@vibe-commit/capture 0.10.0 → 0.11.0

package/dist/commands/upload_worker.js

@@ -0,0 +1,336 @@
+/**
+ * THE UPLOAD WORKER — U5a of the detached uploader (plan §3.3, §3.9, §3.12).
+ *
+ * `vibecommit __upload-worker`: a hidden verb (not in `VERBS`, not in help), spawned detached by the hook when it has recorded a firing and
+ * no worker is alive (U6 spawns it; until then nothing does). ONE worker per machine and identity (`identity.ts`) holds
+ * `uploader.<id>.lock`, walks every session that has a firing log, and replays each session's oldest unconsumed firing ALONE through
+ * `replayStep`. The hook never waits for the network again; this process does, with a fixed request timeout and no deadline.
+ *
+ * ## What bounds it
+ *  - **One request at a time**, and after each step that made requests a sleep of `max(250 ms, the step's elapsed time)` capped at 30 s
+ *    (D9), so about half the wall clock is server work. A step is one delta per target, so it is a handful of requests at most.
+ *  - **Backoff per session** on `later`: 5 s, doubling to 5 min, with jitter. Sessions back off independently; one failing session does not
+ *    slow the rest.
+ *  - **No idle linger.** It exits when nothing is owed (release the lock, look at the queue again, and take the lock back only if
+ *    something arrived in between), after 30 min with no progress and after 60 min in all, so an upgrade takes effect and a stuck worker
+ *    cannot live on. The next hook respawns it.
+ *  - **It never waits for a session's writer lock** (a busy session is revisited) and sleeps at least 25 ms after every step that held one,
+ *    longer than a waiting `finalize` polls, so a waiter can win.
+ *  - **A newer firing version** stops it after the step in hand: a newer build owns those lines.
+ *  - **A revoked or missing credential** stops it (`fatal`); the cursor stays, so nothing is lost and the next hook retries.
+ *
+ * ## What it reports: `uploader.<id>.status`
+ * Counts, classes and times only: never a body, a path or a credential. Written atomically after every step. `status` reads it (U7), and
+ * the hook reads it for notices (U6). "Behind" is NEVER taken from the worker's own claim; `status` recomputes it from the firing logs.
+ *
+ * ## ⛔ Static imports are the worker's own. `index.ts` loads this file with a dynamic `import()` that fails closed to exit 0.
+ */
+import { writeFileAtomic } from "../atomic_write.js";
+import { drainIdleStep } from "../drain.js";
+import { firingSessions, readCursor, readFirings } from "../firing.js";
+import { unboundedPaceMs } from "../hooks/entry.js";
+import { claimUploader, UPLOADER_BEAT_MS } from "../hooks/fire_lock.js";
+import { identityDigest } from "../identity.js";
+import { uploaderStatusPath } from "../paths.js";
+import { ingestUrl } from "../post.js";
+import { replayStep, REQUEST_TIMEOUT_MS } from "../replay.js";
+/** Backoff on `later` (plan §3.12). */
+export const BACKOFF_FIRST_MS = 5_000;
+export const BACKOFF_MAX_MS = 5 * 60_000;
+/** Pacing (D9): sleep after a step that made requests. The constants and `unboundedPaceMs` live in `hooks/entry.ts`, beside the loops that must honour them. */
+/** Yield after a step that held a session lock: longer than `WRITER_POLL_MS` (20 ms) so a waiter can win. */
+export const YIELD_MS = 25;
+/** Lifetime bounds (plan §3.9). */
+export const NO_PROGRESS_MS = 30 * 60_000;
+export const TOTAL_MS = 60 * 60_000;
+/** How long a pass with nothing to do but wait (busy sessions, backoff) sleeps before looking again. */
+const IDLE_POLL_MS = 1_000;
+/** The last outcomes kept in the status file. */
+const OUTCOMES_KEPT = 20;
+const realSleep = (ms) => new Promise((resolve) => {
+    setTimeout(resolve, ms);
+});
+/** `5 s, 10 s, ... 5 min`, with ±25 % jitter. Pure given `random`. */
+export function backoffMs(failures, random) {
