instar 1.3.503 → 1.3.505

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyzCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8dN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAumYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4zCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgqYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -384,6 +384,9 @@ let _inboundQueueStop = null;
  *  (forward/spawn on another machine → must NOT also dispatch locally) from a
  *  self placement. Set once in startServer()'s mesh block. */
 let _meshSelfId = null;
+/** WS1.1: read-only ownership lookup for the drain's spawn-boundary re-check
+ *  (the registry is constructed later in startServer's pool block). */
+let _ownershipReadForDrain = null;
 /** Resolve the current router (Telegram-owning lease holder)'s base URL, or null if
  *  this machine IS the router / none is known. Used by the owner-side resume to fetch
  *  a moved topic's prior history from the router (bug #2). Set in the mesh block where
@@ -2014,6 +2017,22 @@ getAttentionTopicId) {
                 return { kind: 'local-delivered', injectError: err instanceof Error ? err.message : String(err) };
             }
         }
+        // WS1.1 (MULTI-MACHINE-SEAMLESSNESS-SPEC): ownership re-check at the SPAWN
+        // boundary. route() consulted ownership above, but ownership can move in
+        // the window between that verdict and this spawn (entry queued under owner
+        // A, transferred to B mid-queue, drained on A) — a non-owner spawn is the
+        // double-session bug (audit F20). Bounce to un-routable: the entry
+        // re-queues and the next drain pass re-routes against FRESH ownership
+        // (forward to the real owner / queue). Direct-inject into an EXISTING
+        // local session above is not gated — a live local session for the topic is
+        // itself the strongest local-serving signal, and the reconciler/closeout
+        // own its lifecycle.
+        if (_ownershipReadForDrain && _meshSelfId) {
+            const ownRec = _ownershipReadForDrain(dmsg.sessionKey);
+            if (ownRec && ownRec.status === 'active' && ownRec.ownerMachineId !== _meshSelfId) {
+                return { kind: 'un-routable', reason: 'ownership-moved-before-spawn' };
+            }
+        }
         // Respawn / auto-spawn path. The spawn-in-progress guard maps to
         // un-routable (§3.1) — never a silent skip.
         if (spawningTopics.has(topicId)) {
@@ -11394,6 +11413,27 @@ export async function startServer(options) {
                     return false; /* @silent-fallback-ok — no pin signal → hold not applied, closeout behaves as before */
                 }
             },
+            // WS1.2 P19 breaker escalation: ONE deduped attention item when the
+            // post-transfer closeout gives up on a permanently-vetoing session.
+            // The attention store dedupes on id, so a re-opening breaker within
+            // the same episode never floods (P17). Best-effort — the audit row in
+            // sentinel-events.jsonl is the durable record either way.
+            raiseAttention: (item) => {
+                try {
+                    if (!telegram)
+                        return;
+                    void telegram.createAttentionItem({
+                        id: item.id,
+                        title: item.title,
+                        summary: item.summary,
+                        description: item.description,
+                        category: 'sessions',
+                        priority: 'NORMAL',
+                        sourceContext: 'session-reaper:closeout-breaker',
+                    }).catch(() => { });
+                }
+                catch { /* @silent-fallback-ok — telegram not wired yet (TDZ window) → audit-only */ }
+            },
             audit: reaperAuditSink(config.stateDir),
         }, 
         // developmentAgent gate (standard_development_agent_dark_feature_gate):
@@ -11892,6 +11932,10 @@ export async function startServer(options) {
                                 loadAvg: osMod.loadavg()[0],
                                 quotaState: selfQuotaState(),
                                 guardPosture: selfGuardPosture(),
+                                // WS1.1 capability advertisement (spec invariant 5): a bounded
+                                // fixed-size summary, never an inventory. Reported live each
+                                // heartbeat so a queue going dark withdraws the capability.
