instar 1.3.142 → 1.3.143

package/dist/server/machineAuth.d.ts

@@ -46,16 +46,22 @@ export interface SignedHeaders {
     'X-Sequence': string;
     'X-Signature': string;
 }
+/** The next process-global machineAuth sequence (strictly increasing). */
+export declare function nextMachineAuthSequence(): number;
 /**
  * Sign an outgoing request with machine credentials.
  *
  * @param machineId - This machine's ID
  * @param privateKeyPem - Ed25519 private key in PEM format
  * @param body - The request body (will be JSON stringified for hashing)
- * @param sequence - The sequence number for this request
+ * @param _legacySequence - IGNORED. Retained for signature compatibility with
+ *   existing callers. The sequence is now drawn from the process-global
+ *   `nextMachineAuthSequence()` so every channel shares one monotonic counter
+ *   (see the note above — per-caller counters collided on the receiver's
+ *   per-machine watermark). New callers may omit it.
  * @returns Headers to include in the request
  */
-export declare function signRequest(machineId: string, privateKeyPem: string, body: unknown, sequence: number): SignedHeaders;
+export declare function signRequest(machineId: string, privateKeyPem: string, body: unknown, _legacySequence?: number): SignedHeaders;
 export interface Challenge {
     /** Random 32-byte challenge, hex-encoded */
     challenge: string;

package/dist/server/machineAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machineAuth.d.ts","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI1D,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,eAAe,EAAE,sBAAsB,CAAC;IACxC,wCAAwC;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,mCAAmC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,IACjD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CA+F/D;AAID,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACf,aAAa,CAiBf;AAID,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,YAAY,CAAiC;;IAQrD,8DAA8D;IAC9D,QAAQ,IAAI,SAAS;IAUrB;;;OAGG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAatC,mCAAmC;IACnC,OAAO,CAAC,OAAO;IASf,8BAA8B;IAC9B,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"machineAuth.d.ts","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI1D,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,eAAe,EAAE,sBAAsB,CAAC;IACxC,wCAAwC;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,mCAAmC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,IACjD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CA+F/D;AAID,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAkBD,0EAA0E;AAC1E,wBAAgB,uBAAuB,IAAI,MAAM,CAGhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,eAAe,CAAC,EAAE,MAAM,GACvB,aAAa,CAkBf;AAID,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,YAAY,CAAiC;;IAQrD,8DAA8D;IAC9D,QAAQ,IAAI,SAAS;IAUrB;;;OAGG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAatC,mCAAmC;IACnC,OAAO,CAAC,OAAO;IASf,8BAA8B;IAC9B,OAAO,IAAI,IAAI;CAGhB"}

package/dist/server/machineAuth.js

@@ -105,16 +105,42 @@ export function machineAuthMiddleware(deps) {
         next();
     };
 }
+/**
+ * Process-global monotonic sequence for ALL machineAuth-signed outbound requests.
+ *
+ * The receiver's NonceStore tracks ONE monotonic sequence PER SENDING MACHINE
+ * (src/core/NonceStore.ts) — so EVERY signed channel from this process (lease
+ * broadcast, machine heartbeat, handoff, reply-marker, live-tail, …) MUST draw
+ * from a single shared counter. They previously each used their own
+ * `Date.now()`-seeded counter; the fast-firing heartbeat pushed the receiver's
+ * per-machine watermark high while the slow lease counter stayed low, so every
+ * lease broadcast was rejected as an out-of-order replay and the standby never
+ * learned the holder (found live 2026-05-31:
+ * `Sequence 1780200440053 <= last seen 1780200440744`). Seeding from `Date.now()`
+ * keeps it monotonic across a process restart (wall-clock only advances), so the
+ * receiver's persisted watermark from a prior run is never above our fresh seed.
+ */
+let __machineAuthSequence = Date.now();
+/** The next process-global machineAuth sequence (strictly increasing). */
+export function nextMachineAuthSequence() {
+    __machineAuthSequence += 1;
+    return __machineAuthSequence;
+}
 /**
  * Sign an outgoing request with machine credentials.
  *
  * @param machineId - This machine's ID
  * @param privateKeyPem - Ed25519 private key in PEM format
  * @param body - The request body (will be JSON stringified for hashing)
- * @param sequence - The sequence number for this request
+ * @param _legacySequence - IGNORED. Retained for signature compatibility with
+ *   existing callers. The sequence is now drawn from the process-global
+ *   `nextMachineAuthSequence()` so every channel shares one monotonic counter
+ *   (see the note above — per-caller counters collided on the receiver's
+ *   per-machine watermark). New callers may omit it.
  * @returns Headers to include in the request
  */
-export function signRequest(machineId, privateKeyPem, body, sequence) {
+export function signRequest(machineId, privateKeyPem, body, _legacySequence) {
+    const sequence = nextMachineAuthSequence();
     const timestamp = Math.floor(Date.now() / 1000).toString();
     const nonce = crypto.randomBytes(16).toString('hex');
     const bodyHash = crypto.createHash('sha256')

