instar 1.3.569 → 1.3.571

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAg4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAihctE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAg4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4mctE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -3423,6 +3423,69 @@ export async function startServer(options) {
         // answer to "who is my verified operator?" (only the local authenticated setOperator binds it).
         const { TOPIC_OPERATOR_KIND_REGISTRATION } = await import('../core/TopicOperatorReplicatedStore.js');
         replicatedKindRegistry.register(TOPIC_OPERATOR_KIND_REGISTRATION);
+        // ── WS2 SEND-SIDE wiring (docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md). The
+        //    substrate above ships the registry + receive/serve machinery + advert; THIS
+        //    wires the SEND half that was deferred ("the journal-backed emitter is attached
+        //    in a later rollout stage"). Three pieces, all KIND-AGNOSTIC: (1) inject the
+        //    now-populated registry into the journal writer + the applier so a registered
+        //    `*-record` kind validates/accepts on BOTH ends (without it a peer's record
+        //    suspect-flags the stream — the receive-only gap); (2) the peer-stream reader
+        //    that materializes own + peer journal streams into the union's per-origin
+        //    records (makes a received record READABLE) + the snapshot loadOwnEntries
+        //    source + the emitter's `observed`-witness source; (3) the author-side HLC
+        //    clock. All require the coherence journal (the emit sink + the streams to read);
+        //    when it is dark these stay undefined and every consumer degrades to its
+        //    existing single-machine no-op. The generic record emitter is constructed below
+        //    (it also needs the resolved stateSync flags).
+        let replicatedPeerStreamReader;
+        let replicatedRecordEmitter;
+        let replicatedHlcClock;
+        if (coherenceJournal && cjOwnMachineId) {
+            try {
+                coherenceJournal.setReplicatedKindRegistry(replicatedKindRegistry);
+                journalSyncApplier?.setReplicatedKindRegistry(replicatedKindRegistry);
+                const { ReplicatedPeerStreamReader } = await import('../core/ReplicatedPeerStreamReader.js');
+                replicatedPeerStreamReader = new ReplicatedPeerStreamReader({
+                    stateDir: config.stateDir,
+                    registry: replicatedKindRegistry,
+                    selfMachineId: cjOwnMachineId,
+                });
+                // Author-side HLC clock — persisted under the journal dir (atomic temp+rename)
+                // so the merge total order survives restarts (§3.5). node = this machine's id.
+                const { HybridLogicalClock } = await import('../core/HybridLogicalClock.js');
+                const hlcSafeId = cjOwnMachineId.replace(/[^A-Za-z0-9_.-]/g, '_');
+                const hlcPath = path.join(config.stateDir, 'state', 'coherence-journal', `hlc-${hlcSafeId}.json`);
+                replicatedHlcClock = new HybridLogicalClock({
+                    node: cjOwnMachineId,
+                    now: () => Date.now(),
+                    persist: {
+                        load: () => {
+                            try {
+                                const o = JSON.parse(fs.readFileSync(hlcPath, 'utf-8'));
+                                return o && typeof o.physical === 'number' ? o : null;
+                            }
+                            catch { /* @silent-fallback-ok: absent/corrupt hlc file = fresh clock (first boot) — the clock starts at 0, never throws. */
+                                return null;
+                            }
+                        },
+                        save: (t) => {
+                            try {
+                                fs.mkdirSync(path.dirname(hlcPath), { recursive: true });
+                                const tmp = `${hlcPath}.tmp-${process.pid}`;
+                                fs.writeFileSync(tmp, JSON.stringify(t));
+                                fs.renameSync(tmp, hlcPath);
+                            }
+                            catch { /* @silent-fallback-ok: a failed hlc persist degrades to in-memory-only (the clock still advances this run); replication merge order is best-effort durable, never a boot blocker. */ }
+                        },
+                    },
+                });
+            }
+            catch (e) { /* @silent-fallback-ok: the SEND-side wiring must never endanger boot — a failure leaves replication dark (undefined seams), exactly the pre-WS2-send behavior. */
+                replicatedPeerStreamReader = undefined;
+                replicatedHlcClock = undefined;
+                console.log(pc.dim(`  [ws2-send] emitter wiring skipped: ${e instanceof Error ? e.message : String(e)}`));
+            }
+        }
         // Snapshot-then-tail engine (Component 4 / build-order step 3,
         // multi-machine-replicated-store-foundation §6). The cache (FIXED ceiling,
         // §8.2 — NOT pool-scaled), the per-peer rebuild breaker (§6.3), and the engine
@@ -3443,10 +3506,12 @@ export async function startServer(options) {
             cache: snapshotCache,
             breaker: snapshotRebuildBreaker,
             seams: {
-                // Step-3 substrate: no concrete store kind is registered yet, so there are
-                // no contributing own-streams to load. A consumer PR (WS2.1) replaces this
-                // with a loader that reads the CoherenceJournal own streams for its kind(s).
