instar 1.3.43 → 1.3.44

package/dist/core/ReplyMarkerTransport.js

@@ -0,0 +1,66 @@
+/**
+ * ReplyMarkerTransport — propagates the `reply_committed` marker from the lease
+ * holder to the standby peer(s) over the authenticated machine channel (spec §8
+ * G3a, "dual-medium sent-marker"). The cross-machine half of exactly-once.
+ *
+ * When the holder commits a reply, it broadcasts a small marker
+ * {dedupeKey, replyIdempotencyKey, epoch, topic} to each standby. The standby
+ * applies it via MessageProcessingLedger.applyRemoteReplyMarker, so AFTER a
+ * handoff/failover the newly-awake machine already knows that event was answered
+ * — a provider redelivery of the same inbound is then dropped by the dedup gate,
+ * closing the cross-machine double-reply window the lease alone can't (a
+ * redelivery arriving at the new holder for a message the OLD holder answered).
+ *
+ * The marker carries NO conversation content (just the dedupeKey + the
+ * deterministic idempotency key + the fencing epoch), so unlike the live-tail it
+ * is NOT encrypted — it rides the signed channel for authentication only. The
+ * tunnel is the low-latency medium; git-committed ledger state is the slower
+ * belt-and-suspenders (the residual is the documented Two-Generals floor).
+ *
+ * Single-machine safe: no peers → broadcast is a reachable no-op. fetch/clock
+ * injected for testability.
+ */
+import { signRequest } from '../server/machineAuth.js';
+export class ReplyMarkerTransport {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    log(m) {
+        this.d.logger?.(`[reply-marker] ${m}`);
+    }
+    /**
+     * POST the marker to every standby peer over the signed channel. Resolves true
+     * if at least one peer accepted (a live medium carried it); false if none was
+     * reachable. No peers → reachable no-op (true). Never throws — propagation is
+     * best-effort; the provider's at-least-once redelivery + the dedup gate are the
+     * backstop if a marker is lost.
+     */
+    async broadcast(marker) {
+        const peers = this.d.peers();
+        if (peers.length === 0)
+            return true;
+        const fetchImpl = this.d.fetchImpl ?? fetch;
+        let anyOk = false;
+        await Promise.all(peers.map(async (peer) => {
+            try {
+                const body = { marker };
+                const headers = signRequest(this.d.selfMachineId, this.d.signingKeyPem, body, this.d.nextSequence());
+                const res = await fetchImpl(`${peer.url.replace(/\/$/, '')}/api/message-marker`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', ...headers },
+                    body: JSON.stringify(body),
+                });
+                if (res && res.ok)
+                    anyOk = true;
+                else
+                    this.log(`peer ${peer.machineId} rejected marker ${marker.dedupeKey} (status ${res?.status})`);
+            }
+            catch (err) {
+                this.log(`broadcast to ${peer.machineId} failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }));
+        return anyOk;
+    }
+}
+//# sourceMappingURL=ReplyMarkerTransport.js.map

package/dist/core/ReplyMarkerTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplyMarkerTransport.js","sourceRoot":"","sources":["../../src/core/ReplyMarkerTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AA2BvD,MAAM,OAAO,oBAAoB;IACd,CAAC,CAA2B;IAE7C,YAAY,IAA8B;QACxC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBACrG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,EAAE;oBAC/E,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;oBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,GAAG,IAAK,GAAgB,CAAC,EAAE;oBAAE,KAAK,GAAG,IAAI,CAAC;;oBACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,oBAAoB,MAAM,CAAC,SAAS,YAAa,GAAgB,EAAE,MAAM,GAAG,CAAC,CAAC;YACpH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/handoffReceiverWiring.d.ts