package/dist/server/machineAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"machineAuth.js","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAyB1D,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;QACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QAEnE,iCAAiC;QACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,eAAe;gBACtB,SAAS;gBACT,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBACrE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC1C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,6BAA6B;QAC7D,KAAK,EACL,MAAM,EACN,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAEnF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;iBACpD,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,6CAA6C;QAC5C,GAAW,CAAC,WAAW,GAAG;YACzB,SAAS;YACT,QAAQ,EAAE,MAAM;SACY,CAAC;QAE/B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,aAAqB,EACrB,IAAa,EACb,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzC,OAAO;QACL,cAAc,EAAE,SAAS;QACzB,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,+CAA+C;QAC/C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa;YAC7C,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IAC3B,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"machineAuth.js","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAyB1D,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;QACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QAEnE,iCAAiC;QACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,eAAe;gBACtB,SAAS;gBACT,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBACrE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC1C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,6BAA6B;QAC7D,KAAK,EACL,MAAM,EACN,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAEnF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;iBACpD,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,6CAA6C;QAC5C,GAAW,CAAC,WAAW,GAAG;YACzB,SAAS;YACT,QAAQ,EAAE,MAAM;SACY,CAAC;QAE/B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,IAAI,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB;IACrC,qBAAqB,IAAI,CAAC,CAAC;IAC3B,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,aAAqB,EACrB,IAAa,EACb,eAAwB;IAExB,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzC,OAAO;QACL,cAAc,EAAE,SAAS;QACzB,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,+CAA+C;QAC/C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa;YAC7C,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IAC3B,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.142",
+  "version": "1.3.143",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-31T04:37:55.427Z",
-  "instarVersion": "1.3.142",
+  "generatedAt": "2026-05-31T04:44:08.984Z",
+  "instarVersion": "1.3.143",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.143.md