+    const base = Math.min(BACKOFF_MAX_MS, BACKOFF_FIRST_MS * 2 ** Math.max(0, failures - 1));
+    return Math.floor(base * (0.75 + random() * 0.5));
+}
+/** `Retry-After` wins when it is longer than our own backoff, and nothing waits past the backoff ceiling. Pure. */
+export function waitAfterLaterMs(failures, retryAfterMs, random) {
+    return Math.min(BACKOFF_MAX_MS, Math.max(backoffMs(failures, random), retryAfterMs ?? 0));
+}
+/** The sleep after a step that made requests: `max(250 ms, elapsed)`, capped. Pure. */
+export function paceMs(elapsedMs) {
+    return unboundedPaceMs(elapsedMs);
+}
+/** Did this step put requests on the wire? (`done:nothing-granted` and friends resolved targets and sent nothing.) */
+function madeRequests(step) {
+    switch (step.kind) {
+        case "more":
+        case "later":
+        case "threw":
+            return true;
+        case "fatal":
+            return step.why === "rejected";
+        case "done":
+            // U6b (F2b): a HELD step that put a request on the wire (a 403 capture_not_approved) is paced like any other; `requested` says so.
+            return step.class === "delivered" || (step.class === "held" && step.requested === true);
+        default:
+            return false;
+    }
+}
+/** Does `stem` still owe a firing of this identity? A read, no lock. */
+function owes(cfg, stem) {
+    return readFirings(cfg.home, stem, readCursor(cfg.home, stem).offset).firings.some((r) => r.firing.id === cfg.identity);
+}
+export async function runUploadWorker(opts) {
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? realSleep;
+    const random = opts.random ?? Math.random;
+    const noProgressMs = opts.noProgressMs ?? NO_PROGRESS_MS;
+    const totalMs = opts.totalMs ?? TOTAL_MS;
+    const url = ingestUrl(opts.env);
+    if (url === null)
+        return "no-url";
+    const identity = identityDigest({ url, env: opts.env });
+    const cfg = {
+        home: opts.home,
+        env: opts.env,
+        nodeVersion: opts.nodeVersion,
+        identity,
+        url,
+        requestTimeoutMs: opts.requestTimeoutMs ?? REQUEST_TIMEOUT_MS,
+    };
+    const startedAt = now();
+    let lastProgressAt = startedAt;
+    const counts = {};
+    const outcomes = [];
+    // Set when the server rejects a credential; cleared by the next delivery. Read by the hook's `credential_revoked` notice.
+    let rejected;
+    const failures = new Map();
+    const notBefore = new Map();
+    // The idle drain (U5c): bytes sent this worker life, and one backoff for the drain as a whole (a failing session rotates to the back).
+    const drain = { bytes: 0 };
+    let drainFailures = 0;
+    let drainNotBefore = 0;
+    const writeStatus = (state, exit) => {
+        const status = {
+            v: 1,
+            pid: process.pid,
+            startedAt,
+            heartbeatAt: now(),
+            state,
+            ...(exit === undefined ? {} : { exit }),
+            counts,
+            outcomes,
+            ...(rejected === undefined ? {} : { rejected }),
+        };
+        try {
+            writeFileAtomic(uploaderStatusPath(opts.home, identity), `${JSON.stringify(status)}\n`, 0o600);
+        }
+        catch {
+            // A status file that cannot be written must not stop the uploading it reports on.
+        }
+    };
+    const record = (stem, klass, elapsedMs) => {
+        counts[klass] = (counts[klass] ?? 0) + 1;
+        outcomes.push({ at: now(), class: klass, elapsedMs, session: stem });
+        if (outcomes.length > OUTCOMES_KEPT)
+            outcomes.splice(0, outcomes.length - OUTCOMES_KEPT);
+    };
+    for (;;) {
+        const claim = claimUploader(opts.home, identity);
+        if (claim === null)
+            return "not-claimed";
+        let lockLost = false;
+        // The lock is beaten from a timer, so a live worker is never judged dead however long one request runs.
