instar 1.3.569 → 1.3.571

package/dist/core/ReplicatedPeerStreamReader.js

@@ -0,0 +1,274 @@
+/**
+ * ReplicatedPeerStreamReader — materializes a replicated store's per-origin records
+ * from the coherence-journal streams on disk (WS2 send-side, the union-read half).
+ *
+ * Spec: docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md §3.3 + §3.4; the substrate is
+ * docs/specs/multi-machine-replicated-store-foundation.md §7.1 (namespaced per-origin
+ * storage), §7.2 (the union the reader merges).
+ *
+ * THE GAP THIS CLOSES: `ReplicatedStoreReader.loadOriginRecords` returned only the OWN
+ * origin, so even a correctly-received peer record (durably written by
+ * JournalSyncApplier to `peers/<M>.<kind>.jsonl`) was invisible to a read. This reader
+ * is the seam that makes the union real: it reads the OWN stream
+ * (`<self>.<kind>.jsonl` + archives) AND every peer replica stream
+ * (`peers/<M>.<kind>.jsonl` + archives; quarantine + meta excluded), validates each
+ * line through the SAME `validateReplicatedEnvelope` + store schema the writer used,
+ * and folds to the LATEST record per `(origin, recordKey)` by HLC-max. A delete is a
+ * tombstone (kept) so the union's delete-resolution + resurrection guard work.
+ *
+ * It supplies three seams to the rest of the system:
+ *   - `loadOriginRecords(store, recordKey)` + `listRecordKeys(store)` — the
+ *     ReplicatedStoreReader seams (the no-clobber union's per-origin input).
+ *   - `loadWitness(store, recordKey)` — the emitter's `observed` source (the MAX HLC
+ *     over every origin record held for the key — own prior + applied peers).
+ *   - `loadOwnEntries(store, origin)` — the snapshot-serve seam (raw OWN entries by
+ *     kind), replacing the `loadOwnEntries: () => ({})` stub.
+ *
+ * PURE-ish: all I/O is the injected `fsImpl` (defaults to node:fs); no Date, no
+ * network. Bounded — replicated memory stores are small (per-kind retention caps), and
+ * the read ceiling mirrors the applier's SERVE_READ_BYTE_CEILING.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { sanitizeMachineId, readTailTolerant, } from './CoherenceJournal.js';
+import { HybridLogicalClock } from './HybridLogicalClock.js';
+import { validateReplicatedEnvelope, } from './ReplicatedRecordEnvelope.js';
+/** The byte ceiling for one stream read (mirrors JournalSyncApplier.SERVE_READ_BYTE_CEILING). */
+const READ_BYTE_CEILING = 64 * 1024 * 1024;
+/** A counters bag that ignores every bump — the reader surfaces nothing per-field
+ *  (a malformed replica line is simply dropped from the union, the safe direction). */
+const NOOP_COUNTERS = {
+    bumpSchemaReject: () => { },
+    bumpDroppedField: () => { },
+    bumpJailReject: () => { },
+};
+function realFs() {
+    return {
+        openSync: fs.openSync,
+        writeSync: fs.writeSync,
+        fdatasyncSync: fs.fdatasyncSync,
+        closeSync: fs.closeSync,
+        existsSync: fs.existsSync,
+        statSync: fs.statSync,
+        renameSync: fs.renameSync,
+        writeFileSync: fs.writeFileSync,
+        readFileSync: fs.readFileSync,
+        readdirSync: fs.readdirSync,
+        truncateSync: fs.truncateSync,
+        mkdirSync: fs.mkdirSync,
+        readSync: fs.readSync,
+    };
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// RULE 3: EXEMPT — this is NOT a state-detector. ReplicatedPeerStreamReader reads
+// the agent's OWN coherence-journal stream files (a fixed, self-authored JSONL format)
+// and validates each line through validateReplicatedEnvelope. It does not parse
+// provider/CLI output, does not detect external/environment state, and has no
+// signature-matching that could drift across providers — it deterministically folds
+// in-house journal entries by HLC. The "*Reader" name matches the Rule-3 pattern
+// heuristic but the substance is an internal-format reader (mirrors the same exemption
+// on ReplicatedStoreReader).
+export class ReplicatedPeerStreamReader {
+    stateDir;
+    registry;
+    selfMachineId;
+    io;
+    constructor(config) {
+        if (!config)
+            throw new Error('ReplicatedPeerStreamReader: config required');
+        if (!config.registry)
+            throw new Error('ReplicatedPeerStreamReader: registry required (not null)');
+        if (typeof config.selfMachineId !== 'string' || config.selfMachineId.length === 0) {
+            throw new Error('ReplicatedPeerStreamReader: selfMachineId must be a non-empty string');
+        }
+        this.stateDir = config.stateDir;
+        this.registry = config.registry;
+        this.selfMachineId = config.selfMachineId;
+        this.io = config.fsImpl ?? realFs();
+    }
+    // ── The ReplicatedStoreReader seams ────────────────────────────────────────
+    /**
+     * Every origin's CURRENT record for (store, recordKey) — the own stream + each peer
+     * replica namespace, ONE record per origin (the latest by HLC, a delete kept as a
+     * tombstone). The union reader merges these via the no-clobber rule. A single-machine
+     * install returns only the own origin (so the union is a strict no-op = that record).
