instar 1.3.502 → 1.3.504

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyzCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8dN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkiYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4zCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAynYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -384,6 +384,9 @@ let _inboundQueueStop = null;
  *  (forward/spawn on another machine → must NOT also dispatch locally) from a
  *  self placement. Set once in startServer()'s mesh block. */
 let _meshSelfId = null;
+/** WS1.1: read-only ownership lookup for the drain's spawn-boundary re-check
+ *  (the registry is constructed later in startServer's pool block). */
+let _ownershipReadForDrain = null;
 /** Resolve the current router (Telegram-owning lease holder)'s base URL, or null if
  *  this machine IS the router / none is known. Used by the owner-side resume to fetch
  *  a moved topic's prior history from the router (bug #2). Set in the mesh block where
@@ -2014,6 +2017,22 @@ getAttentionTopicId) {
                 return { kind: 'local-delivered', injectError: err instanceof Error ? err.message : String(err) };
             }
         }
+        // WS1.1 (MULTI-MACHINE-SEAMLESSNESS-SPEC): ownership re-check at the SPAWN
+        // boundary. route() consulted ownership above, but ownership can move in
+        // the window between that verdict and this spawn (entry queued under owner
+        // A, transferred to B mid-queue, drained on A) — a non-owner spawn is the
+        // double-session bug (audit F20). Bounce to un-routable: the entry
+        // re-queues and the next drain pass re-routes against FRESH ownership
+        // (forward to the real owner / queue). Direct-inject into an EXISTING
+        // local session above is not gated — a live local session for the topic is
+        // itself the strongest local-serving signal, and the reconciler/closeout
+        // own its lifecycle.
+        if (_ownershipReadForDrain && _meshSelfId) {
+            const ownRec = _ownershipReadForDrain(dmsg.sessionKey);
+            if (ownRec && ownRec.status === 'active' && ownRec.ownerMachineId !== _meshSelfId) {
+                return { kind: 'un-routable', reason: 'ownership-moved-before-spawn' };
+            }
+        }
         // Respawn / auto-spawn path. The spawn-in-progress guard maps to
         // un-routable (§3.1) — never a silent skip.
         if (spawningTopics.has(topicId)) {
@@ -11381,6 +11400,19 @@ export async function startServer(options) {
                     return null; /* @silent-fallback-ok — pool not wired yet → rule inert */
                 }
             },
+            // WS1.3: pin-conflict do-not-act — a pin naming THIS machine while the
+            // owner is elsewhere means the reconciler is bringing the topic back;
+            // the closeout holds instead of attacking the session the pin wants here.
+            topicPinnedHere: (topicId) => {
+                try {
+                    const self = _meshSelfId;
+                    const pin = _topicPinStore?.get(String(topicId));
+                    return !!self && !!pin && pin.pinned && pin.preferredMachine === self;
+                }
+                catch {
+                    return false; /* @silent-fallback-ok — no pin signal → hold not applied, closeout behaves as before */
+                }
+            },
             audit: reaperAuditSink(config.stateDir),
         }, 
         // developmentAgent gate (standard_development_agent_dark_feature_gate):
@@ -11879,6 +11911,10 @@ export async function startServer(options) {
                                 loadAvg: osMod.loadavg()[0],
                                 quotaState: selfQuotaState(),
                                 guardPosture: selfGuardPosture(),
+                                // WS1.1 capability advertisement (spec invariant 5): a bounded
+                                // fixed-size summary, never an inventory. Reported live each
+                                // heartbeat so a queue going dark withdraws the capability.
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -11971,6 +12007,10 @@ export async function startServer(options) {
                     logger: (m) => console.log(pc.dim(`  ${m}`)),
                 });
                 const ownReg = sessionOwnershipRegistry;
+                // WS1.1: expose a read-only ownership lookup to the drain's
+                // spawn-boundary re-check (module-scope; the drain closure is defined
+                // before this block runs).
+                _ownershipReadForDrain = (sk) => ownReg.read(sk);
                 // ── WS3 one-voice: bind the election's late pool deps ──
                 // From here on the SpeakerElection sees the real pool: online machine
                 // ids from the capacity registry and live topic ownership from the
@@ -11998,6 +12038,72 @@ export async function startServer(options) {
                         }
                     },
                 };
+                // ── WS1.3 ownership reconciler (MULTI-MACHINE-SEAMLESSNESS-SPEC) ──
+                // Bounded pin/owner convergence on a tick, replacing "wait for an
+                // inbound message that delivery may never route" (the 2026-06-12 stuck
+                // transfer-back). Dark + dry-run defaults; strict single-machine no-op
+                // inside the module. Phase C: quorum logic is N-machine from day one.
