wicked-crew 0.15.1 → 0.15.3

package/dist/api/gate-cache.d.ts

@@ -25,6 +25,14 @@ export interface GateCacheEntry {
      * ABSENT when the engine did not say (an older engine, a row written before the field).
      */
     gateKind?: string;
+    /**
+     * The answer tokens the engine offered (`awaitingHuman.choices`; issue #969) — e.g. a
+     * `team_dispute` gate's `['approve', 'request_changes', 'reject']`. Without them a client that
+     * missed the live frame could draw only Approve/Reject. ABSENT when the engine offered none.
+     */
+    choices?: string[];
+    /** The index into `choices` of the engine's recommended answer. ABSENT without `choices`. */
+    recommended?: number;
 }
 /**
  * Detect whether a gate prompt is a PURE sandbox/tool refusal — the worker reporting it could not
@@ -41,6 +49,41 @@ export declare function detectRefusal(text: string): {
     matched: boolean;
     reason: string;
 } | undefined;
+/**
+ * The answer set an `awaitingHuman` frame offered, kept only when well-formed (issue #969):
+ * `choices` must be a non-empty array of strings, and `recommended` an integer index inside it.
+ * A malformed value is dropped rather than served — a skin would render it as buttons. Spread the
+ * result, so a gate the engine offered nothing on stays byte-identical on the wire.
+ */
+export declare function offeredChoices(event: CoreEvent): {
+    choices?: string[];
+    recommended?: number;
+};
+/**
+ * The open gate a run's event history records, or `undefined` — the last `awaitingHuman` not
+ * followed by a resumed/terminal event. `events` is the run's log oldest-first. Pure: the same
+ * `fold` the live stream uses, over a scratch map, so a replay cannot disagree with what the live
+ * stream would have produced from the same events (FINDING-051).
+ */
+export declare function replayOpenGate(runId: string, events: CoreEvent[]): GateCacheEntry | undefined;
+/**
+ * What one read of a run's open gate from the record yields: the gate; `null` (the record holds
+ * no open gate); `'no-log'` (this build cannot read the log, so nothing can be said);
+ * `'ambiguous'` (the engine's open gate rows disagree on the ord, so the record cannot say which
+ * gate is open — crew#1083 round 5).
+ */
+export type GateRead = GateCacheEntry | null | 'no-log' | 'ambiguous';
+/**
+ * What `GateCache.resolve` yields: a read's result, or `'unstable'` — live gate events kept landing
+ * while the record was read, so nothing could be verified (crew#1083 round 3). Retryable.
+ */
+export type GateResolution = GateRead | 'unstable';
+/** Narrows a resolution to an open gate: `null`, `'no-log'`, `'ambiguous'` and `'unstable'` are not one. */
+export declare function isOpenGate(resolution: GateResolution | undefined): resolution is GateCacheEntry;
+/** The one log call the cache makes (`resolve`): `console` by default, the daemon's logger in `server.ts`. */
+export interface GateCacheLog {
+    warn(message: string): void;
+}
 /**
  * Gate-prompt cache over a durable log (DES-STUDIO-001 §3.3).
  *
@@ -52,8 +95,9 @@ export declare function detectRefusal(text: string): {
  * prune-only, so a daemon restart dropped the map and **nothing could put an entry back**. A parked
  * run then kept holding the operator without being able to say what it was asking. The prompt was
  * never actually lost — core records `awaitingHuman` to the event log (core#139) — it was simply
- * never read. `rebuild` is that read, which demotes this map to what it was always meant to be: a
- * latency optimisation, not the system of record.
+ * never read. `resolve`, fed the route's read of the durable row and the log, is that read, which
+ * demotes this map to what it was always meant to be: a latency optimisation, not the system of
+ * record.
  *
  * NOTE: the full HITL lifecycle from §3.3 (advisory / hard-expiry timers, append-only message log,
  * auto-cancel-on-expiry, synthesized `gateLifecycle` frames) is a deliberate follow-on. This
@@ -61,30 +105,67 @@ export declare function detectRefusal(text: string): {
  * always `open`.
  */
 export declare class GateCache {
+    private readonly log;
     private readonly entries;
+    /**
+     * Per-run count of the LIVE gate-opening and gate-closing events `ingest` has folded. `resolve`
+     * compares it across an async read of the record: a read some event overlapped is run again,
+     * never adopted. Never pruned — one number per run seen.
+     */
+    private readonly revisions;
+    constructor(log?: GateCacheLog);
     /** Fold one live CoreEvent into the cache. */
     ingest(event: CoreEvent): void;
+    private revision;
     /**
-     * Rebuild one run's gate from its durable event history and adopt the result (FINDING-051).