@@ -0,0 +1,57 @@
+/**
+ * handoffReceiverWiring — the incoming-machine binding for the planned handoff
+ * (spec §8 G3d/G3e). Extracted from server.ts so the wiring is a tested unit
+ * (Testing Integrity Standard: DI components get wiring-integrity tests) rather
+ * than inline closures in the boot path.
+ *
+ * It composes a HandoffReceiver with ops bound to the live components:
+ *   - begin route → onBegin(manifest, from): stores the outgoing's flush manifest
+ *     and drives receiver.onBeginHandoff (build + send the caught-up ack).
+ *   - buildAck: echoes the manifest's tailSeq + ingressPosition and RECOMPUTES the
+ *     thread-history hash from THIS machine's own synced state — it matches the
+ *     outgoing's only if the live-tail kept us caught up. Never trusts the
+ *     manifest's own hash blindly.
+ *   - yield route → yieldHandler(): receiver.onYield → acquireLeaseOnConsent. The
+ *     lease CAS is attempted ONLY here, never on the ack (closes the two-holders
+ *     race, spec §8 G3e).
+ *
+ * The hash is computed with the SAME canonical formatting LiveTailSource uses for
+ * the tail content, so both machines hash identical bytes for the same history.
+ */
+import { HandoffReceiver } from './HandoffReceiver.js';
+import type { HandoffAck } from './HandoffSentinel.js';
+import type { IngressPosition } from './types.js';
+/** A thread entry as LiveTailSource formats it (timestamp + text). */
+export interface ThreadEntry {
+    timestamp: string;
+    text: string;
+}
+/**
+ * Canonical thread-history hash — identical on both machines for the same
+ * history. Exported so the OUTGOING flush (HandoffSentinel) hashes the same way.
+ */
+export declare function hashTopicHistory(getTopicHistory: (topic: number, limit: number) => ThreadEntry[], topic: number | undefined): string;
+export interface HandoffBeginManifest {
+    tailSeq: number;
+    ingressPosition: IngressPosition;
+    threadHistoryHash: string;
+    topic?: number;
+}
+export interface HandoffReceiverWiringDeps {
+    /** Push the caught-up ack to the outgoing machine (HandoffWireTransport.sendAck). */
+    sendAck: (ack: HandoffAck) => Promise<boolean>;
+    /** Acquire the lease on the verified yield (coordinator.acquireLeaseOnConsent). */
+    acquireLeaseOnConsent: (fromMachineId: string) => Promise<boolean>;
+    /** Thread history for the hash (telegram.getTopicHistory). */
+    getTopicHistory: (topic: number, limit: number) => ThreadEntry[];
+    logger?: (msg: string) => void;
+}
+export interface HandoffReceiverWiring {
+    receiver: HandoffReceiver;
+    /** Bind to the /api/handoff/begin route (AgentServer onHandoffBegin). */
+    onBegin: (manifest: unknown, fromMachineId: string) => void;
+    /** Register on the HandoffWireTransport so a yield drives the lease CAS. */
+    yieldHandler: () => void;
+}
+export declare function createHandoffReceiverWiring(deps: HandoffReceiverWiringDeps): HandoffReceiverWiring;
+//# sourceMappingURL=handoffReceiverWiring.d.ts.map

package/dist/core/handoffReceiverWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffReceiverWiring.d.ts","sourceRoot":"","sources":["../../src/core/handoffReceiverWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,WAAW,EAAE,EAChE,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,qFAAqF;IACrF,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,mFAAmF;IACnF,qBAAqB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,eAAe,CAAC;IAC1B,yEAAyE;IACzE,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D,4EAA4E;IAC5E,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,qBAAqB,CAiClG"}

