instar 1.3.728 → 1.3.730

package/dist/core/PostUpdateMigrator.js

@@ -106,6 +106,13 @@ Two reconcilers keep a multi-machine mesh from drifting into the wrong shape. Bo
 - **When to use** (PROACTIVE — these are the triggers): user asks "why did my conversation move machines by itself?" → read the claim trace (\`logs/stale-owner-release.jsonl\`) + \`GET /pool/placement?topic=N\` and explain the episode honestly. "why did serving move back to the Mini by itself?" → the hand-back reconciler; \`GET /pool/lease-handback\` names the episode + latch state. "is auto-failover healthy?" → \`GET /pool/stale-owner-release\`.
 `;
 }
+export function WRITE_ADMISSION_CLAUDEMD_SECTION(port) {
+    return `\n### Write Admission (⚗️ experimental, dry-run — why did my write get a 409 naming another machine?)
+
+On a multi-machine setup, writes are classified by DOMAIN (machine-local / session-scoped / topic-scoped / cluster-shared) and admitted by ownership instead of the old blanket "standby is read-only" boolean. A write this machine genuinely must not perform gets a TYPED 409 refusal in <2s — \`{ error: "write-refused", code, owner, leaseHolder, retryable }\` with a \`Retry-After\` header — never a hang. Ships dev-gated + dry-run FIRST: while dry, the legacy standby guard keeps enforcing and the layer only logs would-verdicts.
+- Status + per-domain counters + recent refusals + the event-loop-lag gauge: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/write-admission\` (503 when dark). Refusal audit: \`logs/write-admission.jsonl\`.
+- **When to use** (PROACTIVE): a write of mine (or a route like \`POST /evolution/actions\` / \`POST /attention\`) answers 409 \`write-refused\` naming another machine → that state belongs to the named owner; re-send it there — do NOT auto-move the topic (moving is a consent-gated operator decision, the refusal hint is advisory prose). "Are writes hanging or being refused?" → read \`GET /write-admission\` (the eventLoop block attributes hang windows to loop starvation) instead of guessing. A refusal storm surfaces as ONE deduped attention item, never a flood.\n`;
+}
 export function PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION(port) {
     return `\n### Playwright Profile Registry (which browser profile holds which account)
 