+     */
+    loadOriginRecords(store, recordKey) {
+        const byOrigin = this.materialize(store).get(recordKey);
+        return byOrigin ? [...byOrigin.values()] : [];
+    }
+    /** Every recordKey the store currently holds across ALL origins (for readAll). */
+    listRecordKeys(store) {
+        return [...this.materialize(store).keys()];
+    }
+    // ── The emitter `observed`-witness seam (§7.2) ─────────────────────────────
+    /**
+     * The MAX HLC over every origin record this machine currently holds for
+     * (store, recordKey) — own prior + applied peers. The author stamps this as the
+     * record's `observed` witness. Returns undefined when none is held (first write of
+     * the key) ⇒ the author omits `observed` ⇒ flag-on-conflict (the safe direction).
+     * Sound: it only witnesses a version provably on disk, so a not-yet-pulled peer
+     * version is absent here and the merge flags concurrent rather than silently
+     * resolving (§7.2 err-toward-flag).
+     */
+    loadWitness(store, recordKey) {
+        const records = this.loadOriginRecords(store, recordKey);
+        let max;
+        for (const r of records) {
+            if (max === undefined || HybridLogicalClock.compare(r.envelope.hlc, max) > 0) {
+                max = r.envelope.hlc;
+            }
+        }
+        return max;
+    }
+    // ── The snapshot-serve seam (replaces loadOwnEntries: () => ({})) ──────────
+    /**
+     * The OWN-stream raw entries for `store`, keyed by contributing journal kind — the
+     * single-origin snapshot input (§6). `origin` MUST be this machine (single-origin,
+     * §6.1); a request for any other origin returns `{}` (we only serve what we
+     * authored). Reads the own current + archive streams; returns ALL entries (the
+     * materializer folds to the latest per recordKey and computes the seq watermark).
+     */
+    loadOwnEntries(store, origin) {
+        const reg = this.registry.getByStore(store);
+        if (!reg)
+            return {};
+        // Single-origin: only serve OUR OWN authored stream.
+        if (origin !== this.selfMachineId)
+            return {};
+        const kind = reg.kind;
+        const entries = this.readKindEntries(this.ownStreamFiles(origin, kind));
+        if (entries.length === 0)
+            return {};
+        const raw = entries.map((e) => ({
+            seq: e.seq,
+            ts: e.ts,
+            machine: e.machine,
+            kind: e.kind,
+            data: e.data,
+        }));
+        return { [kind]: raw };
+    }
+    // ── Materialization (own + peer streams → latest per (origin, recordKey)) ──
+    /**
+     * Build `recordKey → (origin → latest OriginRecord)` for a store by reading the own
+     * stream + every peer replica stream and folding by HLC-max per (origin, recordKey).
+     * Read FRESH each call (no cache) so a write-then-read is always consistent — the
+     * stores are small + bounded, so the scan is cheap.
+     */
+    materialize(store) {
+        const out = new Map();
+        const reg = this.registry.getByStore(store);
+        if (!reg)
+            return out;
+        const kind = reg.kind;
+        const schema = reg.schema;
+        const files = [
+            ...this.ownStreamFiles(this.selfMachineId, kind),
+            ...this.peerStreamFiles(kind),
+        ];
+        for (const file of files) {
+            const entries = this.readKindEntries([file]);
+            for (const entry of entries) {
+                if (entry.kind !== kind)
+                    continue;
+                const data = entry.data;
+                if (!data || typeof data !== 'object')
+                    continue;
+                const result = validateReplicatedEnvelope(data, schema, NOOP_COUNTERS);
+                if (!result.ok)
+                    continue;
+                const origin = result.envelope.origin;
+                const recordKey = result.envelope.recordKey;
+                const rec = { origin, envelope: result.envelope, data: result.storeFields };
+                let byOrigin = out.get(recordKey);
+                if (!byOrigin) {
+                    byOrigin = new Map();
+                    out.set(recordKey, byOrigin);
+                }
+                const prior = byOrigin.get(origin);
+                // Keep the LATEST record per (origin, recordKey) by HLC-max (a delete is a
+                // tombstone — kept, so the union resolves delete↔put deterministically).