package/dist/core/handoffReceiverWiring.js

@@ -0,0 +1,65 @@
+/**
+ * handoffReceiverWiring — the incoming-machine binding for the planned handoff
+ * (spec §8 G3d/G3e). Extracted from server.ts so the wiring is a tested unit
+ * (Testing Integrity Standard: DI components get wiring-integrity tests) rather
+ * than inline closures in the boot path.
+ *
+ * It composes a HandoffReceiver with ops bound to the live components:
+ *   - begin route → onBegin(manifest, from): stores the outgoing's flush manifest
+ *     and drives receiver.onBeginHandoff (build + send the caught-up ack).
+ *   - buildAck: echoes the manifest's tailSeq + ingressPosition and RECOMPUTES the
+ *     thread-history hash from THIS machine's own synced state — it matches the
+ *     outgoing's only if the live-tail kept us caught up. Never trusts the
+ *     manifest's own hash blindly.
+ *   - yield route → yieldHandler(): receiver.onYield → acquireLeaseOnConsent. The
+ *     lease CAS is attempted ONLY here, never on the ack (closes the two-holders
+ *     race, spec §8 G3e).
+ *
+ * The hash is computed with the SAME canonical formatting LiveTailSource uses for
+ * the tail content, so both machines hash identical bytes for the same history.
+ */
+import { createHash } from 'node:crypto';
+import { HandoffReceiver } from './HandoffReceiver.js';
+/**
+ * Canonical thread-history hash — identical on both machines for the same
+ * history. Exported so the OUTGOING flush (HandoffSentinel) hashes the same way.
+ */
+export function hashTopicHistory(getTopicHistory, topic) {
+    const h = createHash('sha256');
+    if (topic != null && Number.isFinite(Number(topic))) {
+        const entries = getTopicHistory(Number(topic), 500);
+        h.update(entries.map((e) => `[${e.timestamp}] ${e.text}`).join('\n') + (entries.length ? '\n' : ''));
+    }
+    return h.digest('hex');
+}
+export function createHandoffReceiverWiring(deps) {
+    let pendingManifest = null;
+    let pendingFrom = null;
+    const receiver = new HandoffReceiver({
+        buildAck: async () => {
+            const m = pendingManifest;
+            if (!m)
+                throw new Error('no pending handoff manifest');
+            return {
+                tailSeq: m.tailSeq,
+                ingressPosition: m.ingressPosition,
+                threadHistoryHash: hashTopicHistory(deps.getTopicHistory, m.topic),
+            };
+        },
+        sendAck: (ack) => deps.sendAck(ack),
+        acquireOnYield: () => deps.acquireLeaseOnConsent(pendingFrom ?? ''),
+    }, {
+        logger: deps.logger,
+        onTerminal: (s, detail) => deps.logger?.(`[handoff-recv] ${s}: ${detail}`),
+    });
+    return {
+        receiver,
+        onBegin: (manifest, from) => {
+            pendingManifest = manifest;
+            pendingFrom = from;
+            void receiver.onBeginHandoff();
+        },
+        yieldHandler: () => { void receiver.onYield(); },
+    };
+}
+//# sourceMappingURL=handoffReceiverWiring.js.map

package/dist/core/handoffReceiverWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffReceiverWiring.js","sourceRoot":"","sources":["../../src/core/handoffReceiverWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,eAAgE,EAChE,KAAyB;IAEzB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AA2BD,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,IAAI,eAAe,GAAgC,IAAI,CAAC;IACxD,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAClC;QACE,QAAQ,EAAE,KAAK,IAAyB,EAAE;YACxC,MAAM,CAAC,GAAG,eAAe,CAAC;YAC1B,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,IAAI,EAAE,CAAC;KACpE,EACD;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,KAAK,MAAM,EAAE,CAAC;KAC3E,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE;YAC1B,eAAe,GAAG,QAAgC,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjC,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/core/handoffSentinelBootWiring.d.ts

@@ -0,0 +1,53 @@
+/**
+ * handoffSentinelBootWiring — binds the outgoing planned-handoff sentinel to the
+ * LIVE server components (Telegram adapter, coordinator, live-tail source, wire
+ * transport). Extracted from server.ts boot so the glue — active-topic selection
+ * and dependency binding — is a tested unit rather than inline boot code. This
+ * mirrors handoffReceiverWiring (Testing Integrity Standard: DI components get
+ * wiring-integrity tests; spec §8 G3e / §10).
+ *
+ * server.ts calls this once inside the live-tail block (where liveTailSource is
+ * in scope) and exposes the returned `initiate` behind POST /handoff/initiate +
+ * `sentinel.inProgress` as the race guard.
+ */
+import { type HandoffSentinelWiring } from './handoffSentinelWiring.js';
+import type { HandoffAck } from './HandoffSentinel.js';
+import type { IngressPosition } from './types.js';
+import type { ThreadEntry } from './handoffReceiverWiring.js';
+/** The slice of the Telegram adapter the boot wiring needs. */
+export interface SentinelBootTelegram {
+    getIngressPosition: () => IngressPosition;
+    getTopicHistory: (topic: number, limit: number) => ThreadEntry[];
+    getKnownTopicIds: () => number[];
+}
+/** The slice of the coordinator the boot wiring needs. */
+export interface SentinelBootCoordinator {
+    demoteToStandby: (reason: string) => void;
+}
+/** The slice of the live-tail source the boot wiring drives before flushing. */
+export interface SentinelBootLiveTail {
+    pushTick: () => Promise<unknown>;
+}
+/** The slice of the wire transport the boot wiring uses (outgoing side). */
+export interface SentinelBootWire {
+    sendBegin: (manifest: unknown) => Promise<boolean>;
+    awaitAck: (timeoutMs: number) => Promise<HandoffAck | null>;
+    sendYield: () => Promise<boolean>;
+}
+export interface HandoffSentinelBootDeps {
+    telegram: SentinelBootTelegram;
+    coordinator: SentinelBootCoordinator;
+    liveTailSource: SentinelBootLiveTail;
+    wire: SentinelBootWire;
+    handoffAckTimeoutMs: number;
+    minHandoffIntervalMs: number;
+    logger?: (msg: string) => void;
+}
+/**
+ * Pick the topic to fence the handoff on: the most-recently-active one.
+ * getTopicHistory returns entries in chronological order capped at the last N,
+ * so the final entry is the newest. Falls back to the first known topic id.
+ */
+export declare function pickActiveTopic(getKnownTopicIds: () => number[], getTopicHistory: (topic: number, limit: number) => ThreadEntry[]): number | undefined;
+export declare function createHandoffSentinelBootWiring(deps: HandoffSentinelBootDeps): HandoffSentinelWiring;
+//# sourceMappingURL=handoffSentinelBootWiring.d.ts.map

