).filter((e) => e.capability === capability).map((e) => ({ ...e }))) {
-      if (entry.step === 'claimed') this.checkpoint.drop(entry.request); // the move returned the claim to the queue
-      else if (!['unknown', 'lapsed'].includes(entry.step)) {
-        // Begun: outcome_unknown, which the slot's holder reconciles. Accepted: held on the board, continued only by a
-        // transfer if the slot is this service's again; never a com.responder_replace on its own.
-        entry.step = entry.effect ? 'unknown' : 'lapsed';
-        this.checkpoint.put(entry);
-      }
-    }
-    this.toResume = this.toResume.filter((r) => this.checkpoint.entries[r]?.capability !== capability);
-    this.slots[capability] = { state: 'moved', generation: now, renewedAt: this.now() };
-    if (!('moved' in held)) { // once, even across restarts
-      this.emit('board.slot.moved', 'warn', `The ${capability} slot on this Project was moved to another session. This service stopped answering it there, left its accepted work held (work already begun is the new holder's to settle) and does not take the slot back by itself. Its take-back action brings it back once the other session lets it go; without one, ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
-      this.note(capability, { ...held, moved: now }); // said again at the next start if it cannot be written
-    }
-    return true;
-  }
-
-  /**
-   * The operator's act, never the kit's: forget that a capability's slot moved away. In the same board session the next
-   * tick enrolls once the slot is free; a reconnect with held work takes it back at once by a transfer (FAA-155).
-   */
-  takeBack(capability) {
-    if (!this.capabilities.includes(capability)) throw new BoardError('invalid_arguments', `This responder does not answer ${capability}.`);
-    this.checkpoint.slot(capability, null);
-    if (this.slots[capability]?.state === 'moved') this.slots[capability] = { state: 'contested', renewedAt: 0 };
-    delete this.said['board.slot.moved'];
-  }
-
   // -- restart: reconcile and transfer --
   async readState(entry) {
     const message = await this.call('com.get', { message: entry.message });
@@ -354,20 +262,20 @@ export class Responder {
     const responders = (status.responders ?? []).filter(isObj);
     const generations = Object.fromEntries(responders.map((r) => [r.capability, r.generation ?? 0]));
     const onHold = new Set(responders.filter((r) => r.held === true).map((r) => r.capability)); // DEC-0079
+    let failure = null;
     for (const capability of capabilities) {
       const was = this.checkpoint.slots[capability]?.generation;
-      if (await this.gone(capability, status)) continue; // moved away: never replaced at recovery (FAA-155)
-      if (onHold.has(capability)) {
-        for (const entry of transfer[capability] ?? []) {
-          entry.step = 'lapsed'; // taken back by a transfer once the hold is lifted
-          this.checkpoint.put(entry);
-        }
-        this.pause(capability);
-      } else if (transfer[capability]?.length) { // at the generation a replay just recorded, else com.status's
-        const mine = this.checkpoint.slots[capability]?.generation;
-        await this.replace(capability, transfer[capability], isInt(mine, 1) && mine !== was ? mine : generations[capability] ?? 0);
+      if (failure) { // the board session failed: the rest wait for the next tick (FAA-163)
+        this.retryLater(capability, transfer[capability] ?? [], failure);
+        this.suspect.add(capability); // its move check comes before its retry enrolls (0.56.0 seam r2)
+        continue;
+      }
+      try {
+        await this.settle(capability, () => this.recoverOne(capability, status, transfer[capability], was, generations, onHold), transfer[capability] ?? []);
+      } catch (e) {
+        if (!(e instanceof BoardError)) throw e; // as the Python twin: only the board's refusals are left to retry
+        failure = e;
       }
-      else await this.enroll(capability);
     }
     for (const entry of reconcile) {
       if (this.slots[entry.capability]?.state === 'held') await this.reconcile(entry);
@@ -376,6 +284,21 @@ export class Responder {
         this.checkpoint.put(entry);
       }
     }
+    if (failure) throw failure;
+  }
+
+  async recoverOne(capability, status, held, was, generations, onHold) {
+    if (await this.gone(capability, status)) return; // moved away: never replaced at recovery (FAA-155)
+    if (onHold.has(capability)) {
+      for (const entry of held ?? []) {
+        entry.step = 'lapsed'; // taken back by a transfer once the hold is lifted
+        this.checkpoint.put(entry);
+      }
+      this.pause(capability);
+    } else if (held?.length) { // at the generation a replay just recorded, else com.status's
+      const mine = this.checkpoint.slots[capability]?.generation;
+      await this.replace(capability, held, isInt(mine, 1) && mine !== was ? mine : generations[capability] ?? 0);
+    } else await this.enroll(capability);
   }
 
   async replace(capability, entries, generation) {
@@ -405,7 +328,7 @@ export class Responder {
         // A board pinned before DEC-0078 hands back no attempt. Never claim it back: it stays held.
