@urun-sh/core 0.4.3 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.5.0
+
+- **BREAKING: `end()` PARKS, and `cancel()` is the admission-ticket verb** (owner ruling D3,
+  2026-09-06; Review A §5.1 "two end verbs", §3.3 residue).
+  - `Session.end()` / `sessionDirectory().end(id)` both go through the one implementation
+    `endSession()` → `POST /api/sessions/{id}/end` → `urun_park_session(client_ended)`.
+    It resolves `{ status: 'paused', sessionId, reason }`. `'paused'` can never throw; a
+    TERMINAL word on that route is now the loud error (`invalid_end_response`), because a
+    terminal write on the session plane is what the model forbids.
+  - `Session.cancel()` (new) → `POST /api/session-requests/{id}/cancel`. Request plane only,
+    never addressed by session id. Every outcome the control plane can answer maps to
+    `{ status: 'canceled' }`; an unrecognized word stays loud.
+  - `SessionEndResult` is now `{ status: 'paused'; sessionId; reason } | { status: 'canceled';
+    requestId; platformStatus? }` — the `'ended'` member is gone.
+  - `SessionEndError.requestId` is optional and `sessionId` is new.
+  - `allocateSession`'s `onRequest` handle carries `sessionId` as soon as the create envelope
+    names one, so a hang-up racing allocation parks the session instead of cancelling the
+    ticket of a session that already exists.
+  - `SessionGatewayStatus` gains `'paused'`.
+  - The end request is `keepalive`, like the teardown beacon: an `end()` can race the tab
+    close that triggered it. It sends NO body: the verb names the cause server-side, and
+    session-api reads a wire `reason` only to tolerate it — so `end()` now speaks the same
+    wire shape as the pagehide beacon hitting that same route.
+  - **The one routing rule holds on the paths that are not the two verbs** (review findings):
+    a page teardown that cancelled a still-queued TICKET finishes on the SESSION plane if
+    promotion won the race (otherwise the promoted session holds a GPU seat with no client),
+    and the give-up cancel parks instead of cancelling when allocation threw AFTER the control
+    plane allocated (an unusable `session_api_base` / `ws_url` — the ticket-cancel route
+    refuses those with 409 `request_has_session`).
+  - A REFUSED `cancel()` is not a cancel: the release claim and the re-attach bookmark are
+    only taken on success, so a later `pagehide` still beacons the ticket cancel instead of
+    being suppressed by a release that never happened.
+
 ## 0.4.3
 
 - **FIX: no server status word can reach a user as a benign lie — on EITHER path.**
@@ -109,7 +142,6 @@
 
 ## 0.4.1
 
-
 - **FIX: a re-dial no longer leaves the playout element bound to a DEAD track**
   (urun-infra#2132; the prod qwen-voice "assistant audio drops mid-session and
   never self-heals, reload fixes it" signature). `recvTransport.consume()` /