instar 1.3.339 → 1.3.341

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgxRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA06RtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -2304,6 +2304,94 @@ export async function startServer(options) {
                 console.log(pc.yellow('  Standby mode — processing gated, writes disabled'));
             }
         }
+        // ── Coherence Journal (COHERENCE-JOURNAL-SPEC §3.1/§3.3, P1.1) ─────────
+        // Per-machine append-only event streams (topic-placement / session-
+        // lifecycle / autonomous-run). Dark-ship: `enabled ?? !!developmentAgent`.
+        // Constructed HERE — after the coordinator (machineId available), before
+        // the reaper/ownership wiring that emits into it. Writer runs even on a
+        // single-machine agent (locally useful); replication is P1.3.
+        let coherenceJournal;
+        {
+            const cjCfg = config.multiMachine?.coherenceJournal;
+            const cjEnabled = cjCfg?.enabled ?? !!config.developmentAgent;
+            if (cjEnabled) {
+                try {
+                    const cjMod = await import('../core/CoherenceJournal.js');
+                    // Stable machine id: mesh identity when present; deterministic
+                    // hostname-derived fallback for single-machine agents (sanitized by
+                    // the journal's own percent-encode rule either way).
+                    const cjMachineId = coordinator.identity?.machineId ?? `m_host_${os.hostname()}`;
+                    coherenceJournal = new cjMod.CoherenceJournal({
+                        stateDir: config.stateDir,
+                        machineId: cjMachineId,
+                        flushIntervalMs: cjCfg?.flushIntervalMs,
+                        retention: cjCfg?.retention,
+                        // The §3.1 standby-safe seam: the flusher asks StateManager before
+                        // each append batch; the prefix allowlist lives there.
+                        guardWrite: (p) => state.guardJournalWrite(p),
+                        logger: (m) => console.log(pc.dim(`  [coherence-journal] ${m}`)),
+                    });
+                    coherenceJournal.open();
+                    // Lifecycle funnel (§3.3): every session status transition flows
+                    // through StateManager.saveSession; the diff-derived emit lives there.
+                    state.setCoherenceJournal(coherenceJournal);
+                    // §3.3 autonomous-run journal scanner — observation-based start/stop
+                    // (no single .local.md write funnel exists; polling is the structural
+                    // choice). P19 brakes, declared: constant per-tick cost (bounded by
+                    // maxConcurrent active runs); a throwing read skips the tick and
+                    // never compounds; the seen-set evicts a run after its stopped emit
+                    // (bounded by active runs, not history); emits inherit the writer's
+                    // rate cap. Sub-scan-interval runs are not observed (stated spec
+                    // limitation). Op-key dedupe collapses scanner + stop-funnel emits.
+                    {
+                        const journal = coherenceJournal;
+                        const cjScannerMs = cjCfg?.scannerIntervalMs ?? 60000;
+                        const seenRuns = new Map();
+                        const cjScan = async () => {
+                            try {
+                                const { activeAutonomousJobs, autonomousRunId } = await import('../core/AutonomousSessions.js');
+                                const active = activeAutonomousJobs(config.stateDir);
+                                const liveTopics = new Set();
+                                for (const j of active) {
+                                    if (j.topic == null)
+                                        continue; // legacy single-file job: not topic-scoped
+                                    liveTopics.add(j.topic);
+                                    const topicNum = Number(j.topic);
+                                    if (!Number.isFinite(topicNum))
+                                        continue;
+                                    if (!seenRuns.has(j.topic)) {
+                                        const runId = autonomousRunId(j.startedAt, j.topic);
+                                        seenRuns.set(j.topic, { runId, file: j.file });
+                                        journal.emitAutonomousRun(topicNum, { action: 'started', runId, artifactPaths: [j.file] });
+                                    }
+                                }
+                                for (const [topicKey, run] of [...seenRuns]) {
+                                    if (liveTopics.has(topicKey))
+                                        continue;
+                                    const topicNum = Number(topicKey);
+                                    if (Number.isFinite(topicNum)) {
+                                        // observed-stopped: covers deaths outside the stop funnels
+                                        // (crash / reboot / reaper kill) — no phantom-live runs.
+                                        journal.emitAutonomousRun(topicNum, { action: 'stopped', runId: run.runId, artifactPaths: [run.file] });
+                                    }
+                                    seenRuns.delete(topicKey);
+                                }
+                            }
+                            catch { /* @silent-fallback-ok: journal observability must never endanger the observed operation (COHERENCE-JOURNAL-SPEC §3.1) */ /* skip-tick; never compounds (P19) */ }
+                        };
+                        const cjScanTimer = setInterval(() => { void cjScan(); }, cjScannerMs);
+                        cjScanTimer.unref?.();
+                        void cjScan(); // prime at boot (re-emits dedupe via op keys)
+                    }
+                    console.log(pc.dim(`  Coherence journal: writer active (${cjMachineId.slice(0, 16)}…)`));
+                }
+                catch (err) { /* @silent-fallback-ok: journal observability must never endanger the observed operation (COHERENCE-JOURNAL-SPEC §3.1) */
+                    // The journal must never endanger boot (§3.1 inverted at startup).