+        const beat = setInterval(() => {
+            if (!claim.refresh())
+                lockLost = true;
+        }, UPLOADER_BEAT_MS);
+        beat.unref();
+        let exit = null;
+        try {
+            writeStatus("running");
+            while (exit === null) {
+                if (lockLost) {
+                    exit = "lock-lost";
+                    break;
+                }
+                if (now() - startedAt >= totalMs) {
+                    exit = "total";
+                    break;
+                }
+                if (now() - lastProgressAt >= noProgressMs) {
+                    exit = "no-progress";
+                    break;
+                }
+                let worked = false;
+                let waiting = false;
+                let newer = false;
+                for (const stem of firingSessions(opts.home)) {
+                    if ((notBefore.get(stem) ?? 0) > now()) {
+                        waiting = true;
+                        continue;
+                    }
+                    let step;
+                    try {
+                        step = await replayStep(cfg, stem);
+                    }
+                    catch {
+                        // `replayStep` counts its own throws; one that escapes it is a bug, and a worker that dies on it would crash-loop the machine.
+                        record(stem, "escaped", 0);
+                        continue;
+                    }
+                    switch (step.kind) {
+                        case "idle":
+                        case "foreign":
+                            continue;
+                        case "busy":
+                            waiting = true;
+                            continue;
+                        case "newer":
+                            newer = true;
+                            continue;
+                        case "done":
+                            if (step.class === "delivered")
+                                rejected = undefined;
+                            record(stem, `done:${step.class}`, step.elapsedMs);
+                            failures.delete(stem);
+                            notBefore.delete(stem);
+                            worked = true;
+                            lastProgressAt = now();
+                            break;
+                        case "more":
+                            record(stem, "more", step.elapsedMs);
+                            failures.delete(stem);
+                            worked = true;
+                            lastProgressAt = now();
+                            break;
+                        case "later": {
+                            const n = (failures.get(stem) ?? 0) + 1;
+                            failures.set(stem, n);
+                            notBefore.set(stem, now() + waitAfterLaterMs(n, step.retryAfterMs, random));
+                            record(stem, "later", step.elapsedMs);
+                            waiting = true;
+                            break;
+                        }
+                        case "threw":
+                            record(stem, `threw:${step.class}`, step.elapsedMs);
+                            if (step.class === "cursor-unwritable") {
+                                // U6b (F9c): a cursor that cannot be written re-ran the resolver every ~250 ms for the worker's whole life. Back off like a `later`.
+                                const n = (failures.get(stem) ?? 0) + 1;
+                                failures.set(stem, n);
+                                notBefore.set(stem, now() + waitAfterLaterMs(n, undefined, random));
+                                waiting = true;
+                            }
+                            else {
+                                worked = true;
+                            }
+                            break;
+                        case "fatal":
+                            if (step.why === "rejected" && step.fingerprint !== undefined)
+                                rejected = { at: now(), fingerprint: step.fingerprint };
+                            record(stem, `fatal:${step.why}`, step.elapsedMs);
+                            exit = "fatal";
+                            break;
+                        case "lost":
+                            record(stem, "lock-lost", 0);
+                            exit = "lock-lost";
+                            break;
+                    }
+                    writeStatus("running");
+                    if (exit !== null)
+                        break;
+                    // D9 pacing after requests; otherwise just yield the session lock long enough for a waiter to take it.
+                    await sleep(madeRequests(step) ? paceMs("elapsedMs" in step ? step.elapsedMs : 0) : YIELD_MS);
+                    if (lockLost)
+                        break;
+                }
+                if (exit !== null)
+                    break;
+                if (newer) {
+                    exit = "newer-firing";
+                    break;
+                }
+                // LIVE FIRINGS OUTRANK THE DRAIN: it runs only when this pass had no live work, and one delta at a time, so the queue is looked at again
+                // before the next one.