package/dist/core/handoffSentinelBootWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffSentinelBootWiring.d.ts","sourceRoot":"","sources":["../../src/core/handoffSentinelBootWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,MAAM,EAAE,CAAC;CAClC;AACD,0DAA0D;AAC1D,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AACD,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAClC;AACD,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5D,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,uBAAuB,CAAC;IACrC,cAAc,EAAE,oBAAoB,CAAC;IACrC,IAAI,EAAE,gBAAgB,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,gBAAgB,EAAE,MAAM,MAAM,EAAE,EAChC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,WAAW,EAAE,GAC/D,MAAM,GAAG,SAAS,CAcpB;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,uBAAuB,GAAG,qBAAqB,CAkBpG"}

package/dist/core/handoffSentinelBootWiring.js

@@ -0,0 +1,52 @@
+/**
+ * handoffSentinelBootWiring — binds the outgoing planned-handoff sentinel to the
+ * LIVE server components (Telegram adapter, coordinator, live-tail source, wire
+ * transport). Extracted from server.ts boot so the glue — active-topic selection
+ * and dependency binding — is a tested unit rather than inline boot code. This
+ * mirrors handoffReceiverWiring (Testing Integrity Standard: DI components get
+ * wiring-integrity tests; spec §8 G3e / §10).
+ *
+ * server.ts calls this once inside the live-tail block (where liveTailSource is
+ * in scope) and exposes the returned `initiate` behind POST /handoff/initiate +
+ * `sentinel.inProgress` as the race guard.
+ */
+import { createHandoffSentinelWiring } from './handoffSentinelWiring.js';
+/**
+ * Pick the topic to fence the handoff on: the most-recently-active one.
+ * getTopicHistory returns entries in chronological order capped at the last N,
+ * so the final entry is the newest. Falls back to the first known topic id.
+ */
+export function pickActiveTopic(getKnownTopicIds, getTopicHistory) {
+    const ids = getKnownTopicIds();
+    let best;
+    let bestTs = -Infinity;
+    for (const id of ids) {
+        const hist = getTopicHistory(id, 50);
+        const last = hist[hist.length - 1];
+        const ts = last ? Date.parse(last.timestamp) : NaN;
+        if (Number.isFinite(ts) && ts > bestTs) {
+            bestTs = ts;
+            best = id;
+        }
+    }
+    return best ?? ids[0];
+}
+export function createHandoffSentinelBootWiring(deps) {
+    // Closures preserve `this` for the adapter methods.
+    const getKnownTopicIds = () => deps.telegram.getKnownTopicIds();
+    const getTopicHistory = (topic, limit) => deps.telegram.getTopicHistory(topic, limit);
+    return createHandoffSentinelWiring({
+        pushTick: async () => { await deps.liveTailSource.pushTick(); },
+        getIngressPosition: () => deps.telegram.getIngressPosition(),
+        getTopicHistory,
+        activeTopic: () => pickActiveTopic(getKnownTopicIds, getTopicHistory),
+        postBegin: (manifest) => deps.wire.sendBegin(manifest),
+        awaitAck: (timeoutMs) => deps.wire.awaitAck(timeoutMs),
+        sendYield: () => deps.wire.sendYield(),
+        demoteSelf: () => deps.coordinator.demoteToStandby('planned handoff: yielded to peer'),
+        handoffAckTimeoutMs: deps.handoffAckTimeoutMs,
+        minHandoffIntervalMs: deps.minHandoffIntervalMs,
+        logger: deps.logger,
+    });
+}
+//# sourceMappingURL=handoffSentinelBootWiring.js.map