+     * The run's open gate: the cached entry, else what `read` finds in the record — the durable row,
+     * the log — adopted and returned once a read completes with no live gate event of the run's
+     * having landed meanwhile. `read` must not consult this cache: it is run again when one does.
+     *
+     * Neither side of such an overlap is known to be the newer (crew#1083 review). The record may
+     * have moved on since the read began — a live `awaitingHuman` for the next gate while an older
+     * row was being read — or the engine's pump may have delivered an OLDER frame late: an
+     * `awaitingHuman` for a gate the row already shows answered, or that gate's `resumed`. The
+     * revision counts arrivals, not order, so the cache cannot pick a winner; the first cut let the
+     * live side win and served a late ord-3 frame over a current ord-4 row, which let a decision
+     * naming ord 3 pass the gate check and answer ord 4. So no winner is picked. The read is run
+     * again, from scratch: the engine writes the row with the pause, so a re-read begun after the
+     * overlapping frame arrived reflects whatever that frame announced, and the first read that
+     * completes with nothing having landed is adopted.
      *
-     * `events` is the run's log oldest-first. Folding all of it yields the last `awaitingHuman` not
-     * followed by a resumed/terminal event — i.e. an open gate, or nothing.
+     * A clean read is the record's word in BOTH directions (crew#1083 round 3): a gate it finds
+     * replaces whatever an overlapped `ingest` folded meanwhile, and "no open gate" / "cannot read"
+     * EVICTS it — otherwise a late frame folded during attempt one outlived the clean attempt two
+     * that found its gate already answered, and was served as a cache hit, unread, from then on. A
+     * read that throws evicts the same way. After `RESOLVE_ATTEMPTS` overlapped reads nothing was
+     * verified, so nothing is served: the entry is evicted and the result is `'unstable'`, never the
+     * unverified entry — an ordinary ordered backlog (`awaitingHuman(2)`, `resumed(2)`,
+     * `awaitingHuman(3)`, one landing per read) left the cache holding ord 3 while every read found
+     * ord 4. The run is logged once.
      *
-     * Deliberately does NOT cross-check the run's live status first: that costs a `sessionsDetail()`
-     * on a read path, and the write side is already guarded — approving a run that has moved on is
-     * refused by the `status === 'awaiting_human'` check on `POST /runs/:id/gate`. So the worst a
-     * stale replay can do is show a prompt that then declines to be approved, and `reconcile` drops
-     * it on the next list. The failure mode is a confusing read, never a bad write.
+     * One read in flight per run (agy, round 4): while a read is running, an entry a live frame
+     * folds is unverified, so a concurrent `resolve` awaits the read in flight instead of taking the
+     * entry as a hit, and the entry is evicted before a re-read so a `get` meanwhile serves nothing
+     * unverified either.
+     */
+    resolve(runId: string, read: () => Promise<GateRead>): Promise<GateResolution>;
+    /** In-flight resolutions per run: `resolve` hands every concurrent caller the same one. */
+    private readonly inflight;
+    private hydrate;
+    /**
+     * The cached open gate for a run, if any — and nothing while a read of it is in flight: an entry
+     * a live frame folded meanwhile is unverified until that read settles, so a sync caller (the GET
+     * route's hit path, a steering prompt) falls through to `resolve` and waits (agy, round 4).
      */
-    rebuild(runId: string, events: CoreEvent[]): GateCacheEntry | undefined;
-    /** The cached open gate for a run, if any. */
     get(runId: string): GateCacheEntry | undefined;
     /**
-     * Adopt an entry hydrated from the DURABLE `interaction_requests` table (DES-PROJECT-001
-     * §5.3). With that table, this cache is finally what its own comments always claimed — a
-     * latency layer over durable truth: the route reads the table on a miss and parks the result
-     * here so the next poll is a map hit. `rebuild` (event-log replay) remains the fallback for
-     * engines predating the table.
+     * Drop the run's cached gate: the engine's record shows another gate open, or none (crew#1083
+     * round 7). The next read hydrates from the record.
+     */
+    forget(runId: string): void;
+    /**
+     * Seed the run's gate synchronously. Nothing can land between the caller's decision and this
+     * set, so it needs no guard; a read that awaited anything goes through `resolve`.
      */
     adopt(runId: string, entry: GateCacheEntry): void;
     /** Drop cache entries whose run is no longer `awaiting_human` (self-healing on reconcile). */