+                if (!worked && !newer) {
+                    if (drainNotBefore > now()) {
+                        waiting = true;
+                    }
+                    else {
+                        const step = await drainIdleStep(cfg, drain, now);
+                        switch (step.kind) {
+                            case "delivered":
+                                record("drain", "drain:delivered", step.elapsedMs);
+                                drainFailures = 0;
+                                worked = true;
+                                lastProgressAt = now();
+                                writeStatus("running");
+                                await sleep(paceMs(step.elapsedMs));
+                                break;
+                            case "later":
+                                drainFailures += 1;
+                                drainNotBefore = now() + waitAfterLaterMs(drainFailures, step.retryAfterMs, random);
+                                record("drain", "drain:later", step.elapsedMs);
+                                waiting = true;
+                                writeStatus("running");
+                                break;
+                            case "held":
+                                // F2a/c: a held (403) session costs one request, then the whole drain backs off like a `later`: the same session asked again
+                                // every second was the flood. The backoff resets on a delivery.
+                                drainFailures += 1;
+                                drainNotBefore = now() + waitAfterLaterMs(drainFailures, undefined, random);
+                                record("drain", "drain:held", step.elapsedMs);
+                                waiting = true;
+                                writeStatus("running");
+                                await sleep(paceMs(step.elapsedMs));
+                                break;
+                            case "fatal":
+                                record("drain", "drain:fatal", step.elapsedMs);
+                                exit = "fatal";
+                                break;
+                            case "idle":
+                                break;
+                        }
+                        if (exit !== null)
+                            break;
+                    }
+                }
+                if (!worked) {
+                    if (!waiting && ![...firingSessions(opts.home)].some((stem) => owes(cfg, stem))) {
+                        exit = "idle";
+                        break;
+                    }
+                    await sleep(IDLE_POLL_MS);
+                }
+            }
+            // ⛔ "EXITED" IS WRITTEN WHILE THE LOCK IS STILL OURS (P1's F3). Written after the release, a successor that claimed in the gap and wrote
+            // "running" would be overwritten by this stale "exited", and the hook's notices and `status` read this file. Then the test seam, then the release.
+            writeStatus("exited", exit ?? "idle");
+            opts.beforeRelease?.();
+        }
+        finally {
+            clearInterval(beat);
+            // Release FIRST, look at the queue SECOND: the hook appends first and checks the lock second, so at least one side sees the other.
+            claim.release();
+        }
+        if (exit === "idle" && firingSessions(opts.home).some((stem) => owes(cfg, stem))) {
+            // A firing arrived between the last look and the release, and the hook that wrote it saw our lock still held and did not spawn.
+            continue;
+        }
+        return exit ?? "idle";
+    }
+}
+/** The process entry for `__upload-worker`: real clock, real env. Never throws, never prints, always exits 0. */
+export async function runUploadWorkerMain(env, home) {
+    try {
+        await runUploadWorker({ home, env, nodeVersion: process.versions.node });
+    }
+    catch {
+        // A detached process has nobody to tell.
+    }
+    return 0;
+}
+//# sourceMappingURL=upload_worker.js.map