+                    console.warn(pc.yellow(`  Coherence journal failed to start (continuing without): ${err instanceof Error ? err.message : String(err)}`));
+                    coherenceJournal = undefined;
+                }
+            }
+        }
         // Cross-Machine Seamlessness (spec §9) — resolve + validate the tunable
         // knobs at startup. A violating config (e.g. a widened ingressHeartbeatMs
         // that breaks the RPO bound) is REJECTED here with a clear message rather
@@ -3577,6 +3665,16 @@ export async function startServer(options) {
                 console.error(`[server] Failed to ensure Agent Updates topic: ${err}`);
             });
         }
+        // ── Coherence Journal × Telegram emergency-stop seam (COHERENCE-JOURNAL §3.3)
+        // The adapter's sentinel emergency-stop path clears a topic's autonomous job
+        // via stopAutonomousTopic but holds no StateManager, so it cannot reach the
+        // wired journal on its own. Inject the journal as the AutonomousJournalSeam so
+        // a sentinel-driven stop emits the autonomous-run `stopped` event like every
+        // other stop funnel. Placed AFTER both adapter-setup blocks (so `telegram` is
+        // assigned in either mode) and only when the journal is wired.
+        if (telegram && coherenceJournal) {
+            telegram.setCoherenceJournalSeam(coherenceJournal);
+        }
         // Agent worktree convention (Layer 4) — lifeline detector.
         //
         // Runs once per server boot. Inspects the canonical instar repo's
@@ -4301,6 +4399,19 @@ export async function startServer(options) {
                 origin: e.origin,
             });
             reapNotifier.onReaped({ session: e.session, reason: e.reason, disposition: e.disposition, origin: e.origin });
+            // Coherence journal 'reaped' (§3.3): emitted HERE, alongside the
+            // reap-log append it references — never derived in the saveSession
+            // funnel (which records the plain killed/completed transition).
+            try {
+                const m = /(?:^|[-_])(?:topic|telegram)[-_]?(\d+)(?:$|[-_])/.exec(e.session.name ?? '');
+                coherenceJournal?.emitLifecycle({
+                    sessionId: e.session.id,
+                    status: 'reaped',
+                    reapReason: e.reason,
+                    reapLogRef: `logs/reap-log.jsonl:${e.session.name}`,
+                }, m ? Number(m[1]) : undefined);
+            }
+            catch { /* observability never endangers the observed */ }
         });
         sessionManager.on('reapBlocked', (e) => {
             reapLog.recordSkipped({
@@ -4317,6 +4428,18 @@ export async function startServer(options) {
         // lifeline to restart the server in a tight loop.
         await sessionManager.purgeDeadSessions();
         sessionManager.startMonitoring();
+        // Pending-inject recovery (finding 8d300555): re-deliver initial messages
+        // orphaned by the previous server process dying in the spawn→ready→inject
+        // window (the auto-updater restart race). Runs AFTER the purge so dead
+        // sessions are already settled, and in the background — the ready-waits
+        // inside can take up to 90s per session and must not block boot.
+        void sessionManager.recoverPendingInjects().catch((err) => {
+            // @silent-fallback-ok boot recovery is a backstop that must NEVER crash
+            // boot — its own internal failures already route to DegradationReporter
+            // (sweepPendingInjects.reportLoss); this outer guard only catches an
+            // unexpected throw from the sweep harness itself.
+            console.error(`[server] Pending-inject recovery failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        });
         // StuckInputSentinel — persistent, restart-safe recovery for tmux prompts
         // that hold text but never submitted Enter. Complements the in-process
         // verifyInjection timers (PR #159) which die when the server crashes.
@@ -9307,16 +9430,55 @@ export async function startServer(options) {
                     logger: (m) => console.log(pc.dim(`  ${m}`)),
                 });
                 const ownReg = sessionOwnershipRegistry;
+                // Coherence journal §3.3: the emit is a thin wrapper at every CAS call
+                // site — `reason` is caller knowledge (cas() is a storage primitive and
+                // cannot know WHY). A mesh-applied action records the coarse reason;
+                // the ORIGINATING machine's own emit carries the precise one. The
+                // cas-pairing lint (scripts/lint-cas-emit-placement.js) fails CI on
+                // any cas( call site missing this pairing.