         entry.step = 'held';
         this.checkpoint.put(entry);
-        this.emit('board.request.held', 'warn', 'An accepted request could not be resumed: this Fabric does not hand back a transferred attempt (DEC-0078). It stays held; nothing was done.', { notify: true, episode: entry.request, request: entry.request, capability });
+        this.emit('board.request.held', 'warning', 'An accepted request could not be resumed: this Fabric does not hand back a transferred attempt (DEC-0078). It stays held; nothing was done.', { notify: true, episode: entry.request, request: entry.request, capability });
         continue;
       }
       if (entry.step === 'replying' && !entry.replied && entry.keys?.reply && !entry.probe) {
@@ -497,7 +420,7 @@ export class Responder {
     if (!outcome) {
       entry.step = 'unknown';
       this.checkpoint.put(entry);
-      this.emit('board.reconcile.needed', 'warn', 'A request\'s outcome is unknown: the work may have happened. It stays unknown until this service observes what happened.', { notify: true, episode: entry.request, request: entry.request, capability: entry.capability });
+      this.emit('board.reconcile.needed', 'warning', 'A request\'s outcome is unknown: the work may have happened. It stays unknown until this service observes what happened.', { notify: true, episode: entry.request, request: entry.request, capability: entry.capability });
       return;
     }
     const sent = Object.fromEntries(['state', 'summary', 'evidence'].filter((k) => k in outcome).map((k) => [k, outcome[k]]));
@@ -538,7 +461,8 @@ export class Responder {
 
   /** Seconds this session's leases still run, by its own clock: the running attempt's, else the oldest held slot's. */
   leaseLeft() {
-    const renewed = this.current ? [this.current.renewedAt ?? 0] : Object.values(this.slots).filter((s) => s.state === 'held').map((s) => s.renewedAt ?? 0);
+    const renewed = this.current ? [this.current.renewedAt ?? 0]
+      : Object.values(this.slots).filter((s) => s.state === 'held' && s.renewedAt !== -Infinity).map((s) => s.renewedAt ?? 0); // a lapsed slot holds no lease (FAA-163)
     return renewed.length && this.session ? Math.min(...renewed) + LEASE_SECONDS - this.now() : 0;
   }
 
@@ -553,7 +477,7 @@ export class Responder {
     if (['not_authorized', 'authority_changed', 'credential'].includes(code)) {
       this.state = 'not-authorized';
       await this.dropSession();
-      this.emit('board.access.needed', 'warn', 'This service may not answer requests for this Project: the operator has to allow it in Fabric (Agents & access). Nothing is claimed until then.', { notify: true, episode: 'access', reason: code });
+      this.emit('board.access.needed', 'warning', 'This service may not answer requests for this Project: the operator has to allow it in Fabric (Agents & access). Nothing is claimed until then.', { notify: true, episode: 'access', reason: code });
     } else if (code === 'held') {
       this.state = 'paused';
       this.emit('board.held', 'info', 'The operator holds new work on this Project; the responder waits and asks again with a growing pause.', { episode: 'held', reason: code });
@@ -566,7 +490,7 @@ export class Responder {
       this.state = 'down';
       // A refusal in recovery that left no slot held reconnects (seam 6); one that left some held serves them (seam 7).
       if ((connecting || ['session-ended', 'unreachable', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol'].includes(code)) && !keep) await this.dropSession();
-      this.emit('board.down', 'warn', 'Fabric\'s board cannot be reached; the responder tries again with a growing pause.', { episode: 'down', reason: code });
+      this.emit('board.down', 'warning', 'Fabric\'s board cannot be reached; the responder tries again with a growing pause.', { episode: 'down', reason: code });
     }
     return wait;
   }
@@ -588,7 +512,8 @@ export class Responder {
     }
     const session = this.session;
     this.session = null;
-    if (session) await session.close();
+    // The DELETE released the slots: a standby taking one is no move (FAA-163).
