instar 1.3.336 → 1.3.338

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4uRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgxRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -5803,7 +5803,8 @@ export async function startServer(options) {
                     ? '  ActiveWorkSilenceSentinel enabled (silent-freeze watchdog — Telegram escalation ON, consolidated)'
                     : '  ActiveWorkSilenceSentinel enabled (silent-freeze watchdog — logs only, Telegram escalation OFF)'));
             }
-            // ── ContextWedgeSentinel — thinking-block-400 fast-fail wedge ──
+            // ── ContextWedgeSentinel — transcript fast-fail wedges (thinking-block
+            // 400 + AUP-rejection loop) ──
             // Detection + audit ship default-ON (harmless housekeeping). The
             // destructive fresh-respawn is gated by autoRecovery (default OFF +
             // dryRun) and rides the Graduated Feature Rollout track. freshRespawn is
@@ -5832,15 +5833,15 @@ export async function startServer(options) {
                     tickIntervalMs: wedgeCfg.tickIntervalMs,
                     confirmWindowMs: wedgeCfg.confirmWindowMs,
                 });
-                wedgeSentinel.on('detected', (e) => notifier.record('detected', 'context-wedge', e.sessionName));
-                wedgeSentinel.on('recovered', (e) => notifier.record('recovered', 'context-wedge', e.sessionName, 'fresh respawn'));
-                wedgeSentinel.on('dry-run', (e) => notifier.record('dry-run', 'context-wedge', e.sessionName, 'would fresh-respawn'));
+                wedgeSentinel.on('detected', (e) => notifier.record('detected', 'context-wedge', e.sessionName, e.kind));
+                wedgeSentinel.on('recovered', (e) => notifier.record('recovered', 'context-wedge', e.sessionName, `fresh respawn (${e.kind ?? 'unknown'})`));
+                wedgeSentinel.on('dry-run', (e) => notifier.record('dry-run', 'context-wedge', e.sessionName, `would fresh-respawn (${e.kind ?? 'unknown'})`));
                 wedgeSentinel.on('false-alarm', (e) => notifier.record('false-alarm', 'context-wedge', e.sessionName, 'signature scrolled out of tail'));
                 wedgeSentinel.on('recovery-error', (e) => notifier.record('recovery-error', 'context-wedge', e.sessionName, e.err instanceof Error ? e.err.message : String(e.err)));
                 wedgeSentinel.start();
                 wedgeRecoveryActive = (s) => wedgeSentinel.isRecoveryActive(s);
                 const mode = autoRecovery.enabled ? (autoRecovery.dryRun ? 'auto-recover dry-run' : 'auto-recover LIVE') : 'detect-only';
-                console.log(pc.green(`  ContextWedgeSentinel enabled (thinking-block-400 wedge — ${mode})`));
+                console.log(pc.green(`  ContextWedgeSentinel enabled (thinking-block-400 + aup-rejection wedges — ${mode})`));
             }
         }
         // Recompose the zombie-kill veto to include ALL four recovery sentinels now
@@ -9653,10 +9654,39 @@ export async function startServer(options) {
                     // Shared-cluster writes stay blocked on a standby. (bug #9: the moved session's
                     // saveSession was blocked by the standby read-only guard.)
                     state.setSessionPoolActive(true);
+                    // Per-peer suspect breaker (P19) — the markOwnerSuspect hook's missing
+                    // half. A peer whose deliveries exhaust retries is short-circuited for
+                    // a half-open 30s window: every session it owns goes straight to the
+                    // EXISTING failover re-place path instead of re-paying the ~4.5s retry
+                    // tax per message. Any successful delivery closes the window; sustained
+                    // suspicion (10min of consecutive windows) raises ONE degradation
+                    // signal per episode.
+                    const ownerSuspectBreaker = new (await import('../core/OwnerSuspectBreaker.js')).OwnerSuspectBreaker({
+                        logger: (m) => console.log(pc.dim(m)),
+                        reportSustained: ({ machineId, suspectForMs, marks }) => {
+                            DegradationReporter.getInstance().report({
+                                feature: 'SessionPool.ownerDelivery',
+                                primary: 'Messages forward to the machine that owns their session',
+                                fallback: `Owner ${machineId} unresponsive to deliveries for ~${Math.round(suspectForMs / 60_000)}min (${marks} suspect windows); its sessions re-place on dispatch; half-open re-probes continue`,
+                                reason: 'deliverMessage retries to the owning machine keep exhausting',
+                                impact: 'Sessions owned by that machine fail over to other machines on their next message instead of being delivered in place.',
+                            });
+                        },
+                    });
                     _sessionRouter = new routerMod.SessionRouter({
                         selfMachineId: meshSelfId,
                         placement: new placeMod.PlacementExecutor(),
-                        machineRegistry: () => machinePoolRegistry?.getCapacities() ?? [],
+                        // Placement must consult the breaker too: a message re-placed OFF a
+                        // suspect owner must not be placed right back ONTO it. Suspect
+                        // machines are filtered from the candidate set UNLESS that would
+                        // empty it — with every machine suspect, placement proceeds on the
+                        // full set (mirrors the all-machines-quota-blocked precedent:
+                        // degraded placement beats no placement).
+                        machineRegistry: () => {
+                            const all = machinePoolRegistry?.getCapacities() ?? [];
+                            const ok = all.filter((c) => !ownerSuspectBreaker.isSuspect(c.machineId));
+                            return ok.length > 0 ? ok : all;
+                        },
                         resolveOwnership: (sk) => {
                             const r = ownReg.read(sk);
                             if (!r)
@@ -9664,7 +9694,13 @@ export async function startServer(options) {
                             const status = r.status === 'released' ? null : r.status;
                             return { owner: ownReg.ownerOf(sk), epoch: r.ownershipEpoch, status, target: ownReg.placementTargetOf(sk) ?? undefined };
                         },
-                        isMachineAlive: (m) => m === meshSelfId || (machinePoolRegistry?.getCapacity(m)?.online ?? false),
+                        // Capacity-online AND not currently suspect: a slow-but-heartbeating
+                        // peer that keeps failing deliveries reads as not-alive for routing,
+                        // sending its sessions down the existing failover re-place path
+                        // without each message re-paying the retry tax.
+                        isMachineAlive: (m) => m === meshSelfId || ((machinePoolRegistry?.getCapacity(m)?.online ?? false) && !ownerSuspectBreaker.isSuspect(m)),
+                        markOwnerSuspect: (m) => ownerSuspectBreaker.markSuspect(m),
+                        onOwnerResponsive: (m) => ownerSuspectBreaker.recordSuccess(m),
                         casClaimOwnership: (sk, machineId) => {
                             const r = ownReg.cas({ type: 'place', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:c:${++routerNonce}` });
                             return { ok: r.ok, epoch: ownReg.read(sk)?.ownershipEpoch ?? 0 };