instar 1.3.548 → 1.3.550

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4lbtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAotbtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -3385,6 +3385,28 @@ export async function startServer(options) {
         // is `status`: a peer must SEE an action was already completed/in_progress elsewhere.
         const { EVOLUTION_ACTION_KIND_REGISTRATION } = await import('../core/EvolutionActionsReplicatedStore.js');
         replicatedKindRegistry.register(EVOLUTION_ACTION_KIND_REGISTRATION);
+        // WS2.6 (multi-machine-replicated-store-foundation) — register the SIXTH concrete replicated
+        // kind, `user-record`, onto the registry: the SECOND PII kind (after WS2.3 relationships).
+        // Dual-registry's dynamic half (the static half is CoherenceJournal.JOURNAL_KINDS, which now
+        // lists 'user-record'). Registration is INERT — emission/serve/pull stay gated behind
+        // `multiMachine.stateSync.userRegistry.enabled` (default false ⇒ strict no-op, NO user PII ever
+        // crosses a machine boundary). With it registered, selfStateSyncReceive self-reports
+        // `userRegistry:true` IFF the store is enabled, and the rollback-unmerge resolves its
+        // contributing kind via getByStore. The local userId is NEVER replicated — the recordKey is the
+        // channel-set identity surface (UserRegistryReplicatedStore.deriveUserRecordKey).
+        const { USER_KIND_REGISTRATION } = await import('../core/UserRegistryReplicatedStore.js');
+        replicatedKindRegistry.register(USER_KIND_REGISTRATION);
+        // WS2.6 (multi-machine-replicated-store-foundation) — register the SEVENTH concrete replicated
+        // kind, `topic-operator-record`, onto the registry: the THIRD PII kind, completing the WS2
+        // memory family. Dual-registry's dynamic half (the static half is CoherenceJournal.JOURNAL_KINDS,
+        // which now lists 'topic-operator-record'). Registration is INERT — emission/serve/pull stay
+        // gated behind `multiMachine.stateSync.topicOperator.enabled` (default false ⇒ strict no-op). The
+        // recordKey is sha256(topicId + ":" + verified-uid), NEVER a content-name
+        // (TopicOperatorReplicatedStore.deriveTopicOperatorRecordKey). THE LOAD-BEARING INVARIANT: a
+        // replicated topic-operator record is UNTRUSTED peer data — NEVER this machine's authoritative
+        // answer to "who is my verified operator?" (only the local authenticated setOperator binds it).
+        const { TOPIC_OPERATOR_KIND_REGISTRATION } = await import('../core/TopicOperatorReplicatedStore.js');
+        replicatedKindRegistry.register(TOPIC_OPERATOR_KIND_REGISTRATION);
         // Snapshot-then-tail engine (Component 4 / build-order step 3,
         // multi-machine-replicated-store-foundation §6). The cache (FIXED ceiling,
         // §8.2 — NOT pool-scaled), the per-peer rebuild breaker (§6.3), and the engine
@@ -7770,6 +7792,96 @@ export async function startServer(options) {
         });
         void evolutionActionsUnionReader; // consumed by the evolution-actions peer-read surface + the journal-apply rollout stage (WS2.5+)
         void evolution.setEvolutionActionReplicationEmitter; // the emit seam exists (unit-tested + dark by default); the journal-backed emitter is attached in a later rollout stage, mirroring the WS2.2 learnings sibling
+        // WS2.6 — the bypass-proof union reader for the `userRegistry` store (the SECOND PII kind). The
+        // single funnel every replicated user read routes through, so no caller reads a raw replica
+        // around the no-clobber rule. `loadOriginRecords` materializes the OWN user registry as the
+        // single origin today (via userToOriginRecord, keyed on the channel-set identity surface — the
+        // local userId is NEVER replicated); when the journal apply path lands peer `user-record`
+        // replicas (a later rollout stage), the seam extends to read those peer namespaces too. With
+        // only the own origin the union is a strict no-op. tierOf returns HIGH (append-both-and-flag
+        // never silently clobbers two divergent profiles; the READ layer is advisory — a replicated
+        // user is a HINT, never the authoritative inbound-resolution answer, which is LOCAL-ONLY). The
+        // emit seam is attached ONLY when stateSync.userRegistry.enabled is true (default false ⇒ NOT
+        // injected ⇒ strict no-op, byte-identical single-machine behavior).