+                const emitPlacement = (sessionKey, r, reason, prevOwner) => {
+                    try {
+                        if (!coherenceJournal || !r?.ok)
+                            return;
+                        const rec = r.record;
+                        const topicNum = Number(sessionKey);
+                        if (!Number.isFinite(topicNum) || rec?.ownershipEpoch == null)
+                            return;
+                        coherenceJournal.emitPlacement(topicNum, {
+                            owner: rec.ownerMachineId ?? '',
+                            ...(prevOwner ? { prevOwner } : {}),
+                            epoch: rec.ownershipEpoch,
+                            reason,
+                        });
+                    }
+                    catch { /* observability never endangers the observed */ }
+                };
                 // The §L3 ownership commands, routed from MeshRpc to the registry CAS.
                 const ownAction = (cmd, sender, env) => {
-                    if (cmd.type === 'place')
-                        return ownReg.cas({ type: 'place', machineId: cmd.machine }, { sessionKey: cmd.session, sender, nonce: env.nonce });
-                    if (cmd.type === 'claim')
-                        return ownReg.cas({ type: 'claim', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
-                    if (cmd.type === 'transfer')
-                        return ownReg.cas({ type: 'transfer', to: cmd.target }, { sessionKey: cmd.session, sender, nonce: env.nonce });
-                    if (cmd.type === 'release')
-                        return ownReg.cas({ type: 'release', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'place') {
+                        const prev = ownReg.read(cmd.session)?.ownerMachineId;
+                        const r = ownReg.cas({ type: 'place', machineId: cmd.machine }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                        emitPlacement(cmd.session, r, 'placed', prev);
+                        return r;
+                    }
+                    if (cmd.type === 'claim') {
+                        const prev = ownReg.read(cmd.session)?.ownerMachineId;
+                        const r = ownReg.cas({ type: 'claim', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                        emitPlacement(cmd.session, r, cmd.failover ? 'failover' : 'placed', prev);
+                        return r;
+                    }
+                    if (cmd.type === 'transfer') {
+                        const prev = ownReg.read(cmd.session)?.ownerMachineId;
+                        const r = ownReg.cas({ type: 'transfer', to: cmd.target }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                        emitPlacement(cmd.session, r, 'user-move', prev);
+                        return r;
+                    }
+                    if (cmd.type === 'release') {
+                        const prev = ownReg.read(cmd.session)?.ownerMachineId;
+                        const r = ownReg.cas({ type: 'release', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                        emitPlacement(cmd.session, r, 'released', prev);
+                        return r;
+                    }
                     return { ok: false, reason: 'unsupported' };
                 };
                 // The §L4 owner-side deliverMessage receive handler (shared factory — same
@@ -9702,7 +9864,9 @@ export async function startServer(options) {
                         markOwnerSuspect: (m) => ownerSuspectBreaker.markSuspect(m),
                         onOwnerResponsive: (m) => ownerSuspectBreaker.recordSuccess(m),
                         casClaimOwnership: (sk, machineId) => {
+                            const prevOwner = ownReg.read(sk)?.ownerMachineId;
                             const r = ownReg.cas({ type: 'place', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:c:${++routerNonce}` });
+                            emitPlacement(sk, r, 'placed', prevOwner);
                             return { ok: r.ok, epoch: ownReg.read(sk)?.ownershipEpoch ?? 0 };
                         },
                         // bug #11: confirm the remote owner (placing → active) after the spawn is
@@ -9711,7 +9875,9 @@ export async function startServer(options) {
                         // owner, so the router confirms on the target's behalf. Without this the
                         // record stays 'placing' and every later message for the session queues.
                         confirmClaim: (sk, machineId) => {
-                            ownReg.cas({ type: 'claim', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:cl:${++routerNonce}` });
+                            const prevOwner = ownReg.read(sk)?.ownerMachineId;
+                            const r = ownReg.cas({ type: 'claim', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:cl:${++routerNonce}` });
+                            emitPlacement(sk, r, 'placed', prevOwner); // placing→active confirmation: a real epoch bump in the registry
                         },
                         deliverMessage: async (target, env) => {
                             const url = peerUrl(target);
@@ -9879,7 +10045,9 @@ export async function startServer(options) {
                             // If THIS machine actively owns the topic, release so the next message re-places to the pin.
                             try {
                                 if (ownReg.ownerOf(sessionKey) === meshSelfId) {
-                                    ownReg.cas({ type: 'release', machineId: meshSelfId }, { sessionKey, sender: meshSelfId, nonce: `${meshSelfId}:rel:${sessionKey}:${Math.round(performance.now())}` });
+                                    const prevOwner = ownReg.read(sessionKey)?.ownerMachineId;
+                                    const r = ownReg.cas({ type: 'release', machineId: meshSelfId }, { sessionKey, sender: meshSelfId, nonce: `${meshSelfId}:rel:${sessionKey}:${Math.round(performance.now())}` });
+                                    emitPlacement(sessionKey, r, 'user-move', prevOwner); // the explicit move's release half
                                 }
                             }
                             catch { /* best-effort; route() re-places regardless once the owner is cleared */ }