-                loadOwnEntries: () => ({}),
+                // WS2 send-side: read the OWN journal streams for the store's registered
+                // kind(s) so a snapshot serve returns real entries (replaces the no-op stub).
+                // Single-origin is enforced inside the reader (it serves only this machine's
+                // own stream). When the journal is dark the reader is undefined ⇒ `{}` (the
+                // correct no-store no-op; serveSnapshot then answers 'no-entries').
+                loadOwnEntries: (store, origin) => replicatedPeerStreamReader ? replicatedPeerStreamReader.loadOwnEntries(store, origin) : {},
                 now: () => Date.now(),
             },
             maxSnapshotBytes: stateSync.maxCacheBytes,
@@ -3461,6 +3526,26 @@ export async function startServer(options) {
         // `enabled === true` semantics but now see a live flag on a dev agent. An explicit
         // operator `enabled` in config still wins (force-dark false / fleet-flip true).
         const _stateSyncStoresResolved = resolveStateSyncStores(config);
+        // WS2 send-side: the generic journal-backed record emitter (the concrete emitter
+        // the per-store managers' emit hooks call). Needs the journal sink, the HLC clock,
+        // the registry (store → kind), this machine's origin id, the resolved stateSync
+        // flags (the dark gate — read via a getter so a live flip is honored), and the
+        // peer-stream reader as the `observed`-witness source. Constructed only when the
+        // journal + clock + reader exist (all gated on the coherence journal being live);
+        // otherwise it stays undefined and every per-store emit adapter is simply never
+        // attached (the managers' hooks stay no-ops, the pre-WS2-send behavior).
+        if (coherenceJournal && replicatedHlcClock && replicatedPeerStreamReader) {
+            const { ReplicatedRecordEmitter } = await import('../core/ReplicatedRecordEmitter.js');
+            replicatedRecordEmitter = new ReplicatedRecordEmitter({
+                journal: coherenceJournal,
+                clock: replicatedHlcClock,
+                registry: replicatedKindRegistry,
+                origin: cjOwnMachineId,
+                stores: () => _stateSyncStoresResolved,
+                loadWitness: (store, recordKey) => replicatedPeerStreamReader.loadWitness(store, recordKey),
+                log: (event, detail) => console.log(pc.dim(`  [ws2-send] ${event} ${JSON.stringify(detail)}`)),
+            });
+        }
         const selfStateSyncReceive = () => {
             const out = {};
             const stores = _stateSyncStoresResolved;
@@ -7843,37 +7928,40 @@ export async function startServer(options) {
         // and-flag never silently clobbers two divergent lessons; the READ layer is advisory,
         // injecting both variants as hints rather than blocking — fork #2). Consulted by a
         // learnings peer-read surface ONLY when stateSync.learnings.enabled is true.
-        const { learningTierOf, learningToOriginRecord, deriveLearningRecordKey, LEARNING_STORE_KEY } = await import('../core/LearningsReplicatedStore.js');
+        const { learningTierOf, deriveLearningRecordKey, buildLearningRecordData, buildLearningTombstoneData, LEARNING_STORE_KEY, } = await import('../core/LearningsReplicatedStore.js');
         const learningsUnionReader = new ReplicatedStoreReader({
             registry: replicatedKindRegistry,
             stores: _stateSyncStoresResolved, // gate-resolved (dev-live / fleet-dark) per operator directive 2026-06-13
             tierOf: learningTierOf,
-            loadOriginRecords: (store, recordKey) => {
-                if (store !== LEARNING_STORE_KEY || _meshSelfId === null)
-                    return [];
-                for (const l of evolution.listLearnings()) {
-                    if (deriveLearningRecordKey(l.title, l.category, l.source) === recordKey) {
-                        const o = learningToOriginRecord(l, _meshSelfId);
-                        return o ? [o] : [];
-                    }
-                }
-                return [];
-            },
-            listRecordKeys: (store) => {
-                if (store !== LEARNING_STORE_KEY)
-                    return [];
-                const keys = [];
-                for (const l of evolution.listLearnings()) {
-                    const k = deriveLearningRecordKey(l.title, l.category, l.source);
-                    if (k !== null)
-                        keys.push(k);
-                }
-                return keys;
-            },
+            // WS2 send-side: the union now reads OWN + PEER journal streams (each record's
+            // authoritative emit-time HLC) via the peer-stream reader — so a learning
+            // replicated FROM a peer is READABLE here, not just the local one. Dark / no
+            // journal ⇒ reader undefined ⇒ [] (isLive already gates a disabled store to a
+            // strict no-op, so this never changes single-machine behavior).