+        const { UserManager: _UMForUnion } = await import('../users/UserManager.js');
+        const { userTierOf, userToOriginRecord, deriveUserRecordKey, USER_STORE_KEY } = await import('../core/UserRegistryReplicatedStore.js');
+        const userRegistryUnionReader = new ReplicatedStoreReader({
+            registry: replicatedKindRegistry,
+            stores: config.multiMachine?.stateSync,
+            tierOf: userTierOf,
+            loadOriginRecords: (store, recordKey) => {
+                if (store !== USER_STORE_KEY || _meshSelfId === null)
+                    return [];
+                const mgr = new _UMForUnion(config.stateDir, config.users);
+                for (const u of mgr.listUsers()) {
+                    if (deriveUserRecordKey(u.channels) === recordKey) {
+                        const o = userToOriginRecord(u, _meshSelfId);
+                        return o ? [o] : [];
+                    }
+                }
+                return [];
+            },
+            listRecordKeys: (store) => {
+                if (store !== USER_STORE_KEY)
+                    return [];
+                const mgr = new _UMForUnion(config.stateDir, config.users);
+                const keys = [];
+                for (const u of mgr.listUsers()) {
+                    const k = deriveUserRecordKey(u.channels);
+                    if (k !== null)
+                        keys.push(k);
+                }
+                return keys;
+            },
+            droppedOrigins: droppedOriginRegistry,
+            conflictStore,
+        });
+        void userRegistryUnionReader; // consumed by the user-registry peer-read surface + the journal-apply rollout stage (WS2.6+)
+        // WS2.6 — the bypass-proof union reader for the `topicOperator` store (the THIRD PII kind). The
+        // single funnel every replicated topic-operator read routes through. `loadOriginRecords`
+        // materializes the OWN topic-operator store as the single origin today (via
+        // topicOperatorToOriginRecord, keyed on sha256(topicId + ":" + verified-uid) — never a
+        // content-name); when the journal apply path lands peer `topic-operator-record` replicas (a
+        // later rollout stage), the seam extends to read those peer namespaces too. With only the own
+        // origin the union is a strict no-op. tierOf returns HIGH (append-both-and-flag). THE
+        // LOAD-BEARING INVARIANT: the READ layer is ADVISORY — a replicated topic-operator record is a
+        // HINT about what a peer machine bound, NEVER this machine's authoritative principal (only the
+        // local authenticated setOperator binds it; there is no apply path back into TopicOperatorStore).