package/dist/commands/upload_worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload_worker.js","sourceRoot":"","sources":["../../src/commands/upload_worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAsC,MAAM,cAAc,CAAC;AAElG,uCAAuC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,gKAAgK;AAChK,6GAA6G;AAC7G,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAC3B,mCAAmC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,wGAAwG;AACxG,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,iDAAiD;AACjD,MAAM,aAAa,GAAG,EAAE,CAAC;AAuBzB,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC9C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,MAAoB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,YAAgC,EAAE,MAAoB;IACvG,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,MAAM,CAAC,SAAiB;IACtC,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,sHAAsH;AACtH,SAAS,YAAY,CAAC,IAAgB;IACpC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC;QACjC,KAAK,MAAM;YACT,mIAAmI;YACnI,OAAO,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QAC1F;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,IAAI,CAAC,GAAiB,EAAE,IAAY;IAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAmB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAiB;QACxB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ;QACR,GAAG;QACH,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,kBAAkB;KAC9D,CAAC;IAEF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,IAAI,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,0HAA0H;IAC1H,IAAI,QAAyD,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,uIAAuI;IACvI,MAAM,KAAK,GAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,WAAW,GAAG,CAAC,KAA2B,EAAE,IAAiB,EAAQ,EAAE;QAC3E,MAAM,MAAM,GAAmB;YAC7B,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS;YACT,WAAW,EAAE,GAAG,EAAE;YAClB,KAAK;YACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM;YACN,QAAQ;YACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC;QACF,IAAI,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB,EAAQ,EAAE;QACtE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,aAAa;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC;IAC3F,CAAC,CAAC;IAEF,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,wGAAwG;QACxG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACxC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,IAAI,IAAI,GAAsB,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,WAAW,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,GAAG,WAAW,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,IAAI,GAAG,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;oBACjC,IAAI,GAAG,OAAO,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,IAAI,GAAG,EAAE,GAAG,cAAc,IAAI,YAAY,EAAE,CAAC;oBAC3C,IAAI,GAAG,aAAa,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;wBACvC,OAAO,GAAG,IAAI,CAAC;wBACf,SAAS;oBACX,CAAC;oBACD,IAAI,IAAgB,CAAC;oBACrB,IAAI,CAAC;wBACH,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;wBACP,+HAA+H;wBAC/H,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;wBAC3B,SAAS;oBACX,CAAC;oBACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,MAAM,CAAC;wBACZ,KAAK,SAAS;4BACZ,SAAS;wBACX,KAAK,MAAM;4BACT,OAAO,GAAG,IAAI,CAAC;4BACf,SAAS;wBACX,KAAK,OAAO;4BACV,KAAK,GAAG,IAAI,CAAC;4BACb,SAAS;wBACX,KAAK,MAAM;4BACT,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;gCAAE,QAAQ,GAAG,SAAS,CAAC;4BACrD,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;4BACnD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;4BACtB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;4BACvB,MAAM,GAAG,IAAI,CAAC;4BACd,cAAc,GAAG,GAAG,EAAE,CAAC;4BACvB,MAAM;wBACR,KAAK,MAAM;4BACT,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;4BACrC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;4BACtB,MAAM,GAAG,IAAI,CAAC;4BACd,cAAc,GAAG,GAAG,EAAE,CAAC;4BACvB,MAAM;wBACR,KAAK,OAAO,CAAC,CAAC,CAAC;4BACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;4BACxC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;4BACtB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;4BAC5E,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;4BACtC,OAAO,GAAG,IAAI,CAAC;4BACf,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;4BACpD,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;gCACvC,qIAAqI;gCACrI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gCACxC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gCACtB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;gCACpE,OAAO,GAAG,IAAI,CAAC;4BACjB,CAAC;iCAAM,CAAC;gCACN,MAAM,GAAG,IAAI,CAAC;4BAChB,CAAC;4BACD,MAAM;wBACR,KAAK,OAAO;4BACV,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gCAAE,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;4BACvH,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;4BAClD,IAAI,GAAG,OAAO,CAAC;4BACf,MAAM;wBACR,KAAK,MAAM;4BACT,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