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -11984,6 +12028,10 @@ export async function startServer(options) {
                     logger: (m) => console.log(pc.dim(`  ${m}`)),
                 });
                 const ownReg = sessionOwnershipRegistry;
+                // WS1.1: expose a read-only ownership lookup to the drain's
+                // spawn-boundary re-check (module-scope; the drain closure is defined
+                // before this block runs).
+                _ownershipReadForDrain = (sk) => ownReg.read(sk);
                 // ── WS3 one-voice: bind the election's late pool deps ──
                 // From here on the SpeakerElection sees the real pool: online machine
                 // ids from the capacity registry and live topic ownership from the
@@ -13147,6 +13195,17 @@ export async function startServer(options) {
                         // sending its sessions down the existing failover re-place path
                         // without each message re-paying the retry tax.
                         isMachineAlive: (m) => m === meshSelfId || ((machinePoolRegistry?.getCapacity(m)?.online ?? false) && !ownerSuspectBreaker.isSuspect(m)),
+                        // WS1.1 skew gate: read the owner's advertised receive capability
+                        // from its last heartbeat. A peer with NO flags field is an older
+                        // version → false (the conservative side: queue, don't forward into
+                        // a 501→failover steal). A peer the registry doesn't know → null
+                        // (unknown; the alive-check upstream already filters those).
+                        ownerSupportsForward: (m) => {
+                            const cap = machinePoolRegistry?.getCapacity(m);
+                            if (!cap)
+                                return null;
+                            return cap.seamlessnessFlags?.ws11DeliverReceive === true;
+                        },
                         markOwnerSuspect: (m) => ownerSuspectBreaker.markSuspect(m),
                         onOwnerResponsive: (m) => ownerSuspectBreaker.recordSuccess(m),
                         casClaimOwnership: (sk, machineId) => {
@@ -13567,6 +13626,7 @@ export async function startServer(options) {
                     // Inert unless the rollout stage is past 'dark' (gated at the call site).
                     const nickMod = await import('../core/NicknameCommand.js');
                     const transferMod = await import('../core/TransferByNickname.js');
+                    const autonomousSessionsModule = await import('../core/AutonomousSessions.js');
                     const pinMod = await import('../core/TopicPlacementPinStore.js');
                     const relocSetMod = await import('../core/RelocationNicknameSet.js');
                     const nickAssignMod = await import('../core/NicknameAssigner.js');
@@ -13627,6 +13687,30 @@ export async function startServer(options) {
                             currentPinOf: (sk) => _topicPinStore?.get(sk)?.preferredMachine ?? null,
                             lastPlacementUpdateAt: (sk) => _topicPinStore?.lastUpdatedAtMs(sk) ?? null,
                             now: () => Date.now(),
+                            // WS1.4 consent gate: a LIVE local autonomous run on this topic
+                            // requires explicit confirmation before a move. The confirmed
+                            // move goes through POST /pool/transfer with confirm:true
+                            // (which performs the turn-boundary suspend); this NL arm only
+                            // ever needs to ASK. Local-registry evidence only — a run on a
+                            // remote owner is covered when the WS1.2 drain verb lands.
+                            autonomousRunActive: (sk) => {
+                                try {
+                                    const autoMod = autonomousSessionsModule;
+                                    const job = autoMod?.listAutonomousJobs(config.stateDir).find((j) => j.topic === sk && j.active && !j.paused);
+                                    if (!job)
+                                        return null;
+                                    let remainingMinutes = null;
+                                    if (job.startedAt && job.durationSeconds != null) {
+                                        const endMs = Date.parse(job.startedAt) + job.durationSeconds * 1000;
+                                        if (Number.isFinite(endMs))
+                                            remainingMinutes = Math.max(0, Math.round((endMs - Date.now()) / 60_000));
+                                    }
+                                    return { goal: job.goal, remainingMinutes };
+                                }
+                                catch {
+                                    return null; /* @silent-fallback-ok — unreadable run registry → veto not applied; the NL move behaves as before WS1.4 */
+                                }
+                            },
                         }, sessionKey);
                         if (plan.action === 'transfer' || plan.action === 'noop') {
                             const target = plan.targetMachine;