+    if (session && await session.close()) this.checkpoint.leave(this.project, this.heldNow());
   }
 
   async tick() {
@@ -606,7 +531,11 @@ export class Responder {
       if (slot.state === 'moved') continue; // never enrolled again on its own, even when the new holder's lease lapses (FAA-155)
       if (slot.state === 'paused') {
         // still held: a longer pause; lifted: the slot is ours again
-        if (capability !== heldByWork && this.now() >= (slot.retryAt ?? 0)) await this.enroll(capability);
+        if (capability !== heldByWork && this.now() >= (slot.retryAt ?? 0) && !(await this.gone(capability))) await this.enroll(capability); // a move is read first
+        continue;
+      }
+      if (slot.state === 'retry') { // its enroll was refused: asked again alone (FAA-163)
+        if (this.now() >= (slot.retryAt ?? 0)) await this.settle(capability, async () => (await this.gone(capability)) || this.enroll(capability));
         continue;
       }
       if (capability !== heldByWork && this.now() - (slot.renewedAt ?? 0) >= RENEW_SECONDS - 0.5) await this.enroll(capability);
@@ -692,12 +621,12 @@ export class Responder {
     const req = isObj(message) ? message.request : null;
     if (message.digest !== entry.digest) {
       this.checkpoint.drop(entry.request);
-      this.emit('board.request.skipped', 'warn', 'A claimed request was not accepted: the message read back carries another digest than the claim. Nothing was done; the claim lapses.', { request: entry.request, capability, reason: 'digest-mismatch' });
+      this.emit('board.request.skipped', 'warning', 'A claimed request was not accepted: the message read back carries another digest than the claim. Nothing was done; the claim lapses.', { request: entry.request, capability, reason: 'digest-mismatch' });
       return;
     }
     if (!isObj(req) || req.id !== entry.request || req.capability !== capability || req.target !== this.project) {
       this.checkpoint.drop(entry.request);
-      this.emit('board.request.skipped', 'warn', 'A claimed request was not accepted: it is not addressed to this Project and capability. Nothing was done; the claim lapses.', { request: entry.request, capability, reason: 'not-addressed' });
+      this.emit('board.request.skipped', 'warning', 'A claimed request was not accepted: it is not addressed to this Project and capability. Nothing was done; the claim lapses.', { request: entry.request, capability, reason: 'not-addressed' });
       return;
     }
     const request = new BoardRequest(message, capability);
@@ -797,17 +726,17 @@ export class Responder {
     if (entry.effect) {
       entry.step = 'unknown';
       this.checkpoint.put(entry);
-      this.emit('board.reconcile.needed', 'warn', 'The attempt was lost after its effect began; the outcome stays unknown until this service observes what happened.', { notify: true, episode: entry.request, request: entry.request, capability: entry.capability, reason: code });
+      this.emit('board.reconcile.needed', 'warning', 'The attempt was lost after its effect began; the outcome stays unknown until this service observes what happened.', { notify: true, episode: entry.request, request: entry.request, capability: entry.capability, reason: code });
     } else if (!['claimed', 'accepting'].includes(entry.step) && (code === 'lease_expired' || (code === 'fenced' && entry.capability in this.checkpoint.slots))) {
       // Accepted work whose lease lapsed, or fenced off a slot this responder held (moved, FAA-155): the board holds it
       // (C4). It continues only by a checkpoint transfer to this responder while it holds the slot.
       entry.step = 'lapsed';
       this.checkpoint.put(entry);
-      this.emit('board.attempt.lost', 'warn', code === 'lease_expired' ? 'This service\'s lease on an accepted request lapsed; it stopped working on it and takes it back by a transfer.'
+      this.emit('board.attempt.lost', 'warning', code === 'lease_expired' ? 'This service\'s lease on an accepted request lapsed; it stopped working on it and takes it back by a transfer.'