package/dist/core/handoffSentinelBootWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffSentinelBootWiring.js","sourceRoot":"","sources":["../../src/core/handoffSentinelBootWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,2BAA2B,EAA8B,MAAM,4BAA4B,CAAC;AAoCrG;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,gBAAgC,EAChC,eAAgE;IAEhE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC;IACvB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YACvC,MAAM,GAAG,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAA6B;IAC3E,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAChE,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEtG,OAAO,2BAA2B,CAAC;QACjC,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QAC5D,eAAe;QACf,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,gBAAgB,EAAE,eAAe,CAAC;QACrE,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QACtD,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;QACtC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kCAAkC,CAAC;QACtF,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/core/handoffSentinelWiring.d.ts

@@ -0,0 +1,60 @@
+/**
+ * handoffSentinelWiring — the outgoing-machine binding for the planned handoff
+ * (spec §8 G3e). Counterpart to handoffReceiverWiring; extracted from server.ts
+ * so the lease-yield orchestration is a tested unit, not inline boot code.
+ *
+ * Composes a HandoffSentinel whose ops are bound to the live components:
+ *   - flush(): drive the live-tail so the standby is current, then POST the begin
+ *     manifest to the peer. The manifest's threadHistoryHash is computed with the
+ *     SAME canonical hash the incoming uses (handoffReceiverWiring.hashTopicHistory),
+ *     so the incoming's recomputed echo can verify.
+ *   - awaitAck(): the HandoffWireTransport's pending-ack promise.
+ *   - validate(): Tier-1 readiness. v1 is deterministic (the sentinel's own
+ *     ackMatches echo-verification is the substantive gate); a Haiku-class
+ *     validator is the spec's upgrade path (tracked).
+ *   - sendYield(): the explicit yield — the ONLY trigger for the incoming CAS.
+ *   - demoteSelf(): step down to standby after the yield.
+ *
+ * The CRITICAL invariant (spec §8 G3e) lives in HandoffSentinel.initiate: the
+ * outgoing NEVER yields unless the ack is verified AND validation passes; on any
+ * failure it aborts and stays awake. This wiring only supplies the ops.
+ */
+import { HandoffSentinel } from './HandoffSentinel.js';
+import type { FlushManifest, HandoffAck, HandoffOutcome } from './HandoffSentinel.js';
+import type { IngressPosition } from './types.js';
+import { type ThreadEntry } from './handoffReceiverWiring.js';
+export interface HandoffSentinelWiringDeps {
+    /** Push the live tail so the standby's buffer is current before we flush. */
+    pushTick: () => Promise<void>;
+    /** This machine's current ingress position (telegram.getIngressPosition). */
+    getIngressPosition: () => IngressPosition;
+    /** Thread history for the hash (telegram.getTopicHistory) — same fn the receiver uses. */
+    getTopicHistory: (topic: number, limit: number) => ThreadEntry[];
+    /** The conversation topic to fence on (most-recently-active). undefined → empty hash. */
+    activeTopic: () => number | undefined;
+    /** Best-effort live-tail sequence echoed in the manifest (hash is the real check). */
+    lastTailSeq?: () => number;
+    /** POST the begin manifest to the peer (HandoffWireTransport.sendBegin). */
+    postBegin: (manifest: FlushManifest & {
+        topic?: number;
+    }) => Promise<boolean>;
+    /** Await the incoming's ack (HandoffWireTransport.awaitAck). */
+    awaitAck: (timeoutMs: number) => Promise<HandoffAck | null>;
+    /** Send the explicit yield (HandoffWireTransport.sendYield). */
+    sendYield: () => Promise<boolean>;
+    /** Demote self to standby (coordinator.demoteToStandby). */
+    demoteSelf: () => void | Promise<void>;
+    /** Optional Tier-1 validator; default → deterministic pass (ackMatches is the gate). */
+    validate?: (ack: HandoffAck, manifest: FlushManifest) => Promise<boolean>;
+    handoffAckTimeoutMs: number;
+    minHandoffIntervalMs: number;
+    logger?: (msg: string) => void;
+    onTerminal?: (outcome: HandoffOutcome, detail: string) => void;
+}
+export interface HandoffSentinelWiring {
+    sentinel: HandoffSentinel;
+    /** Run a planned handoff to completion (operator/test trigger). */
+    initiate: () => Promise<HandoffOutcome>;
+}
+export declare function createHandoffSentinelWiring(deps: HandoffSentinelWiringDeps): HandoffSentinelWiring;
+//# sourceMappingURL=handoffSentinelWiring.d.ts.map