+                if (_topicPinStore && _meshSelfId) {
+                    const ws13Cfg = () => (config.multiMachine?.seamlessness ?? {});
+                    const { OwnershipReconciler } = await import('../core/OwnershipReconciler.js');
+                    const reconciler = new OwnershipReconciler({
+                        enabled: () => ws13Cfg().ws13Reconcile === true,
+                        dryRun: () => ws13Cfg().ws13DryRun !== false,
+                        selfMachineId: _meshSelfId,
+                        pinStore: _topicPinStore,
+                        ownership: ownReg,
+                        machines: () => {
+                            try {
+                                return (machinePoolRegistry?.getCapacities() ?? []).map((c) => ({
+                                    machineId: c.machineId,
+                                    online: !!c.online,
+                                    lastSeenMs: c.selfReportedLastSeen ? Date.parse(c.selfReportedLastSeen) || 0 : 0,
+                                }));
+                            }
+                            catch {
+                                return []; /* @silent-fallback-ok — no pool view → module's single-machine strict no-op */
+                            }
+                        },
+                        isTopicBusy: (sessionKey) => {
+                            try {
+                                // Conservative safe-point signal: an inbound for this topic is
+                                // mid-processing. The bounded deadline in the module keeps a
+                                // false-busy from deferring forever.
+                                return currentInboundByTopic?.has(sessionKey) ?? false;
+                            }
+                            catch {
+                                return false; /* @silent-fallback-ok — unknown busy state defers to the module's bounded deadline */
+                            }
+                        },
+                        emitPlacement: (sessionKey, r, reason) => {
+                            try {
+                                const topicNum = Number(sessionKey);
+                                if (Number.isFinite(topicNum)) {
+                                    state.getCoherenceJournal()?.emitPlacement(topicNum, {
+                                        owner: r.record.ownerMachineId ?? '',
+                                        epoch: r.record.ownershipEpoch,
+                                        reason: 'reconcile',
+                                    });
+                                }
+                            }
+                            catch { /* §3.3 pairing is observability — never endangers the CAS */ }
+                        },
+                        logger: (m) => console.log(pc.dim(`  ${m}`)),
+                    });
+                    const tickMs = Math.max(5000, ws13Cfg().ws13TickMs ?? 30000);
+                    const ws13Timer = setInterval(() => {
+                        try {
+                            const rep = reconciler.tick();
+                            if (!rep.skipped && (rep.transfers || rep.claims || rep.forceClaims || rep.adoptions)) {
+                                console.log(pc.dim(`  [OwnershipReconciler] tick: t=${rep.transfers} c=${rep.claims} f=${rep.forceClaims} a=${rep.adoptions}${rep.dryRun ? ' (dry-run)' : ''}`));
+                            }
+                        }
+                        catch (err) {
+                            console.error('[OwnershipReconciler] tick failed:', err instanceof Error ? err.message : String(err));
+                        }
+                    }, tickMs);
+                    ws13Timer.unref?.();
+                }
                 // Coherence journal §3.3: the emit is a thin wrapper at every CAS call
                 // site — `reason` is caller knowledge (cas() is a storage primitive and
                 // cannot know WHY). A mesh-applied action records the coarse reason;
@@ -13068,6 +13174,17 @@ export async function startServer(options) {
                         // sending its sessions down the existing failover re-place path
                         // without each message re-paying the retry tax.
                         isMachineAlive: (m) => m === meshSelfId || ((machinePoolRegistry?.getCapacity(m)?.online ?? false) && !ownerSuspectBreaker.isSuspect(m)),
+                        // WS1.1 skew gate: read the owner's advertised receive capability
+                        // from its last heartbeat. A peer with NO flags field is an older
+                        // version → false (the conservative side: queue, don't forward into
+                        // a 501→failover steal). A peer the registry doesn't know → null
+                        // (unknown; the alive-check upstream already filters those).
+                        ownerSupportsForward: (m) => {
+                            const cap = machinePoolRegistry?.getCapacity(m);
+                            if (!cap)
+                                return null;
+                            return cap.seamlessnessFlags?.ws11DeliverReceive === true;
+                        },
                         markOwnerSuspect: (m) => ownerSuspectBreaker.markSuspect(m),
                         onOwnerResponsive: (m) => ownerSuspectBreaker.recordSuccess(m),
                         casClaimOwnership: (sk, machineId) => {