@@ -4186,6 +4193,16 @@ setTimeout(() => process.exit(0), 2000);
             patched = true;
             result.upgraded.push('CLAUDE.md: added Mesh Self-Healing (U4.2/U4.4) section');
         }
+        // Write Admission (standby-write-reconciliation §7 migration parity) —
+        // Agent Awareness: existing agents learn the GET /write-admission surface
+        // + the "why did my write get a 409 naming another machine?" proactive
+        // trigger. Honestly tagged experimental/dry-run (Maturity Honesty).
+        // Content-sniffed on the heading.
+        if (!content.includes('Write Admission')) {
+            content += WRITE_ADMISSION_CLAUDEMD_SECTION(port);
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Write Admission section');
+        }
         // Dynamic MCP Lifecycle (DYNAMIC-MCP-LIFECYCLE-SPEC) — Agent Awareness +
         // Migration Parity: existing agents learn the dark/opt-in load-on-demand
         // capability, the /mcp/* surface, the Know-Your-Principal authorization rule,
@@ -4495,6 +4512,7 @@ Rule: I do not state that work landed inside another agent's state unless I have
 - **Quota across ALL my machines** (pool-scope read) — \`GET /subscription-pool?scope=pool\` fans out to every ONLINE peer's plain pool, tags each account with the machine holding it (\`machineId\`/\`machineNickname\`/\`remote:true\`), and merges into ONE dark-peer-tolerant object \`{ enabled, accounts:[...], pool:{ selfMachineId, peersQueried, peersOk, failed }, scope:'pool' }\`. A down/slow/unauth peer is a classified \`pool.failed\` row (normalized reason — never a peer URL or token), never a silent omission and never a 500. Per-machine seat is meaningful, so the SAME account on two machines stays individually visible (never coalesced). Single-machine → the plain self-only view tagged \`scope:'pool'\`. Use this when the operator asks "how much quota is left across ALL my machines?".
 - **Continuity guarantee** — a long session that hits its account's quota resumes on another eligible account (conversation preserved via \`--resume\`), never dies. Manual lever: \`POST /subscription-pool/swap\` \`{"sessionName":"...","exhaustedAccountId":"..."}\`. Auto-swap on rate-limit ships OFF (opt-in via \`subscriptionPool.autoSwapOnRateLimit\` — it moves a live session, real authority).
 - **Pre-limit (proactive) swap** — beyond the reactive swap above, I can move a session OFF an account BEFORE it walls, at a lag-aware measured threshold (default 80% — the polled reading trails real usage, so the swap completes with margin). It also covers the UNTAGGED interactive session (resolves its account from the default login), so the session you talk to doesn't wedge at the wall. Opt-in via \`subscriptionPool.proactiveSwap.enabled\` (same authority as auto-swap, earlier trigger). Status: \`GET /subscription-pool/proactive-swap\`; run a pass now: \`POST /subscription-pool/proactive-swap/check\`.
+- **Anti-thrash brakes + in-flight work protection on swaps** — the proactive swap carries brakes so it can never ping-pong sessions between hot accounts: when EVERY account is hot it STAYS PUT (\`all-hot\` refusal), a just-swapped session dwells ~45 min before it can be moved again (restart-safe via \`state/swap-ledger.jsonl\`), and a swap only executes onto a target that is MATERIALLY cooler on a fresh quota reading. A session mid-turn or carrying live subagents is never killed by an optimization — the swap DEFERS until the work lands (a forced/reactive kill carries a mitigation note enumerating interrupted subagents + re-injecting the last unanswered message). Brakes ship dry-run first (\`subscriptionPool.proactiveSwap.antiThrash.dryRun\`); the work gate's \`subscriptionPool.swapContinuity.enabled\` is restart-required. "Why didn't my session swap?" → \`GET /subscription-pool/proactive-swap\` \`brakes\`/\`deferrals\` blocks name the refusal; "why did my refresh get a session-busy error?" → the work gate refused to kill in-flight work — wait, or re-issue with \`force:true\`.
 - **Enroll a new account from your phone** — \`POST /subscription-pool/enroll\` \`{"id","label","provider","framework","configHome"}\` starts a login and returns a public code/URL (never a token); \`GET /subscription-pool/pending-logins\` is the surface; expired codes are auto-reissued. Mark done with \`POST /subscription-pool/enroll/:id/complete\`.
 - **Dashboard**: the **Subscriptions tab** shows live quota bars (5h + weekly + reset countdown), status, and the Pending Logins panel — share the dashboard URL + PIN.
 - **When to use** (PROACTIVE): "how much quota is left across my accounts?" / "am I about to hit a limit?" → \`GET /subscription-pool\`; the user wants to add another subscription → drive the enrollment wizard (never ask them to paste a token); a long job is at risk of a quota wall → the continuity guarantee + \`/swap\` keep it alive. Single-account pools are a no-op.
@@ -4518,6 +4536,23 @@ Rule: I do not state that work landed inside another agent's state unless I have
                 result.upgraded.push('CLAUDE.md: added Subscription Pool pre-limit (proactive) swap bullet');
             }
         }
+        // Swap-continuity anti-thrash awareness (swap-continuity-antithrash §9).
+        // Existing agents that ALREADY carry the Subscription Pool section won't get
+        // the new bullet from the section-install guard above. Patch it in
+        // idempotently: insert the anti-thrash bullet right after the pre-limit
+        // (proactive) swap bullet when the section exists but the bullet is missing.
+        // Content-sniffed on the distinctive bullet title.
+        if (content.includes('Subscription Pool (multi-account quota') &&
+            content.includes('Pre-limit (proactive) swap') &&
+            !content.includes('Anti-thrash brakes + in-flight work protection')) {
+            const preLimitAnchor = '`GET /subscription-pool/proactive-swap`; run a pass now: `POST /subscription-pool/proactive-swap/check`.';
+            const antiThrashBullet = '\n- **Anti-thrash brakes + in-flight work protection on swaps** — the proactive swap carries brakes so it can never ping-pong sessions between hot accounts: when EVERY account is hot it STAYS PUT (`all-hot` refusal), a just-swapped session dwells ~45 min before it can be moved again (restart-safe via `state/swap-ledger.jsonl`), and a swap only executes onto a target that is MATERIALLY cooler on a fresh quota reading. A session mid-turn or carrying live subagents is never killed by an optimization — the swap DEFERS until the work lands (a forced/reactive kill carries a mitigation note enumerating interrupted subagents + re-injecting the last unanswered message). Brakes ship dry-run first (`subscriptionPool.proactiveSwap.antiThrash.dryRun`); the work gate\'s `subscriptionPool.swapContinuity.enabled` is restart-required. "Why didn\'t my session swap?" → `GET /subscription-pool/proactive-swap` `brakes`/`deferrals` blocks name the refusal; "why did my refresh get a session-busy error?" → the work gate refused to kill in-flight work — wait, or re-issue with `force:true`.';
+            if (content.includes(preLimitAnchor)) {
+                content = content.replace(preLimitAnchor, preLimitAnchor + antiThrashBullet);
+                patched = true;
+                result.upgraded.push('CLAUDE.md: added Subscription Pool anti-thrash brakes + work-gate bullet');
+            }
+        }
         // WS5.1 pool-scope read awareness. Existing agents that ALREADY carry the
         // Subscription Pool section won't get the new bullet from the section-install
         // guard above. Patch it in idempotently: insert the pool-scope bullet right