+        const { TopicOperatorStore: _TOSForUnion } = await import('../users/TopicOperatorStore.js');
+        const { topicOperatorTierOf, topicOperatorToOriginRecord, deriveTopicOperatorRecordKey, TOPIC_OPERATOR_STORE_KEY } = await import('../core/TopicOperatorReplicatedStore.js');
+        const topicOperatorUnionReader = new ReplicatedStoreReader({
+            registry: replicatedKindRegistry,
+            stores: config.multiMachine?.stateSync,
+            tierOf: topicOperatorTierOf,
+            loadOriginRecords: (store, recordKey) => {
+                if (store !== TOPIC_OPERATOR_STORE_KEY || _meshSelfId === null)
+                    return [];
+                const tos = new _TOSForUnion(config.stateDir);
+                const all = tos.all();
+                for (const [topicId, op] of Object.entries(all)) {
+                    if (deriveTopicOperatorRecordKey(topicId, op.uid) === recordKey) {
+                        const o = topicOperatorToOriginRecord(topicId, op, _meshSelfId);
+                        return o ? [o] : [];
+                    }
+                }
+                return [];
+            },
+            listRecordKeys: (store) => {
+                if (store !== TOPIC_OPERATOR_STORE_KEY)
+                    return [];
+                const tos = new _TOSForUnion(config.stateDir);
+                const keys = [];
+                for (const [topicId, op] of Object.entries(tos.all())) {
+                    const k = deriveTopicOperatorRecordKey(topicId, op.uid);
+                    if (k !== null)
+                        keys.push(k);
+                }
+                return keys;
+            },
+            droppedOrigins: droppedOriginRegistry,
+            conflictStore,
+        });
+        void topicOperatorUnionReader; // consumed by the topic-operator peer-read surface + the journal-apply rollout stage (WS2.6+)
         // Start MemoryPressureMonitor (platform-aware memory tracking)
         const { MemoryPressureMonitor } = await import('../monitoring/MemoryPressureMonitor.js');
         const memoryMonitor = new MemoryPressureMonitor({ stateDir: config.stateDir });
@@ -8650,21 +8762,26 @@ export async function startServer(options) {
         // (dev-gate-resolved AND the §2.10 env-token gate), and the executor's own dryRun keeps it a
         // dry-run dogfood on a dev agent (full decision loop + audit, ZERO writes) until dryRun:false.
         const { CredentialRebalancer } = await import('../core/CredentialRebalancer.js');
-        const { mapSlots: credMapSlots, mapAccounts: credMapAccounts, resolveRebalancerConfig: credResolveBalancerConfig } = await import('../core/CredentialRebalancerSnapshot.js');
+        const { mapSlots: credMapSlots, mapAccounts: credMapAccounts, resolveRebalancerConfig: credResolveBalancerConfig, computeBusynessBySlot: credComputeBusyness } = await import('../core/CredentialRebalancerSnapshot.js');
         const CRED_DEFAULT_SLOT = '~/.claude';
         const credentialRebalancer = new CredentialRebalancer({
             // Same gate as the location gate: dev-gate-resolved AND not env-token-refused.
             isEnabled: () => resolveDevAgentGate(config.subscriptionPool?.credentialRepointing?.enabled, config) &&
                 !credentialEnvTokenGate.evaluate().refused,
             isDryRun: () => config.subscriptionPool?.credentialRepointing?.dryRun !== false,
-            listSlots: () => credMapSlots(credentialLocationLedger.getAssignments(), { defaultSlot: CRED_DEFAULT_SLOT }),
+            // Busyness = count of RUNNING claude-code sessions per slot (the drain "busiest slot"
+            // signal), resolved from the live session list through the ledger's account→slot map.
+            listSlots: () => credMapSlots(credentialLocationLedger.getAssignments(), {
+                defaultSlot: CRED_DEFAULT_SLOT,
+                busynessBySlot: credComputeBusyness(state.listSessions(), (accountId) => credentialLocationLedger.slotOf(accountId), CRED_DEFAULT_SLOT),
+            }),
             listAccounts: () => credMapAccounts(subscriptionPool.list(), Date.now()),
             resolveConfig: () => credResolveBalancerConfig({
                 ...(config.subscriptionPool?.credentialRepointing?.balancer ?? {}),
                 slotCount: credentialLocationLedger.getAssignments().length,
-                // Dry-run dogfood defaults: keep the account currently in ~/.claude as the desired
-                // default (objective-0 keeps it alive). An explicit operator default-account config +
-                // tmux-activity busyness for the drain target are refinements <!-- tracked: 20905 -->.
+                // Dry-run dogfood default: keep the account currently in ~/.claude as the desired
+                // default (objective-0 keeps it alive). An explicit operator default-account config
+                // is a refinement <!-- tracked: 20905 -->.
                 desiredDefaultAccountId: credentialLocationLedger.tenantOf(CRED_DEFAULT_SLOT) ?? null,
             }),
             swap: async (a, b) => {