;4BAC7B,IAAI,GAAG,WAAW,CAAC;4BACnB,MAAM;oBACV,CAAC;oBACD,WAAW,CAAC,SAAS,CAAC,CAAC;oBACvB,IAAI,IAAI,KAAK,IAAI;wBAAE,MAAM;oBACzB,uGAAuG;oBACvG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;oBAC9F,IAAI,QAAQ;wBAAE,MAAM;gBACtB,CAAC;gBACD,IAAI,IAAI,KAAK,IAAI;oBAAE,MAAM;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,GAAG,cAAc,CAAC;oBACtB,MAAM;gBACR,CAAC;gBACD,yIAAyI;gBACzI,uBAAuB;gBACvB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBACtB,IAAI,cAAc,GAAG,GAAG,EAAE,EAAE,CAAC;wBAC3B,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;wBAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;4BAClB,KAAK,WAAW;gCACd,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gCACnD,aAAa,GAAG,CAAC,CAAC;gCAClB,MAAM,GAAG,IAAI,CAAC;gCACd,cAAc,GAAG,GAAG,EAAE,CAAC;gCACvB,WAAW,CAAC,SAAS,CAAC,CAAC;gCACvB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gCACpC,MAAM;4BACR,KAAK,OAAO;gCACV,aAAa,IAAI,CAAC,CAAC;gCACnB,cAAc,GAAG,GAAG,EAAE,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gCACpF,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gCAC/C,OAAO,GAAG,IAAI,CAAC;gCACf,WAAW,CAAC,SAAS,CAAC,CAAC;gCACvB,MAAM;4BACR,KAAK,MAAM;gCACT,6HAA6H;gCAC7H,gEAAgE;gCAChE,aAAa,IAAI,CAAC,CAAC;gCACnB,cAAc,GAAG,GAAG,EAAE,GAAG,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gCAC5E,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gCAC9C,OAAO,GAAG,IAAI,CAAC;gCACf,WAAW,CAAC,SAAS,CAAC,CAAC;gCACvB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gCACpC,MAAM;4BACR,KAAK,OAAO;gCACV,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gCAC/C,IAAI,GAAG,OAAO,CAAC;gCACf,MAAM;4BACR,KAAK,MAAM;gCACT,MAAM;wBACV,CAAC;wBACD,IAAI,IAAI,KAAK,IAAI;4BAAE,MAAM;oBAC3B,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;wBAChF,IAAI,GAAG,MAAM,CAAC;wBACd,MAAM;oBACR,CAAC;oBACD,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,yIAAyI;YACzI,mJAAmJ;YACnJ,WAAW,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,mIAAmI;YACnI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,gIAAgI;YAChI,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,MAAM,CAAC;IACxB,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAsB,EAAE,IAAY;IAC5E,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/copy/strings.d.ts

@@ -139,6 +139,21 @@ export declare const STATUS: {
      * changed them to match the screen rather than changing the screen.
      */
     readonly repoLabel: "repo";
+    /**
+     * U7 (plan §3.8): the background uploader's row, machine-wide, under `last sent`. COMPUTED from the firing logs against the ledgers and from the
+     * worker's lock, never from the worker's own say-so, so a dead worker with bytes behind is "not running", never "up to date".
+     */
+    readonly uploadLabel: "upload";
+    readonly uploadValue: (view: {
+        readonly state: "up_to_date" | "sending" | "waiting_to_retry" | "not_running";
+        readonly sessions: number;
+        readonly bytes: number;
+        readonly ackAge: string | null;
+        readonly attemptAge: string | null;
+        readonly problem: "no_answer" | "credential" | "error" | null;
+    }) => string;
+    /** The line under a "not running" row. */
+    readonly uploadNotRunning: "It retries on your next agent turn.";
     /** 0.7.0, D6 · 2A: why this repo is on. One row under `repo`, only inside a repo that is on. */
     readonly basisLabel: "basis";
     readonly basisOwner: (owner: string) => string;
@@ -378,18 +393,17 @@ export declare const CONNECT: {
     /**
      * ⚠ THE NUMBER AND ITS QUALIFIER ARE ONE UNIT.
      *
-     * **12 is `CR-042`'s counted figure** (merged, `6d8ec68`), taken rather than
-     * recounted: the patterns live in `vibecommit-mcp/src/scrubber/patterns.ts`,
-     * which is closed source and another chain's repo. `CR-042` exists precisely
-     * because the draft said 10 — a number is a claim, and this one is counted
-     * from code.
+     * **13 is the server's counted figure since mcp #174** (a PEM `private_key` pattern joined the twelve `CR-042` counted, merged `6d8ec68`,
+     * so the earlier text said 12). Taken rather than recounted: the patterns live in `vibecommit-mcp/src/scrubber/patterns.ts`, which is closed
+     * source and another chain's repo. `CR-042` exists precisely because the draft said 10 — a number is a claim, and this one is counted from
+     * code. Alexander's OK for the change: 2026-11-06 04:35Z (relayed by P1); the web copy (`disclosure.ts`, digest-pinned) changes in lockstep.