+                if (!prior || HybridLogicalClock.compare(rec.envelope.hlc, prior.envelope.hlc) > 0) {
+                    byOrigin.set(origin, rec);
+                }
+            }
+        }
+        return out;
+    }
+    /** Read + tolerant-parse every JournalEntry from the given stream files. */
+    readKindEntries(files) {
+        const out = [];
+        for (const f of files) {
+            const read = readTailTolerant(this.io, f, Number.MAX_SAFE_INTEGER, READ_BYTE_CEILING);
+            for (const e of read.entries)
+                out.push(e);
+        }
+        return out;
+    }
+    // ── Path enumeration ───────────────────────────────────────────────────────
+    journalDir() {
+        return path.join(this.stateDir, 'state', 'coherence-journal');
+    }
+    peersDir() {
+        return path.join(this.journalDir(), 'peers');
+    }
+    /** Own current + archive stream files for (origin, kind), newest-first by stamp. */
+    ownStreamFiles(origin, kind) {
+        const safe = sanitizeMachineId(origin);
+        const dir = this.journalDir();
+        const current = path.join(dir, `${safe}.${kind}.jsonl`);
+        const out = [];
+        if (this.io.existsSync(current))
+            out.push(current);
+        out.push(...this.archivesFor(dir, safe, kind));
+        return out;
+    }
+    /** Every peer replica current + archive stream file for `kind` (quarantine excluded). */
+    peerStreamFiles(kind) {
+        const dir = this.peersDir();
+        let names;
+        try {
+            names = this.io.readdirSync(dir);
+        }
+        catch { /* @silent-fallback-ok: peers dir absent = no peers yet (single-machine / fresh) — an empty union, never an error. */
+            return [];
+        }
+        const k = escapeRegExp(kind);
+        // `<id>.<kind>.jsonl` (current) OR `<id>.<kind>.<digits>.jsonl` (archive). The
+        // `<id>` is greedy (`.+`) and may itself contain dots. Quarantine files
+        // (`<id>.<kind>.quarantine.<digits>.jsonl`) are EXCLUDED — they are a fenced
+        // old incarnation, never part of the live union.
+        const re = new RegExp(`^(.+)\\.${k}(?:\\.\\d+)?\\.jsonl$`);
+        const out = [];
+        for (const n of names) {
+            if (n.includes('.quarantine.'))
+                continue;
+            if (re.test(n))
+                out.push(path.join(dir, n));
+        }
+        return out;
+    }
+    /** Archive files `<safe>.<kind>.<stamp>.jsonl` in `dir`, newest-first. */
+    archivesFor(dir, safe, kind) {
+        let names;
+        try {
+            names = this.io.readdirSync(dir);
+        }
+        catch { /* @silent-fallback-ok: dir absent = nothing to read — empty, never an error. */
+            return [];
+        }
+        const re = new RegExp(`^${escapeRegExp(`${safe}.${kind}.`)}(\\d+)\\.jsonl$`);
+        const archives = [];
+        for (const n of names) {
+            const m = re.exec(n);
+            if (m)
+                archives.push({ file: path.join(dir, n), stamp: Number(m[1]) });
+        }
+        archives.sort((a, b) => b.stamp - a.stamp);
+        return archives.map((a) => a.file);
+    }
+}
+//# sourceMappingURL=ReplicatedPeerStreamReader.js.map

package/dist/core/ReplicatedPeerStreamReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplicatedPeerStreamReader.js","sourceRoot":"","sources":["../../src/core/ReplicatedPeerStreamReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAIL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,yBAAyB,CAAC;AAChF,OAAO,EACL,0BAA0B,GAG3B,MAAM,+BAA+B,CAAC;AAIvC,iGAAiG;AACjG,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;uFACuF;AACvF,MAAM,aAAa,GAA+B;IAChD,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;CACzB,CAAC;AAaF,SAAS,MAAM;IACb,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,aAAa,EAAE,EAAE,CAAC,aAAa;QAC/B,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,aAAa,EAAE,EAAE,CAAC,aAAa;QAC/B,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,EAAE,CAAC,QAAQ;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,kFAAkF;AAClF,uFAAuF;AACvF,gFAAgF;AAChF,8EAA8E;AAC9E,oFAAoF;AACpF,iFAAiF;AACjF,uFAAuF;AACvF,6BAA6B;AAC7B,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAS;IACjB,QAAQ,CAAyB;IACjC,aAAa,CAAS;IACtB,EAAE,CAAY;IAE/B,YAAY,MAAwC;QAClD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAClG,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,8EAA8E;IAE9E;;;;;OAKG;IACH,iBAAiB,CAAC,KAAa,EAAE,SAAiB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,kFAAkF;IAClF,cAAc,CAAC,KAAa;QAC1B,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAE9E;;;;;;;;OAQG;IACH,WAAW,CAAC,KAAa,EAAE,SAAiB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,GAA6B,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8EAA8E;IAE9E;;;;;;OAMG;IACH,cAAc,CAAC,KAAa,EAAE,MAAc;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,qDAAqD;QACrD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAmB,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAsB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAE9E;;;;;OAKG;IACK,WAAW,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAmB,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAE1B,MAAM,KAAK,GAAG;YACZ,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC;YAChD,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;SAC9B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;oBAAE,SAAS;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAA+B,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gBAClG,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,SAAS;gBACzB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5C,MAAM,GAAG,GAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC1F,IAAI,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;oBAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