         : 'The board fenced an accepted request away from this service; it stopped working on it, and nothing had been done outside it.', { request: entry.request, capability: entry.capability, reason: code });
     } else {
       this.checkpoint.drop(entry.request);
-      this.emit('board.attempt.lost', 'warn', `The board took a request back from this service (${code}); it stopped working on it, and nothing had been done outside the service.`, { request: entry.request, capability: entry.capability, reason: code });
+      this.emit('board.attempt.lost', 'warning', `The board took a request back from this service (${code}); it stopped working on it, and nothing had been done outside the service.`, { request: entry.request, capability: entry.capability, reason: code });
     }
   }
 
@@ -892,7 +821,7 @@ export class Responder {
     }
     const problems = outcomeProblems(outcome, !!entry.effect);
     if (problems.length) {
-      this.emit('board.outcome.invalid', 'warn', `The handler's outcome was not sent: ${problems[0]}.`, { request: entry.request, capability: entry.capability });
+      this.emit('board.outcome.invalid', 'warning', `The handler's outcome was not sent: ${problems[0]}.`, { request: entry.request, capability: entry.capability });
       if (entry.effect) await this.settleLive(entry, problems.some((p) => p.includes('observation_required')) ? 'observation_required' : 'outcome');
       else {
         entry.outcome = { state: 'failed_known', observed: true, summary: 'The service answered in a form it cannot send.' };
@@ -990,9 +919,11 @@ export class Responder {
       }
     }
     if (this.session) {
-      await this.session.close();
+      const session = this.session;
       this.session = null;
-      this.checkpoint.leave(this.project); // the slots were released: no record of them can read as a move
+      // Only a DELETE Fabric answered released the slots (FAA-163): no record of them can read as a move. An idle stop
+      // waits for it 3 s (FAA-173).
+      if (await session.close(work ? null : IDLE_LEAVE_SECONDS * 1000)) this.checkpoint.leave(this.project, this.heldNow());
     }
     this.state = 'stopped';
   }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-slots.mjs

@@ -0,0 +1,180 @@
+// The board responder's slot records (FAA-155, FAA-163): the generation it holds each slot at, a move to another
+// session and its take-back, and a capability whose enroll was refused, retried on its own. Part of the board
+// connector (FAA-65, layer L4); Responder (fabric-board-session.mjs) extends SlotKeeper.
+import { BoardError, LEASE_SECONDS, isInt, isObj } from './fabric-board-shapes.mjs';
+
+// The answer may have been stored: send it again with the same key (BoardError).
+export const LOST = ['unreachable', 'session-ended'];
+
+/** A lost call is sent again this long before the lease it keeps would lapse (FAA-77, finding 38). */
+export const LEASE_MARGIN_SECONDS = 10;
+
+/** How long a held slot waits before it asks again: doubling from the poll interval, never past this. */
+export const HOLD_RETRY_MAX_SECONDS = 900;
+
+/** Refusals that are about the board session, not one capability: they end recovery and go to the responder's fault. */
+export const SESSION_CODES = Object.freeze(new Set(['unreachable', 'session-ended', 'not_authorized', 'authority_changed', 'credential', 'no-epoch',
+  'schema-unsupported', 'checkpoint', 'receipt-shape', 'idempotency_conflict', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'not_available']));
+
+/** The slot methods of Responder, which owns every field they read (checkpoint, slots, project, locked). */
+export class SlotKeeper {
+  // -- a slot moved to another session (FAA-155, DEC-0140 PR-2) --
+  /** The generation this responder holds the slot at, kept beside its checkpoint; a failed write is retried at the next receipt. */
+  heldAt(capability, generation) {
+    this.note(capability, { project: this.project, generation });
+    this.confirmed[capability] = generation;
+    delete this.said[`board.slot.refused:${capability}`]; // held again: a later refusal is said again
+    delete this.said[`board.slot.contested:${capability}`]; // and a later contest, by enroll or replace
+  }
+
+  /** The slot record, best effort: one that cannot be written now is written at the next receipt. */
+  note(capability, record) {
+    try {
+      this.checkpoint.slot(capability, record);
+    } catch {
+      // the request steps fail closed on their own
+    }
+  }
+
+  /**
+   * An enroll or replace is recorded with its key before it is sent, so a lost answer is never read as a move; a refusal
+   * drops the record, a receipt replaces it (heldAt), a record that cannot be written is skipped.