      *
      * The qualifier is as load-bearing as the number. Without *"it is a pattern
      * list, not a general secret detector"* and *"a secret it has no pattern for
      * is uploaded"*, the count reads as PROTECTION — which is the reassurance D65
      * §DR7 bans, arriving as arithmetic instead of as an adjective.
      */
-    readonly consentScrubber: "A scrubber removes 12 known secret formats (AWS keys, GitHub tokens, and similar). It is a pattern list, not a general secret detector: a secret it has no pattern for is uploaded. Command output is not path-filtered.";
+    readonly consentScrubber: "A scrubber removes 13 known secret formats (AWS keys, GitHub tokens, and similar). It is a pattern list, not a general secret detector: a secret it has no pattern for is uploaded. Command output is not path-filtered.";
     /**
      * ⛔ **THE SECOND DATA CLASS, AND THE DISCLOSURE DID NOT MENTION IT AT ALL —
      * `T15`, `D190`.**
@@ -415,7 +429,7 @@ export declare const CONNECT: {
      * rightly: `post_commit.ts` gathered the list and it stayed in the spool. From 0.10.0 `capSpool` also returns `files` and the
      * delta that carries `x-commits` carries the list too, for a GRANTED REPOSITORY only (never a folder). The paths are git's own
      * (`git diff-tree -z --name-only`), unchanged, and the transcript scrubber does not run on them, which the sentence says
-     * because "a scrubber removes 12 known secret formats" two paragraphs up would otherwise read as covering them. **Not
+     * because "a scrubber removes 13 known secret formats" two paragraphs up would otherwise read as covering them. **Not
      * describing the paths as uploaded would now be the FALSE DISCLOSURE, which is as much a claims defect as describing what
      * does not leave.** The committer DATE still stays local.
      *
@@ -898,6 +912,8 @@ export declare const BACKFILL: {
     readonly parentLabel: "outside a repository";
     readonly parentTouchedNothing: "touched nothing you chose";
     readonly parentBusy: "another process was writing it";
+    /** U5b: an earlier turn of the session was recorded but could not be sent yet, so the session is not closed over it. */
+    readonly replayStopped: "an earlier turn could not be sent yet";
     readonly parentFolderRefused: "the folder's repository belongs to someone else";
     /** Skip reasons. */
     readonly overSize: "over 50 MiB";

package/dist/copy/strings.js

@@ -233,6 +233,38 @@ export const STATUS = {
      * changed them to match the screen rather than changing the screen.
      */
     repoLabel: "repo",
+    /**
+     * U7 (plan §3.8): the background uploader's row, machine-wide, under `last sent`. COMPUTED from the firing logs against the ledgers and from the
+     * worker's lock, never from the worker's own say-so, so a dead worker with bytes behind is "not running", never "up to date".
+     */
+    uploadLabel: "upload",
+    uploadValue: (view) => {
+        const size = view.bytes < 1024 ? `${view.bytes} ${view.bytes === 1 ? "byte" : "bytes"}` : view.bytes < 1048576 ? `${(view.bytes / 1024).toFixed(1)} KiB` : `${(view.bytes / 1048576).toFixed(1)} MiB`;
+        // "Behind" is RECORDED turns not yet sent (firings the hooks wrote that no worker has consumed): not the idle-drain backlog of sessions with no
+        // unconsumed firing, which this row does not count, and it includes firings of another server or credential.