,2EAA2E;gBAC3E,yEAAyE;gBACzE,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4EAA4E;IACpE,eAAe,CAAC,KAAe;QACrC,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;YACtF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8EAA8E;IAEtE,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChE,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,oFAAoF;IAC5E,cAAc,CAAC,MAAc,EAAE,IAAiB;QACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,CAAC;QACxD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACjF,eAAe,CAAC,IAAiB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAa,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC,CAAC,qHAAqH;YAC7H,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,+EAA+E;QAC/E,wEAAwE;QACxE,6EAA6E;QAC7E,iDAAiD;QACjD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,SAAS;YACzC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAClE,WAAW,CAAC,GAAW,EAAE,IAAY,EAAE,IAAiB;QAC9D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAa,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC,CAAC,gFAAgF;YACxF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAsC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/core/ReplicatedRecordEmitter.d.ts

@@ -0,0 +1,102 @@
+/**
+ * ReplicatedRecordEmitter — the GENERIC journal-backed SEND emitter (WS2 send-side).
+ *
+ * Spec: docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md §4; the substrate it rides is
+ * docs/specs/multi-machine-replicated-store-foundation.md §4 (the envelope +
+ * flag-gated emission) and §7.2 (the `observed` last-writer-witness).
+ *
+ * THE GAP THIS CLOSES: every memory manager already calls an internal
+ * `emitter.emitPut(record)` / `emitter.emitDelete(...)` hook on each write, behind a
+ * `*ReplicationEmitter | null` seam — but server.ts never constructed the concrete
+ * emitter those hooks call (it was deferred to "a later rollout stage" that never
+ * came), so the hooks fired into a no-op and nothing reached the journal own-streams.
+ * This class IS that concrete emitter; server.ts builds ONE and adapts it to each
+ * manager's emit seam (a tiny per-store adapter that names the store's
+ * `build*RecordData`).
+ *
+ * It is store-AGNOSTIC: `emit(store, recordKey, build)` resolves the store's journal
+ * kind from the injected `ReplicatedKindRegistry`, gates on
+ * `multiMachine.stateSync.<store>.enabled` (dark by default), stamps the HLC, derives
+ * the `observed` witness, asks the store's builder for the disclosure-minimized
+ * envelope `data`, and appends it via `CoherenceJournal.emitReplicatedRecord`. ONE
+ * generic path serves all 7 kinds; the only per-store thing is the builder closure.
+ *
+ * SAFETY: NEVER throws into the caller (the manager hooks are best-effort). A disabled
+ * store, an unregistered store, a degenerate (null) recordKey, a builder that returns
+ * null or throws (e.g. a record over its per-entry byte cap) — every one is a counted
+ * no-op, never an exception that would break the local write the agent is performing.
+ * Emission is SINGLE-ORIGIN by construction: it stamps `origin = this machine` and the
+ * journal writes only this machine's own stream (§6.1 anti-forgery holds end-to-end).
+ */
+import type { HlcTimestamp } from './HybridLogicalClock.js';
+import { type ReplicatedKindRegistry, type StateSyncStores } from './ReplicatedRecordEnvelope.js';
+/** The minimal journal seam the emitter needs (so it is unit-testable with a fake). */
+export interface ReplicatedRecordEmitterJournal {
+    /** Append a built replicated-record envelope `data` for `kind` (no-op when the
+     *  kind is not a registered replicated kind; never throws). */
+    emitReplicatedRecord(kind: string, data: Record<string, unknown>): void;
+}
+/** The minimal HLC seam (only `tick()` is needed on the author side). */
+export interface ReplicatedRecordEmitterClock {
+    /** Local-event advance — strictly greater than every prior tick/receive (§3.2.1). */
+    tick(): HlcTimestamp;
+}
+/** A builder closure: produce the disclosure-minimized envelope `data` for this write
+ *  given the freshly-ticked `hlc`, this machine's `origin`, and the `observed` witness
+ *  (absent ⇒ no prior witness). Returns null to SKIP (a degenerate record with no
+ *  stable identity surface). May THROW on an over-cap record — the emitter catches it. */
+export type BuildRecordData = (hlc: HlcTimestamp, origin: string, observed: HlcTimestamp | undefined) => Record<string, unknown> | null;
+/** The DI'd seams (asserted real, never null/no-op, by the wiring-integrity test). */
+export interface ReplicatedRecordEmitterSeams {
+    /** The journal append sink. */
+    journal: ReplicatedRecordEmitterJournal;
+    /** The author-side HLC clock (persisted; one per machine). */
+    clock: ReplicatedRecordEmitterClock;
+    /** The replicated-kind registry — resolves store → journal kind; the emitter only
+     *  emits a registered store. */
+    registry: ReplicatedKindRegistry;
+    /** This machine's origin id (stamped on every emitted record — single-origin). */
+    origin: string;
+    /** The per-store stateSync flags (the dark-by-default gate). A getter so a live
+     *  config flip is honored without reconstructing the emitter. */
+    stores: () => StateSyncStores | undefined;
+    /**
+     * The last-writer-witness source (§7.2): the MAX HLC over every origin record this
+     * machine CURRENTLY holds on disk for (store, recordKey) — own prior + applied
+     * peers. Sound by construction: it can only witness a version provably on disk, so a
+     * not-yet-pulled peer version is simply absent ⇒ the merge flags concurrent
+     * (err-toward-flag), never a silent clobber. Returns undefined when none is held
+     * (the first write of a key) ⇒ `observed` omitted. Best-effort; throwing is caught.