package/dist/core/handoffSentinelWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffSentinelWiring.d.ts","sourceRoot":"","sources":["../../src/core/handoffSentinelWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEhF,MAAM,WAAW,yBAAyB;IACxC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,0FAA0F;IAC1F,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;IACjE,yFAAyF;IACzF,WAAW,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,gEAAgE;IAChE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5D,gEAAgE;IAChE,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,4DAA4D;IAC5D,UAAU,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,eAAe,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;CACzC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,qBAAqB,CAoClG"}

package/dist/core/handoffSentinelWiring.js

@@ -0,0 +1,59 @@
+/**
+ * handoffSentinelWiring — the outgoing-machine binding for the planned handoff
+ * (spec §8 G3e). Counterpart to handoffReceiverWiring; extracted from server.ts
+ * so the lease-yield orchestration is a tested unit, not inline boot code.
+ *
+ * Composes a HandoffSentinel whose ops are bound to the live components:
+ *   - flush(): drive the live-tail so the standby is current, then POST the begin
+ *     manifest to the peer. The manifest's threadHistoryHash is computed with the
+ *     SAME canonical hash the incoming uses (handoffReceiverWiring.hashTopicHistory),
+ *     so the incoming's recomputed echo can verify.
+ *   - awaitAck(): the HandoffWireTransport's pending-ack promise.
+ *   - validate(): Tier-1 readiness. v1 is deterministic (the sentinel's own
+ *     ackMatches echo-verification is the substantive gate); a Haiku-class
+ *     validator is the spec's upgrade path (tracked).
+ *   - sendYield(): the explicit yield — the ONLY trigger for the incoming CAS.
+ *   - demoteSelf(): step down to standby after the yield.
+ *
+ * The CRITICAL invariant (spec §8 G3e) lives in HandoffSentinel.initiate: the
+ * outgoing NEVER yields unless the ack is verified AND validation passes; on any
+ * failure it aborts and stays awake. This wiring only supplies the ops.
+ */
+import { HandoffSentinel } from './HandoffSentinel.js';
+import { hashTopicHistory } from './handoffReceiverWiring.js';
+export function createHandoffSentinelWiring(deps) {
+    const sentinel = new HandoffSentinel({
+        flush: async () => {
+            await deps.pushTick();
+            const topic = deps.activeTopic();
+            const manifest = {
+                tailSeq: deps.lastTailSeq ? deps.lastTailSeq() : 0,
+                ingressPosition: deps.getIngressPosition(),
+                threadHistoryHash: hashTopicHistory(deps.getTopicHistory, topic),
+                topic,
+            };
+            const posted = await deps.postBegin(manifest);
+            if (!posted)
+                throw new Error('begin POST to peer failed (no reachable peer or rejected)');
+            return manifest;
+        },
+        awaitAck: (timeoutMs) => deps.awaitAck(timeoutMs),
+        validate: deps.validate ?? (async () => true),
+        sendYield: async () => {
+            const ok = await deps.sendYield();
+            if (!ok)
+                throw new Error('yield POST to peer failed');
+        },
+        demoteSelf: async () => { await deps.demoteSelf(); },
+    }, {
+        handoffAckTimeoutMs: deps.handoffAckTimeoutMs,
+        minHandoffIntervalMs: deps.minHandoffIntervalMs,
+        logger: deps.logger,
+        onTerminal: deps.onTerminal,
+    });
+    return {
+        sentinel,
+        initiate: () => sentinel.initiate(),
+    };
+}
+//# sourceMappingURL=handoffSentinelWiring.js.map

package/dist/core/handoffSentinelWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoffSentinelWiring.js","sourceRoot":"","sources":["../../src/core/handoffSentinelWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAoB,MAAM,4BAA4B,CAAC;AAmChF,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAClC;QACE,KAAK,EAAE,KAAK,IAA4B,EAAE;YACxC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAuC;gBACnD,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClD,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC1C,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;gBAChE,KAAK;aACN,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC1F,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAC7C,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACxD,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;KACrD,EACD;QACE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CACF,CAAC;IAEF,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/core/seamlessnessConfig.d.ts