+            loadOriginRecords: (store, recordKey) => store === LEARNING_STORE_KEY && replicatedPeerStreamReader
+                ? replicatedPeerStreamReader.loadOriginRecords(store, recordKey)
+                : [],
+            listRecordKeys: (store) => store === LEARNING_STORE_KEY && replicatedPeerStreamReader
+                ? replicatedPeerStreamReader.listRecordKeys(store)
+                : [],
             droppedOrigins: droppedOriginRegistry,
             conflictStore,
         });
-        void learningsUnionReader; // consumed by the learnings peer-read surface + the journal-apply rollout stage (WS2.2+)
+        void learningsUnionReader; // consumed by the learnings peer-read surface (the E2E reads through it) + future session-context injection
+        // WS2 SEND-SIDE: attach the journal-backed emitter to the EvolutionManager's
+        // learning hooks. The call sites already fire emitPut/emitDelete on every
+        // saveLearnings (prune→emitDelete, survivor→emitPut); the adapter maps the
+        // manager's emit signature to the store's build*RecordData. The emitter owns the
+        // dark gate, HLC tick, `observed` witness, and journal append. Attached only when
+        // the emitter exists (journal live); when dark the hooks stay no-ops (byte-
+        // identical single-machine behavior — the local LRN-NNN id never crosses the wire).
+        if (replicatedRecordEmitter) {
+            const emitter = replicatedRecordEmitter;
+            evolution.setLearningReplicationEmitter({
+                emitPut: (rec) => emitter.emit(LEARNING_STORE_KEY, deriveLearningRecordKey(rec.title, rec.category, rec.source), (hlc, origin, observed) => buildLearningRecordData({ record: rec, hlc, origin, observed })),
+                emitDelete: (title, category, source, deletedAt) => emitter.emit(LEARNING_STORE_KEY, deriveLearningRecordKey(title, category, source), (hlc, origin, observed) => buildLearningTombstoneData({ title, category, source, hlc, origin, deletedAt, observed })),
+            });
+        }
         // WS2.4 — the bypass-proof union reader for the `knowledge` store + the emit seam on
         // the KnowledgeManager. The KnowledgeManager reads the local catalog.json (cheap, no
         // background work); we construct one here scoped to the replication wiring. The union
@@ -15405,31 +15493,17 @@ export async function startServer(options) {
                         fetchPeerCapacity: async (machineId, url) => {
                             const res = await meshClient.send({ machineId, url }, { type: 'session-status' }, 0);
                             if (res.ok && res.result && typeof res.result === 'object') {
-                                const cap = res.result;
-                                const journalAdvert = _unwrapPeerJournalAdvert(machineId, cap.journalAdvert);
-                                // #930 sibling (live, v1.3.369): the commitments advert was
-                                // parsed AWAY here — served by the peer, dropped by this
-                                // narrowing return — so driveCommitmentsSync never fired and
-                                // zero replicas ever landed. Pass it through.
-                                // A2 (live, v1.3.384): the SAME narrowing also dropped the
-                                // peer's quotaState (its getCapacity(self) includes it), so the
-                                // router only ever saw its OWN quota and quota-aware placement
-                                // (#804) could never avoid a rate-limited PEER — the original
-                                // EXO failure. Pass it through too. Absent = not blocked.
-                                return {
-                                    selfReportedLastSeen: cap.selfReportedLastSeen,
-                                    loadAvg: cap.loadAvg,
-                                    journalAdvert,
-                                    ...(cap.commitmentsAdvert ? { commitmentsAdvert: cap.commitmentsAdvert } : {}),
-                                    // §WS2.1 sibling pass-through (the #930/A2 narrowing lesson): the
-                                    // peer's preferences advert is served but would be dropped here
-                                    // without this, so drivePreferencesSync would never fire.
-                                    ...(cap.preferencesAdvert ? { preferencesAdvert: cap.preferencesAdvert } : {}),
-                                    ...(cap.quotaState ? { quotaState: cap.quotaState } : {}),
-                                    // Guard posture rides the same pass-through (the A2 narrowing
-                                    // lesson): dropping it here would blind the pool to peers' posture.
-                                    ...(cap.guardPosture ? { guardPosture: cap.guardPosture } : {}),
-                                };
+                                // The journal advert is the one slice that needs closure context
+                                // (the machine-id-keyed unwrap), so it is computed HERE; the rest
+                                // of the narrowing — commitmentsAdvert (#930), quotaState (A2/#804),
+                                // preferencesAdvert (WS2.1), guardPosture, and seamlessnessFlags
+                                // (THIS fix, the 4th instance of the narrowing-return-forgets-a-field
+                                // class) — is the SINGLE shared `narrowSessionStatusToPeerCapacity`
+                                // pass-through that the peer-presence round-trip test also runs, so
+                                // the test proves the REAL mapping and a forgotten field can't recur
+                                // silently (the wiring-integrity ratchet asserts over this helper).
+                                const journalAdvert = _unwrapPeerJournalAdvert(machineId, res.result.journalAdvert);
+                                return presenceMod.narrowSessionStatusToPeerCapacity(res.result, journalAdvert);
                             }
                             return null;
                         },