+     */
+    loadWitness: (store: string, recordKey: string) => HlcTimestamp | undefined;
+    /** Optional structured logger (default no-op). */
+    log?: (event: string, detail: Record<string, unknown>) => void;
+}
+/** Lifetime counters for observability (mirrors the journal's degradation style). */
+export interface ReplicatedRecordEmitterStats {
+    /** Records appended to the journal. */
+    emitted: number;
+    /** No-ops because the store was disabled (dark). */
+    storeDisabled: number;
+    /** No-ops because the recordKey was null/degenerate or the builder returned null. */
+    skipped: number;
+    /** Builder/journal throws caught (never propagated to the manager). */
+    errors: number;
+}
+export declare class ReplicatedRecordEmitter {
+    private readonly seams;
+    private readonly stats;
+    constructor(seams: ReplicatedRecordEmitterSeams);
+    /** Read-only stats (for observability + the wiring-integrity assertions). */
+    getStats(): Readonly<ReplicatedRecordEmitterStats>;
+    /**
+     * Emit one replicated record for (store, recordKey). The single generic path for a
+     * put OR a delete — the only difference is the `build` closure (a put builder vs a
+     * tombstone builder). Never throws into the caller.
+     *
+     * Order (§4): dark gate → degenerate guard → witness → tick → build → append.
+     */
+    emit(store: string, recordKey: string | null | undefined, build: BuildRecordData): void;
+    private log;
+}
+//# sourceMappingURL=ReplicatedRecordEmitter.d.ts.map

package/dist/core/ReplicatedRecordEmitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplicatedRecordEmitter.d.ts","sourceRoot":"","sources":["../../src/core/ReplicatedRecordEmitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAEvC,uFAAuF;AACvF,MAAM,WAAW,8BAA8B;IAC7C;mEAC+D;IAC/D,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzE;AAED,yEAAyE;AACzE,MAAM,WAAW,4BAA4B;IAC3C,qFAAqF;IACrF,IAAI,IAAI,YAAY,CAAC;CACtB;AAED;;;0FAG0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,YAAY,GAAG,SAAS,KAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAEpC,sFAAsF;AACtF,MAAM,WAAW,4BAA4B;IAC3C,+BAA+B;IAC/B,OAAO,EAAE,8BAA8B,CAAC;IACxC,8DAA8D;IAC9D,KAAK,EAAE,4BAA4B,CAAC;IACpC;oCACgC;IAChC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;qEACiE;IACjE,MAAM,EAAE,MAAM,eAAe,GAAG,SAAS,CAAC;IAC1C;;;;;;;OAOG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;IAC5E,kDAAkD;IAClD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChE;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAKpB;gBAEU,KAAK,EAAE,4BAA4B;IAkB/C,6EAA6E;IAC7E,QAAQ,IAAI,QAAQ,CAAC,4BAA4B,CAAC;IAIlD;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IA6CvF,OAAO,CAAC,GAAG;CAGZ"}

package/dist/core/ReplicatedRecordEmitter.js

@@ -0,0 +1,122 @@
+/**
+ * ReplicatedRecordEmitter — the GENERIC journal-backed SEND emitter (WS2 send-side).
+ *
+ * Spec: docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md §4; the substrate it rides is
+ * docs/specs/multi-machine-replicated-store-foundation.md §4 (the envelope +
+ * flag-gated emission) and §7.2 (the `observed` last-writer-witness).