@@ -34,6 +34,14 @@ export interface ResolvedSeamlessnessConfig {
     splitBrainEscalationCooldownMs: number;
     handoffBar: 'near-instant' | 'relaxed';
     maxProcessingMs: number;
+    /**
+     * Exactly-once ingress (spec §8 G3a). When true, the inbound forward path
+     * gates each message through the MessageProcessingLedger (dedup redeliveries)
+     * and the outbound reply path commits reply_committed. DEFAULT false — ships
+     * dark; flip ON only after a live test-as-self confirms no false-drops, since
+     * this is the most critical path (every user message).
+     */
+    exactlyOnceIngress: boolean;
     protocolVersion: number;
 }
 export declare class SeamlessnessConfigError extends Error {

package/dist/core/seamlessnessConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seamlessnessConfig.d.ts","sourceRoot":"","sources":["../../src/core/seamlessnessConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,QAAQ,GAAG,KAAK,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8BAA8B,EAAE,MAAM,CAAC;IACvC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CA+B7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,0BAA0B,GAAG,MAAM,EAAE,CAqCtF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CAUhG"}
+{"version":3,"file":"seamlessnessConfig.d.ts","sourceRoot":"","sources":["../../src/core/seamlessnessConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,QAAQ,GAAG,KAAK,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8BAA8B,EAAE,MAAM,CAAC;IACvC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CAgC7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,0BAA0B,GAAG,MAAM,EAAE,CAqCtF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CAUhG"}

package/dist/core/seamlessnessConfig.js

@@ -64,6 +64,7 @@ export function resolveSeamlessnessConfig(mm) {
         splitBrainEscalationCooldownMs: mm?.splitBrainEscalationCooldownMs ?? 5 * 60_000,
         handoffBar: mm?.handoffBar ?? 'near-instant',
         maxProcessingMs: mm?.maxProcessingMs ?? 5 * 60_000,
+        exactlyOnceIngress: mm?.exactlyOnceIngress ?? false,
         protocolVersion: mm?.protocolVersion ?? SEAMLESSNESS_PROTOCOL_VERSION,
     };
 }