+        const behind = `${view.sessions} ${view.sessions === 1 ? "session" : "sessions"} with unsent turns, ${size}`;
+        const ack = view.ackAge === null ? "nothing acknowledged yet" : `last acknowledged ${view.ackAge}`;
+        const why = view.problem === "no_answer"
+            ? "the server did not answer"
+            : view.problem === "credential"
+                ? "the server did not accept this machine's credential"
+                : view.problem === "error"
+                    ? "it stopped on an error"
+                    : null;
+        const attempt = view.attemptAge === null || why === null ? null : `last attempt ${view.attemptAge}: ${why}`;
+        switch (view.state) {
+            case "up_to_date":
+                return view.ackAge === null ? "up to date" : `up to date · ${ack}`;
+            case "sending":
+                return `sending · ${behind} · ${ack}`;
+            case "waiting_to_retry":
+                return `waiting to retry · ${behind} · ${attempt ?? ack}`;
+            case "not_running":
+                return `not running · ${behind} · ${attempt ?? ack}`;
+        }
+    },
+    /** The line under a "not running" row. */
+    uploadNotRunning: "It retries on your next agent turn.",
     /** 0.7.0, D6 · 2A: why this repo is on. One row under `repo`, only inside a repo that is on. */
     basisLabel: "basis",
     basisOwner: (owner) => `owner grant ${owner}/`,
@@ -522,18 +554,17 @@ export const CONNECT = {
     /**
      * ⚠ THE NUMBER AND ITS QUALIFIER ARE ONE UNIT.
      *
-     * **12 is `CR-042`'s counted figure** (merged, `6d8ec68`), taken rather than
-     * recounted: the patterns live in `vibecommit-mcp/src/scrubber/patterns.ts`,
-     * which is closed source and another chain's repo. `CR-042` exists precisely
-     * because the draft said 10 — a number is a claim, and this one is counted
-     * from code.
+     * **13 is the server's counted figure since mcp #174** (a PEM `private_key` pattern joined the twelve `CR-042` counted, merged `6d8ec68`,
+     * so the earlier text said 12). Taken rather than recounted: the patterns live in `vibecommit-mcp/src/scrubber/patterns.ts`, which is closed
+     * source and another chain's repo. `CR-042` exists precisely because the draft said 10 — a number is a claim, and this one is counted from
+     * code. Alexander's OK for the change: 2026-11-06 04:35Z (relayed by P1); the web copy (`disclosure.ts`, digest-pinned) changes in lockstep.
      *
      * The qualifier is as load-bearing as the number. Without *"it is a pattern
      * list, not a general secret detector"* and *"a secret it has no pattern for
      * is uploaded"*, the count reads as PROTECTION — which is the reassurance D65
      * §DR7 bans, arriving as arithmetic instead of as an adjective.
      */
-    consentScrubber: "A scrubber removes 12 known secret formats (AWS keys, GitHub tokens, and similar). It is a pattern list, not a general secret detector: a secret it has no pattern for is uploaded. Command output is not path-filtered.",
+    consentScrubber: "A scrubber removes 13 known secret formats (AWS keys, GitHub tokens, and similar). It is a pattern list, not a general secret detector: a secret it has no pattern for is uploaded. Command output is not path-filtered.",
     /**
      * ⛔ **THE SECOND DATA CLASS, AND THE DISCLOSURE DID NOT MENTION IT AT ALL —
      * `T15`, `D190`.**
@@ -559,7 +590,7 @@ export const CONNECT = {
      * rightly: `post_commit.ts` gathered the list and it stayed in the spool. From 0.10.0 `capSpool` also returns `files` and the
      * delta that carries `x-commits` carries the list too, for a GRANTED REPOSITORY only (never a folder). The paths are git's own
      * (`git diff-tree -z --name-only`), unchanged, and the transcript scrubber does not run on them, which the sentence says
-     * because "a scrubber removes 12 known secret formats" two paragraphs up would otherwise read as covering them. **Not
+     * because "a scrubber removes 13 known secret formats" two paragraphs up would otherwise read as covering them. **Not
      * describing the paths as uploaded would now be the FALSE DISCLOSURE, which is as much a claims defect as describing what
      * does not leave.** The committer DATE still stays local.
      *
@@ -1066,6 +1097,8 @@ export const BACKFILL = {
     parentLabel: "outside a repository",
     parentTouchedNothing: "touched nothing you chose",
     parentBusy: "another process was writing it",
+    /** U5b: an earlier turn of the session was recorded but could not be sent yet, so the session is not closed over it. */
+    replayStopped: "an earlier turn could not be sent yet",
     parentFolderRefused: "the folder's repository belongs to someone else",
     /** Skip reasons. */
     overSize: "over 50 MiB",