+ *
+ * THE GAP THIS CLOSES: every memory manager already calls an internal
+ * `emitter.emitPut(record)` / `emitter.emitDelete(...)` hook on each write, behind a
+ * `*ReplicationEmitter | null` seam — but server.ts never constructed the concrete
+ * emitter those hooks call (it was deferred to "a later rollout stage" that never
+ * came), so the hooks fired into a no-op and nothing reached the journal own-streams.
+ * This class IS that concrete emitter; server.ts builds ONE and adapts it to each
+ * manager's emit seam (a tiny per-store adapter that names the store's
+ * `build*RecordData`).
+ *
+ * It is store-AGNOSTIC: `emit(store, recordKey, build)` resolves the store's journal
+ * kind from the injected `ReplicatedKindRegistry`, gates on
+ * `multiMachine.stateSync.<store>.enabled` (dark by default), stamps the HLC, derives
+ * the `observed` witness, asks the store's builder for the disclosure-minimized
+ * envelope `data`, and appends it via `CoherenceJournal.emitReplicatedRecord`. ONE
+ * generic path serves all 7 kinds; the only per-store thing is the builder closure.
+ *
+ * SAFETY: NEVER throws into the caller (the manager hooks are best-effort). A disabled
+ * store, an unregistered store, a degenerate (null) recordKey, a builder that returns
+ * null or throws (e.g. a record over its per-entry byte cap) — every one is a counted
+ * no-op, never an exception that would break the local write the agent is performing.
+ * Emission is SINGLE-ORIGIN by construction: it stamps `origin = this machine` and the
+ * journal writes only this machine's own stream (§6.1 anti-forgery holds end-to-end).
+ */
+import { isStoreEmissionEnabled, } from './ReplicatedRecordEnvelope.js';
+export class ReplicatedRecordEmitter {
+    seams;
+    stats = {
+        emitted: 0,
+        storeDisabled: 0,
+        skipped: 0,
+        errors: 0,
+    };
+    constructor(seams) {
+        // Wiring-integrity preconditions: the seams MUST be real, not null/no-op.
+        if (!seams)
+            throw new Error('ReplicatedRecordEmitter: seams are required');
+        if (!seams.journal || typeof seams.journal.emitReplicatedRecord !== 'function') {
+            throw new Error('ReplicatedRecordEmitter: journal.emitReplicatedRecord seam must be a function (not a no-op)');
+        }
+        if (!seams.clock || typeof seams.clock.tick !== 'function') {
+            throw new Error('ReplicatedRecordEmitter: clock.tick seam must be a function');
+        }
+        if (!seams.registry)
+            throw new Error('ReplicatedRecordEmitter: registry seam is required (not null)');
+        if (typeof seams.origin !== 'string' || seams.origin.length === 0) {
+            throw new Error('ReplicatedRecordEmitter: origin must be a non-empty string');
+        }
+        if (typeof seams.stores !== 'function')
+            throw new Error('ReplicatedRecordEmitter: stores seam must be a function');
+        if (typeof seams.loadWitness !== 'function')
+            throw new Error('ReplicatedRecordEmitter: loadWitness seam must be a function (not a no-op)');
+        this.seams = seams;
+    }
+    /** Read-only stats (for observability + the wiring-integrity assertions). */
+    getStats() {
+        return { ...this.stats };
+    }
+    /**
+     * Emit one replicated record for (store, recordKey). The single generic path for a
+     * put OR a delete — the only difference is the `build` closure (a put builder vs a
+     * tombstone builder). Never throws into the caller.
+     *
+     * Order (§4): dark gate → degenerate guard → witness → tick → build → append.
+     */
+    emit(store, recordKey, build) {
+        try {
+            // 1. Dark gate (the default). A disabled store emits NOTHING — a strict no-op.
+            if (!isStoreEmissionEnabled(this.seams.stores(), store)) {
+                this.stats.storeDisabled++;
+                return;
+            }
+            // 2. Only a registered store has a journal kind to ride.
+            const reg = this.seams.registry.getByStore(store);
+            if (!reg) {
+                this.stats.skipped++;
+                return;
+            }
+            // 3. Degenerate guard — a null/empty recordKey has no stable identity surface.
+            if (typeof recordKey !== 'string' || recordKey.length === 0) {
+                this.stats.skipped++;
+                return;
+            }
+            // 4. Witness BEFORE the tick — the HLC this machine had already merged for the
+            //    key (own prior + applied peers). Best-effort; a witness read fault degrades
+            //    to "no witness" (flag-on-conflict, the safe direction), never a throw.
+            let observed;
+            try {
+                observed = this.seams.loadWitness(store, recordKey);
+            }
+            catch (e) { /* @silent-fallback-ok: a witness read fault degrades to no-witness ⇒ flag-on-conflict (the safe merge direction, §7.2); never blocks the emit. */
+                observed = undefined;
+                this.log('witness-read-failed', { store, error: e?.message });
+            }
+            // 5. Tick AFTER the witness so hlc > observed (a clean sequential position).