package/dist/core/seamlessnessConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"seamlessnessConfig.js","sourceRoot":"","sources":["../../src/core/seamlessnessConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAsB/C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAuB;IAChE,MAAM,OAAO,GAAG,EAAE,EAAE,sBAAsB,IAAI,EAAE,CAAC;IACjD,OAAO,OAAO,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,EAAuB;IAC/D,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,EAAE,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,EAAE,EAAE,UAAU,IAAI,CAAC,GAAG,kBAAkB,CAAC;IAC5D,MAAM,sBAAsB,GAAG,EAAE,EAAE,sBAAsB,IAAI,KAAK,CAAC;IAEnE,OAAO;QACL,kBAAkB;QAClB,sBAAsB,EAAE,EAAE,EAAE,sBAAsB,IAAI,MAAM;QAC5D,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,wDAAwD;QACxD,qBAAqB,EACnB,EAAE,EAAE,qBAAqB;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC3E,mBAAmB;QACnB,UAAU;QACV,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,IAAI,QAAQ;QACpD,sBAAsB;QACtB,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,IAAI,sBAAsB;QACpE,2BAA2B,EAAE,EAAE,EAAE,2BAA2B,IAAI,UAAU;QAC1E,wBAAwB,EAAE,EAAE,EAAE,wBAAwB,IAAI,GAAG,GAAG,IAAI;QACpE,mBAAmB,EAAE,EAAE,EAAE,mBAAmB,IAAI,KAAK;QACrD,oBAAoB,EAAE,EAAE,EAAE,oBAAoB,IAAI,MAAM;QACxD,8BAA8B,EAAE,EAAE,EAAE,8BAA8B,IAAI,CAAC,GAAG,MAAM;QAChF,UAAU,EAAE,EAAE,EAAE,UAAU,IAAI,cAAc;QAC5C,eAAe,EAAE,EAAE,EAAE,eAAe,IAAI,CAAC,GAAG,MAAM;QAClD,eAAe,EAAE,EAAE,EAAE,eAAe,IAAI,6BAA6B;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,8BAA8B,CAAC,CAA6B;IAC1E,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAsD;QACnE,CAAC,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAC5C,CAAC,wBAAwB,EAAE,CAAC,CAAC,sBAAsB,CAAC;QACpD,CAAC,uBAAuB,EAAE,CAAC,CAAC,qBAAqB,CAAC;QAClD,CAAC,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC;QAC9C,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;QAC5B,CAAC,wBAAwB,EAAE,CAAC,CAAC,sBAAsB,CAAC;QACpD,CAAC,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAC5C,CAAC,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC;KAC/C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,qBAAqB,sCAAsC;YACpG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,uEAAuE,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,qBAAqB,2BAA2B;YACzF,IAAI,CAAC,CAAC,UAAU,2FAA2F,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CACT,oCAAoC,CAAC,CAAC,kBAAkB,uCAAuC;YAC/F,IAAI,CAAC,CAAC,sBAAsB,8CAA8C,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAAuB;IAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"seamlessnessConfig.js","sourceRoot":"","sources":["../../src/core/seamlessnessConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AA8B/C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAuB;IAChE,MAAM,OAAO,GAAG,EAAE,EAAE,sBAAsB,IAAI,EAAE,CAAC;IACjD,OAAO,OAAO,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,EAAuB;IAC/D,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,EAAE,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,EAAE,EAAE,UAAU,IAAI,CAAC,GAAG,kBAAkB,CAAC;IAC5D,MAAM,sBAAsB,GAAG,EAAE,EAAE,sBAAsB,IAAI,KAAK,CAAC;IAEnE,OAAO;QACL,kBAAkB;QAClB,sBAAsB,EAAE,EAAE,EAAE,sBAAsB,IAAI,MAAM;QAC5D,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,wDAAwD;QACxD,qBAAqB,EACnB,EAAE,EAAE,qBAAqB;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC3E,mBAAmB;QACnB,UAAU;QACV,iBAAiB,EAAE,EAAE,EAAE,iBAAiB,IAAI,QAAQ;QACpD,sBAAsB;QACtB,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,IAAI,sBAAsB;QACpE,2BAA2B,EAAE,EAAE,EAAE,2BAA2B,IAAI,UAAU;QAC1E,wBAAwB,EAAE,EAAE,EAAE,wBAAwB,IAAI,GAAG,GAAG,IAAI;QACpE,mBAAmB,EAAE,EAAE,EAAE,mBAAmB,IAAI,KAAK;QACrD,oBAAoB,EAAE,EAAE,EAAE,oBAAoB,IAAI,MAAM;QACxD,8BAA8B,EAAE,EAAE,EAAE,8BAA8B,IAAI,CAAC,GAAG,MAAM;QAChF,UAAU,EAAE,EAAE,EAAE,UAAU,IAAI,cAAc;QAC5C,eAAe,EAAE,EAAE,EAAE,eAAe,IAAI,CAAC,GAAG,MAAM;QAClD,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,IAAI,KAAK;QACnD,eAAe,EAAE,EAAE,EAAE,eAAe,IAAI,6BAA6B;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,8BAA8B,CAAC,CAA6B;IAC1E,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAsD;QACnE,CAAC,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAC5C,CAAC,wBAAwB,EAAE,CAAC,CAAC,sBAAsB,CAAC;QACpD,CAAC,uBAAuB,EAAE,CAAC,CAAC,qBAAqB,CAAC;QAClD,CAAC,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC;QAC9C,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;QAC5B,CAAC,wBAAwB,EAAE,CAAC,CAAC,sBAAsB,CAAC;QACpD,CAAC,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,CAAC;QAC5C,CAAC,qBAAqB,EAAE,CAAC,CAAC,mBAAmB,CAAC;KAC/C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,qBAAqB,sCAAsC;YACpG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,uEAAuE,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,qBAAqB,2BAA2B;YACzF,IAAI,CAAC,CAAC,UAAU,2FAA2F,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CACT,oCAAoC,CAAC,CAAC,kBAAkB,uCAAuC;YAC/F,IAAI,CAAC,CAAC,sBAAsB,8CAA8C,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAAuB;IAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/types.d.ts

@@ -1468,6 +1468,12 @@ export interface MultiMachineConfig {
     handoffBar?: 'near-instant' | 'relaxed';
     /** A message-ledger entry left 'processing' past this is re-runnable by the new holder. Default 5min. */
     maxProcessingMs?: number;
+    /**
+     * Exactly-once ingress gate (spec §8 G3a). DEFAULT false — when true, inbound
+     * Telegram forwards are deduped via the MessageProcessingLedger and replies
+     * commit reply_committed. Ships dark; flip ON only after live test-as-self.
+     */
+    exactlyOnceIngress?: boolean;
     /**
      * Mesh protocol version override. Normally left unset (the build constant
      * SEAMLESSNESS_PROTOCOL_VERSION applies); present so migrations/tests can pin it.