@@ -0,0 +1,44 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Multi-machine: fixes the next bug blocking cross-machine session transfer.**
+When two machines talk, each message carries an ever-increasing number so the
+receiver can reject replayed old messages. A machine has several lines of
+communication to its peer (the in-charge lease, the heartbeat, handoffs, the live
+tail), and each kept its own number seeded from the clock — so they drifted apart.
+The receiver only tracks one highest-number-seen per machine, so the fast
+heartbeat pushed that number high and the quieter lease line's messages then
+looked out-of-order and were dropped as replays. The standby machine therefore
+never received the lease announcement and refused to take over a conversation.
+This change makes every line on a machine share ONE ever-increasing number from a
+single chokepoint, so legitimate messages are never mistaken for replays. The
+receiver's replay protection (unique tokens + a 30-second freshness window + the
+per-machine number) is unchanged. Single-machine agents are unaffected.
+
+## What to Tell Your User
+
+If you run on one machine, nothing changes. If you run one agent across two
+machines, this fixes a hidden issue where the second machine was silently dropping
+the messages that tell it which machine is in charge — a step toward moving a
+conversation between machines working end to end. Nothing to configure.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Shared machine-auth sequence | Automatic. All of a machine's signed peer requests now share one monotonic sequence, so the lease/heartbeat/handoff/live-tail channels no longer collide on the receiver's per-machine replay watermark. No configuration. |
+
+## Evidence
+
+- `tests/unit/machine-auth.test.ts` (21) updated to the new chokepoint contract,
+  plus a regression: two channels signing via signRequest stay strictly monotonic
+  (no cross-transport collision), and a direct NonceStore stale-sequence-rejection
+  test (receiver behavior preserved).
+- `tests/integration/machine-routes.test.ts` (23) green — no sequence regression.
+- `tsc --noEmit` + repo lint clean.
+- Live evidence that motivated it: the standby's security log showed
+  "Sequence …053 <= last seen …744" rejecting every lease broadcast.
+- Side-effects: `upgrades/side-effects/machineauth-shared-sequence.md`.

package/upgrades/side-effects/machineauth-shared-sequence.md

@@ -0,0 +1,60 @@
+# Side-Effects Review — machineAuth shared monotonic sequence
+
+**Version / slug:** `machineauth-shared-sequence`
+**Date:** `2026-05-31`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+`signRequest` (the single function every machineAuth-signed outbound request flows
+through) now assigns the X-Sequence from a process-global monotonic counter
+(`nextMachineAuthSequence()`, seeded from `Date.now()`) instead of the per-caller
+`sequence` argument (now ignored). Fixes the cross-transport replay collision: the
+receiver tracks one monotonic sequence per sending machine, but each channel had
+its own `Date.now()`-seeded counter, so a lower-seeded channel (the lease
+broadcast) was rejected as out-of-order forever.
+
+## Decision-point inventory
+
+1. **signRequest sequence source** → always `nextMachineAuthSequence()` (global,
+   monotonic), regardless of the passed arg.
+
+## 1. Over-block
+
+**What legitimate inputs does this reject?** None — it makes MORE requests succeed.
+Previously-rejected legitimate lease broadcasts now pass. The receiver's replay
+defenses are unchanged: nonce uniqueness + 30s timestamp window + per-machine
+monotonic sequence all still run. A genuine replay (reused nonce, or stale
+timestamp, or a sequence below the watermark) is still rejected exactly as before.
+
+## 2. Under-block
+
+**What does this still miss?** Nothing new. Anti-replay strength is unchanged; the
+fix only makes a single sender's many channels share one monotonic sequence
+(which is what the per-machine watermark always assumed). Cross-MACHINE replay is
+still caught (each machine has its own watermark on the receiver).
+
+## 3. Blast radius
+
+- `signRequest` is used by every machineAuth sender: lease broadcast, heartbeat,
+  handoff, reply-marker, live-tail, MessageRouter relay, and the `instar pair`/
+  handoff CLI. ALL now share the global counter — this is the intended fix (the
+  chokepoint guarantees no caller can bypass it).
+- The per-caller sequence counters in server.ts / MessageRouter become inert
+  (their value is ignored); left in place to minimize churn — harmless dead args.
+- Tests: `machine-auth.test.ts` (21) updated to the new contract + a regression
+  for the interleaved-channel monotonicity + a direct NonceStore stale-rejection
+  test. `machine-routes.test.ts` integration (23) green. tsc + lint clean.
+
+## 4. Rollback
+
+Pure code (no migration/config/schema). Rollback = revert the PR. The sequence
+reverts to per-caller, re-introducing the collision (so don't revert without
+re-introducing bug #3).
+
+## 5. Failure modes
+
+- Process restart → counter re-seeds from the new (higher) `Date.now()`, still
+  above any prior watermark. Monotonic across restarts by construction.
+- Concurrency → single-threaded JS; `nextMachineAuthSequence` increments atomically.