+            const hlc = this.seams.clock.tick();
+            // 6. Build the disclosure-minimized envelope data (store-specific).
+            const data = build(hlc, this.seams.origin, observed);
+            if (data === null || data === undefined) {
+                this.stats.skipped++;
+                return;
+            }
+            // 7. Append. The journal validates + op-key-dedupes + enqueues (non-blocking).
+            this.seams.journal.emitReplicatedRecord(reg.kind, data);
+            this.stats.emitted++;
+        }
+        catch (e) { /* @silent-fallback-ok: the manager's write must NEVER fail because replication did — a builder throw (e.g. over-cap) / journal fault is a counted no-op, surfaced via stats + the log, never propagated (Structure > Willpower: the safety is structural, not per-caller). */
+            this.stats.errors++;
+            this.log('emit-failed', { store, error: e?.message });
+        }
+    }
+    log(event, detail) {
+        this.seams.log?.(event, detail);
+    }
+}
+//# sourceMappingURL=ReplicatedRecordEmitter.js.map

package/dist/core/ReplicatedRecordEmitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplicatedRecordEmitter.js","sourceRoot":"","sources":["../../src/core/ReplicatedRecordEmitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,sBAAsB,GAGvB,MAAM,+BAA+B,CAAC;AAgEvC,MAAM,OAAO,uBAAuB;IACjB,KAAK,CAA+B;IACpC,KAAK,GAAiC;QACrD,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;KACV,CAAC;IAEF,YAAY,KAAmC;QAC7C,0EAA0E;QAC1E,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,KAAK,UAAU,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACtG,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACnH,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC3I,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,6EAA6E;IAC7E,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAa,EAAE,SAAoC,EAAE,KAAsB;QAC9E,IAAI,CAAC;YACH,+EAA+E;YAC/E,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,+EAA+E;YAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,+EAA+E;YAC/E,iFAAiF;YACjF,4EAA4E;YAC5E,IAAI,QAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAC,kJAAkJ;gBAC9J,QAAQ,GAAG,SAAS,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,6EAA6E;YAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,oEAAoE;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,+EAA+E;YAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,CAAC,8QAA8Q;YAC1R,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,MAA+B;QACxD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/core/ws2SendWiring.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ws2SendWiring — the SEND-side wiring manifest + the wiring-integrity ratchet
+ * (WS2 send-side, docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md §6/§7).
+ *
+ * THE INVARIANT THIS ENFORCES: every replicated store registered in the
+ * `ReplicatedKindRegistry` (the RECEIVE/advert half) must be CONSCIOUSLY classified
+ * as either SEND-WIRED (its manager's emit hooks are attached to the journal-backed
+ * emitter) or SEND-PENDING (a known, enumerated follow-up). A new replicated kind
+ * added to the registry WITHOUT placing it in one of these sets fails the ratchet —
+ * which is the EXACT gap this workstream fixes: a kind shipped receive-only (advert +
+ * apply machinery) with the SEND half silently a no-op. The ratchet makes that a CI
+ * failure, not a memory item (Structure > Willpower).
+ *
+ * Pure data + a pure check — no I/O, no deps. The server's wiring + the
+ * wiring-integrity test BOTH read these sets, so they cannot drift.
+ */
+/** Stores whose manager emit hooks ARE attached to the journal-backed emitter (their
+ *  records actually cross). The learnings slice ships first; the other seamed stores
+ *  follow on the SAME emitter (WS2-SEND-2). */
+export declare const WS2_SEND_WIRED_STORES: ReadonlyArray<string>;
+/**
+ * Stores registered for RECEIVE but whose SEND wiring is a KNOWN, enumerated
+ * follow-up — NOT a silent omission. Each is here for a stated reason:
+ *  - relationships / knowledge / evolutionActions / userRegistry: fully seamed
+ *    managers (emitPut + emitDelete); table-row wiring onto the same emitter (WS2-SEND-2).
+ *  - topicOperator: seamed put-only (no emitDelete in its manager interface yet) (WS2-SEND-3).
+ *  - preferences: NO manager emit seam yet — it rode the deprecated `preferences-sync`
+ *    verb; needs a manager emit hook before it can be wired (WS2-SEND-3).
