instar 1.3.503 → 1.3.504

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyzCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8dN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAumYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4zCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAynYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -384,6 +384,9 @@ let _inboundQueueStop = null;
  *  (forward/spawn on another machine → must NOT also dispatch locally) from a
  *  self placement. Set once in startServer()'s mesh block. */
 let _meshSelfId = null;
+/** WS1.1: read-only ownership lookup for the drain's spawn-boundary re-check
+ *  (the registry is constructed later in startServer's pool block). */
+let _ownershipReadForDrain = null;
 /** Resolve the current router (Telegram-owning lease holder)'s base URL, or null if
  *  this machine IS the router / none is known. Used by the owner-side resume to fetch
  *  a moved topic's prior history from the router (bug #2). Set in the mesh block where
@@ -2014,6 +2017,22 @@ getAttentionTopicId) {
                 return { kind: 'local-delivered', injectError: err instanceof Error ? err.message : String(err) };
             }
         }
+        // WS1.1 (MULTI-MACHINE-SEAMLESSNESS-SPEC): ownership re-check at the SPAWN
+        // boundary. route() consulted ownership above, but ownership can move in
+        // the window between that verdict and this spawn (entry queued under owner
+        // A, transferred to B mid-queue, drained on A) — a non-owner spawn is the
+        // double-session bug (audit F20). Bounce to un-routable: the entry
+        // re-queues and the next drain pass re-routes against FRESH ownership
+        // (forward to the real owner / queue). Direct-inject into an EXISTING
+        // local session above is not gated — a live local session for the topic is
+        // itself the strongest local-serving signal, and the reconciler/closeout
+        // own its lifecycle.
+        if (_ownershipReadForDrain && _meshSelfId) {
+            const ownRec = _ownershipReadForDrain(dmsg.sessionKey);
+            if (ownRec && ownRec.status === 'active' && ownRec.ownerMachineId !== _meshSelfId) {
+                return { kind: 'un-routable', reason: 'ownership-moved-before-spawn' };
+            }
+        }
         // Respawn / auto-spawn path. The spawn-in-progress guard maps to
         // un-routable (§3.1) — never a silent skip.
         if (spawningTopics.has(topicId)) {
@@ -11892,6 +11911,10 @@ export async function startServer(options) {
                                 loadAvg: osMod.loadavg()[0],
                                 quotaState: selfQuotaState(),
                                 guardPosture: selfGuardPosture(),
+                                // WS1.1 capability advertisement (spec invariant 5): a bounded
+                                // fixed-size summary, never an inventory. Reported live each
+                                // heartbeat so a queue going dark withdraws the capability.
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -11984,6 +12007,10 @@ export async function startServer(options) {
                     logger: (m) => console.log(pc.dim(`  ${m}`)),
                 });
                 const ownReg = sessionOwnershipRegistry;
+                // WS1.1: expose a read-only ownership lookup to the drain's
+                // spawn-boundary re-check (module-scope; the drain closure is defined
+                // before this block runs).
+                _ownershipReadForDrain = (sk) => ownReg.read(sk);
                 // ── WS3 one-voice: bind the election's late pool deps ──
                 // From here on the SpeakerElection sees the real pool: online machine
                 // ids from the capacity registry and live topic ownership from the
@@ -13147,6 +13174,17 @@ export async function startServer(options) {
                         // sending its sessions down the existing failover re-place path
                         // without each message re-paying the retry tax.
                         isMachineAlive: (m) => m === meshSelfId || ((machinePoolRegistry?.getCapacity(m)?.online ?? false) && !ownerSuspectBreaker.isSuspect(m)),
+                        // WS1.1 skew gate: read the owner's advertised receive capability
+                        // from its last heartbeat. A peer with NO flags field is an older
+                        // version → false (the conservative side: queue, don't forward into
+                        // a 501→failover steal). A peer the registry doesn't know → null
+                        // (unknown; the alive-check upstream already filters those).
+                        ownerSupportsForward: (m) => {
+                            const cap = machinePoolRegistry?.getCapacity(m);
+                            if (!cap)
+                                return null;
+                            return cap.seamlessnessFlags?.ws11DeliverReceive === true;
+                        },
                         markOwnerSuspect: (m) => ownerSuspectBreaker.markSuspect(m),
                         onOwnerResponsive: (m) => ownerSuspectBreaker.recordSuccess(m),
                         casClaimOwnership: (sk, machineId) => {