+   */
+  async ask(capability, op, args) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project) return this.call(op, args); // no record: nothing a lost answer could be mistaken for
+    const slot = this.slots[capability] ?? {};
+    if (op === 'com.enroll' && slot.state === 'held' && slot.generation === held.generation
+      && this.now() - (slot.renewedAt ?? 0) < LEASE_SECONDS - LEASE_MARGIN_SECONDS && !('asking' in held)) {
+      return this.call(op, args); // a live holder's renew cannot change its generation: nothing to record
+    }
+    if (isObj(held.asking)) {
+      // An earlier lost ask is settled first; it may show the slot moved.
+      if (await this.gone(capability)) throw new BoardError('fenced', `The ${capability} slot moved to another session.`, false, op);
+      held = this.checkpoint.slots[capability] ?? {};
+    }
+    try {
+      this.checkpoint.slot(capability, { ...held, asking: { op, args } });
+    } catch {
+      return this.call(op, args);
+    }
+    try {
+      return await this.call(op, args);
+    } catch (e) {
+      if (!LOST.includes(e.code)) this.note(capability, held);
+      throw e;
+    }
+  }
+
+  /**
+   * Asks a lost enroll or replace again under its key. `repeated: true`: it landed, the generation is ours. Else it ran
+   * only now: if the slot had moved past the record (`before`), the record stays and the move is read (the slot just
+   * taken lapses unused). A refusal or an odd receipt drops the record; a lost answer keeps it.
+   */
+  async replay(capability, held, before) {
+    const { asking, ...rest } = held;
+    let record = rest;
+    if (isObj(asking) && ['com.enroll', 'com.responder_replace'].includes(asking.op)) {
+      try {
+        const answer = this.receipt(asking.op, await this.call(asking.op, asking.args));
+        const generation = answer.slot?.generation;
+        const moved = isInt(before, 1) && isInt(rest.generation, 1) && before > rest.generation;
+        if (isInt(generation, 1) && (answer.repeated === true || !moved)) record = { project: this.project, generation };
+      } catch (e) {
+        if (LOST.includes(e.code)) throw e;
+        if (e.code === 'idempotency_window_expired') record = {}; // a retired epoch: unknown, so a first start, no move
+      }
+    }
+    this.note(capability, Object.keys(record).length ? record : null);
+    return record;
+  }
+
+  /**
+   * True when com.status shows the slot's generation past the one recorded held: the operator or another session moved
+   * it. The slot is left `moved`. No record, another Project's, an odd value or no later generation: false.
+   */
+  async gone(capability, status = null) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project || (!isInt(held.generation, 1) && !('asking' in held))) return false;
+    let now = ((status ?? await this.status()).responders ?? []).find((r) => isObj(r) && r.capability === capability)?.generation;
+    if ('asking' in held) held = await this.replay(capability, held, now); // its own lost ask first
+    if (isInt(held.moved, 1) /* a recorded move stays until takeBack */ && !(isInt(now, 1) && now > (held.generation ?? now))) now = held.moved;
+    if (!isInt(now, 1) || !isInt(held.generation, 1) || now <= held.generation) {
+      if (isInt(now, 1) && isInt(held.generation, 1) && !('moved' in held)) this.confirmed[capability] = held.generation; // com.status shows it unmoved (0.56.0 seam r3)
+      return false;
+    }
+    // On the fence queue (FAA-158): a fenced call in flight lands first, and a takeBack meanwhile wins.