+ */
+export declare const WS2_SEND_PENDING_STORES: ReadonlyArray<string>;
+/** A registered store's send-wiring classification. */
+export type Ws2SendStatus = 'wired' | 'pending' | 'unclassified';
+/** Classify a registered store's send-wiring status. */
+export declare function ws2SendStatus(store: string): Ws2SendStatus;
+/** The ratchet result: any registered store that is neither wired nor pending. */
+export interface Ws2SendWiringAudit {
+    wired: string[];
+    pending: string[];
+    /** Registered stores in NEITHER set — the failure condition (a silent receive-only kind). */
+    unclassified: string[];
+    ok: boolean;
+}
+/**
+ * Audit a set of registered store keys against the wiring manifest. `ok` is false iff
+ * any registered store is unclassified (neither wired nor pending) — the exact
+ * receive-only gap this workstream closes. Also flags a store in BOTH sets (a manifest
+ * authoring error) as unclassified-style failure via a thrown precondition is avoided;
+ * instead WIRED takes precedence and the overlap is surfaced by the caller's own
+ * disjointness assertion in the test.
+ */
+export declare function auditWs2SendWiring(registeredStores: ReadonlyArray<string>): Ws2SendWiringAudit;
+//# sourceMappingURL=ws2SendWiring.d.ts.map

package/dist/core/ws2SendWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws2SendWiring.d.ts","sourceRoot":"","sources":["../../src/core/ws2SendWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;+CAE+C;AAC/C,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAEtD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAOxD,CAAC;AAEH,uDAAuD;AACvD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAC;AAEjE,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAI1D;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6FAA6F;IAC7F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,EAAE,EAAE,OAAO,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAW9F"}

package/dist/core/ws2SendWiring.js

@@ -0,0 +1,71 @@
+/**
+ * ws2SendWiring — the SEND-side wiring manifest + the wiring-integrity ratchet
+ * (WS2 send-side, docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md §6/§7).
+ *
+ * THE INVARIANT THIS ENFORCES: every replicated store registered in the
+ * `ReplicatedKindRegistry` (the RECEIVE/advert half) must be CONSCIOUSLY classified
+ * as either SEND-WIRED (its manager's emit hooks are attached to the journal-backed
+ * emitter) or SEND-PENDING (a known, enumerated follow-up). A new replicated kind
+ * added to the registry WITHOUT placing it in one of these sets fails the ratchet —
+ * which is the EXACT gap this workstream fixes: a kind shipped receive-only (advert +
+ * apply machinery) with the SEND half silently a no-op. The ratchet makes that a CI
+ * failure, not a memory item (Structure > Willpower).
+ *
+ * Pure data + a pure check — no I/O, no deps. The server's wiring + the
+ * wiring-integrity test BOTH read these sets, so they cannot drift.
+ */
+/** Stores whose manager emit hooks ARE attached to the journal-backed emitter (their
+ *  records actually cross). The learnings slice ships first; the other seamed stores
+ *  follow on the SAME emitter (WS2-SEND-2). */
+export const WS2_SEND_WIRED_STORES = Object.freeze([
+    'learnings',
+]);
+/**
+ * Stores registered for RECEIVE but whose SEND wiring is a KNOWN, enumerated
+ * follow-up — NOT a silent omission. Each is here for a stated reason:
+ *  - relationships / knowledge / evolutionActions / userRegistry: fully seamed
+ *    managers (emitPut + emitDelete); table-row wiring onto the same emitter (WS2-SEND-2).
+ *  - topicOperator: seamed put-only (no emitDelete in its manager interface yet) (WS2-SEND-3).
+ *  - preferences: NO manager emit seam yet — it rode the deprecated `preferences-sync`
+ *    verb; needs a manager emit hook before it can be wired (WS2-SEND-3).
+ */
+export const WS2_SEND_PENDING_STORES = Object.freeze([
+    'relationships',
+    'knowledge',
+    'evolutionActions',
+    'userRegistry',
+    'topicOperator',
+    'preferences',
+]);
+/** Classify a registered store's send-wiring status. */
+export function ws2SendStatus(store) {
+    if (WS2_SEND_WIRED_STORES.includes(store))
+        return 'wired';
+    if (WS2_SEND_PENDING_STORES.includes(store))
+        return 'pending';
+    return 'unclassified';
+}
+/**
+ * Audit a set of registered store keys against the wiring manifest. `ok` is false iff
+ * any registered store is unclassified (neither wired nor pending) — the exact
+ * receive-only gap this workstream closes. Also flags a store in BOTH sets (a manifest
+ * authoring error) as unclassified-style failure via a thrown precondition is avoided;
+ * instead WIRED takes precedence and the overlap is surfaced by the caller's own
+ * disjointness assertion in the test.
+ */
+export function auditWs2SendWiring(registeredStores) {
+    const wired = [];
+    const pending = [];
+    const unclassified = [];
+    for (const store of registeredStores) {
+        const status = ws2SendStatus(store);
+        if (status === 'wired')
+            wired.push(store);
+        else if (status === 'pending')
+            pending.push(store);
+        else
+            unclassified.push(store);
+    }
+    return { wired, pending, unclassified, ok: unclassified.length === 0 };
+}
+//# sourceMappingURL=ws2SendWiring.js.map