+    return this.locked(() => this.moved(capability, held, now));
+  }
+
+  /** The slot moved past `held` to `now`: stop its work, keep its accepted requests held, say it once. */
+  moved(capability, held, now) {
+    const record = this.checkpoint.slots[capability] ?? {};
+    if (record.project !== this.project || record.generation !== held.generation) return false; // a takeBack forgot it
+    if (this.current?.entry.capability === capability) {
+      this.current.ctx.stopped = true;
+      this.current = null;
+    }
+    for (const entry of Object.values(this.checkpoint.entries).filter((e) => e.capability === capability).map((e) => ({ ...e }))) {
+      if (entry.step === 'claimed') this.checkpoint.drop(entry.request); // the move returned the claim to the queue
+      else if (!['unknown', 'lapsed'].includes(entry.step)) {
+        // Begun: outcome_unknown, which the slot's holder reconciles. Accepted: held on the board, continued only by a
+        // transfer if the slot is this service's again; never a com.responder_replace on its own.
+        entry.step = entry.effect ? 'unknown' : 'lapsed';
+        this.checkpoint.put(entry);
+      }
+    }
+    this.toResume = this.toResume.filter((r) => this.checkpoint.entries[r]?.capability !== capability);
+    this.slots[capability] = { state: 'moved', generation: now, renewedAt: this.now() };
+    delete this.confirmed[capability];
+    if (!('moved' in held)) { // once, even across restarts
+      this.emit('board.slot.moved', 'warning', `The ${capability} slot on this Project moved to another session. This service stopped answering it there and left its accepted work \`accepted\` (work begun is the new holder's to settle). Its take-back action brings the slot back once the other session lets it go, or at a later restart or reconnect while accepted work waits; a restart alone does not. Without it, ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
+      this.note(capability, { ...held, moved: now }); // said again at the next start if it cannot be written
+    }
+    return true;
+  }
+
+  /**
+   * The operator's act, never the kit's: forget that a capability's slot moved away. In the same board session the next
+   * tick enrolls once the slot is free; a reconnect with held work takes it back at once by a transfer (FAA-155).
+   */
+  takeBack(capability) {
+    if (!this.capabilities.includes(capability)) throw new BoardError('invalid_arguments', `This responder does not answer ${capability}.`);
+    this.checkpoint.slot(capability, null);
+    if (this.slots[capability]?.state === 'moved') this.slots[capability] = { state: 'contested', renewedAt: 0 };
+    delete this.said['board.slot.moved'];
+  }
+
+  // -- one capability's refusal (FAA-163) --
+  /**
+   * An enroll or replace of one capability was refused: its accepted work waits `lapsed` (a transfer takes it back once
+   * the slot is held) and the capability asks again after a doubling pause; the others go on.
+   */
+  retryLater(capability, entries, e) {
+    if (this.slots[capability]?.state === 'held') return; // the replace landed: what failed came after it
+    for (const entry of entries) {
+      if (!['unknown', 'lapsed'].includes(entry.step)) {
+        entry.step = 'lapsed';
+        this.checkpoint.put(entry);
+      }
+    }
+    const slot = this.slots[capability] ?? {};
+    const tries = slot.state === 'retry' ? (slot.tries ?? 0) + 1 : 1;
+    const wait = Math.min(HOLD_RETRY_MAX_SECONDS, this.holdDelay * 2 ** (tries - 1));
+    this.slots[capability] = { state: 'retry', tries, retryAt: this.now() + wait, renewedAt: this.now() };
+    if (!SESSION_CODES.has(e.code)) { // once per episode (saidAs), also after a silent session refusal // a refusal of the board session is the fault's to say
+      this.emit('board.slot.refused', 'warning', `Fabric refused to give this service the ${capability} slot (${e.code}); it asks again later. Its other capabilities go on.`, { episode: capability, saidAs: `board.slot.refused:${capability}`, capability, reason: e.code });
+    }
+  }
+
+  /** Runs one capability's enroll or replace (FAA-163): a refusal of the board session is raised after the capability is left to retry. */
+  async settle(capability, act, entries = []) {
+    try {
+      await act();
+    } catch (e) {
+      if (!(e instanceof BoardError)) throw e;
+      this.retryLater(capability, entries, e);
+      if (SESSION_CODES.has(e.code)) throw e;
+    }
+  }
+}

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board.mjs

@@ -31,6 +31,7 @@ export {
   EVENT_SCHEMA,
   STOP_CODES,
   HOLD_RETRY_MAX_SECONDS,
+  IDLE_LEAVE_SECONDS,
   BoardSession,
   Checkpoint,
   BoardRequest,