package/dist/api/gate-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoB5F;AAoDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAI9B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS;IAQvE,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIjD,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}
+{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoB5F;AAcD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAM7F;AA4CD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS,CAI7F;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEtE;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,SAAS,GAAG,UAAU,IAAI,cAAc,CAE/F;AAED,8GAA8G;AAC9G,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,SAAS;IASR,OAAO,CAAC,QAAQ,CAAC,GAAG;IARhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;gBAE1B,GAAG,GAAE,YAAsB;IAExD,8CAA8C;IAC9C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAO9B,OAAO,CAAC,QAAQ;IAIhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAYpF,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8C;YAEzD,OAAO;IA0BrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3B;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIjD,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}

package/dist/api/gate-cache.js

@@ -41,6 +41,20 @@ export function detectRefusal(text) {
 function observedAt(event) {
     return new Date(typeof event.ts === 'number' ? event.ts : Date.now()).toISOString();
 }
+/**
+ * The answer set an `awaitingHuman` frame offered, kept only when well-formed (issue #969):
+ * `choices` must be a non-empty array of strings, and `recommended` an integer index inside it.
+ * A malformed value is dropped rather than served — a skin would render it as buttons. Spread the
+ * result, so a gate the engine offered nothing on stays byte-identical on the wire.
+ */
+export function offeredChoices(event) {
+    const choices = event['choices'];
+    if (!Array.isArray(choices) || choices.length === 0 || !choices.every((c) => typeof c === 'string'))
+        return {};
+    const recommended = event['recommended'];
+    const inBounds = Number.isInteger(recommended) && recommended >= 0 && recommended < choices.length;
+    return { choices: [...choices], ...(inBounds ? { recommended: recommended } : {}) };
+}
 /**
  * The one rule that turns an event into a cache mutation.
  *
@@ -49,6 +63,8 @@ function observedAt(event) {
  * free to drift, and the drift would only ever show up after a restart — the exact condition nobody
  * exercises.
  */
+/** The event types `fold` acts on — the ones that open or close a run's gate. */
+const GATE_EVENTS = new Set(['awaitingHuman', 'resumed', 'sessionCompleted', 'runCancelled', 'sessionFailed']);
 function fold(entries, event) {
     const session = typeof event.session === 'string' ? event.session : undefined;
     if (session === undefined)
@@ -66,6 +82,7 @@ function fold(entries, event) {
                     // Spread only when matched, so a normal gate's entry is byte-identical (no `refusal` key).
                     ...(refusal !== undefined ? { refusal } : {}),
                     ...(gateKind !== undefined ? { gateKind } : {}),
+                    ...offeredChoices(event),
                 });
             }
             break;
@@ -79,6 +96,24 @@ function fold(entries, event) {
             break;
     }
 }
+/**
+ * The open gate a run's event history records, or `undefined` — the last `awaitingHuman` not
+ * followed by a resumed/terminal event. `events` is the run's log oldest-first. Pure: the same
+ * `fold` the live stream uses, over a scratch map, so a replay cannot disagree with what the live
+ * stream would have produced from the same events (FINDING-051).
+ */
+export function replayOpenGate(runId, events) {
+    const replayed = new Map();
+    for (const event of events)
+        fold(replayed, event);
+    return replayed.get(runId);
+}
+/** Narrows a resolution to an open gate: `null`, `'no-log'`, `'ambiguous'` and `'unstable'` are not one. */
+export function isOpenGate(resolution) {
+    return typeof resolution === 'object' && resolution !== null;
+}
+/** How many times `resolve` runs a read that a live gate event overlapped before it stops trying. */
+const RESOLVE_ATTEMPTS = 3;
 /**
  * Gate-prompt cache over a durable log (DES-STUDIO-001 §3.3).
  *
@@ -90,8 +125,9 @@ function fold(entries, event) {
  * prune-only, so a daemon restart dropped the map and **nothing could put an entry back**. A parked
  * run then kept holding the operator without being able to say what it was asking. The prompt was
  * never actually lost — core records `awaitingHuman` to the event log (core#139) — it was simply
- * never read. `rebuild` is that read, which demotes this map to what it was always meant to be: a
- * latency optimisation, not the system of record.
+ * never read. `resolve`, fed the route's read of the durable row and the log, is that read, which
+ * demotes this map to what it was always meant to be: a latency optimisation, not the system of
+ * record.
  *
  * NOTE: the full HITL lifecycle from §3.3 (advisory / hard-expiry timers, append-only message log,
  * auto-cancel-on-expiry, synthesized `gateLifecycle` frames) is a deliberate follow-on. This
@@ -99,42 +135,117 @@ function fold(entries, event) {
  * always `open`.
  */
 export class GateCache {
+    log;
     entries = new Map();
+    /**
+     * Per-run count of the LIVE gate-opening and gate-closing events `ingest` has folded. `resolve`
+     * compares it across an async read of the record: a read some event overlapped is run again,
+     * never adopted. Never pruned — one number per run seen.
+     */
+    revisions = new Map();
+    constructor(log = console) {
+        this.log = log;
+    }
     /** Fold one live CoreEvent into the cache. */
     ingest(event) {
+        if (typeof event.session === 'string' && GATE_EVENTS.has(event.type)) {
+            this.revisions.set(event.session, this.revision(event.session) + 1);
+        }
         fold(this.entries, event);
     }
+    revision(runId) {
+        return this.revisions.get(runId) ?? 0;
+    }
     /**
-     * Rebuild one run's gate from its durable event history and adopt the result (FINDING-051).
+     * The run's open gate: the cached entry, else what `read` finds in the record — the durable row,
+     * the log — adopted and returned once a read completes with no live gate event of the run's
+     * having landed meanwhile. `read` must not consult this cache: it is run again when one does.
      *
-     * `events` is the run's log oldest-first. Folding all of it yields the last `awaitingHuman` not
-     * followed by a resumed/terminal event — i.e. an open gate, or nothing.
+     * Neither side of such an overlap is known to be the newer (crew#1083 review). The record may
+     * have moved on since the read began — a live `awaitingHuman` for the next gate while an older
+     * row was being read — or the engine's pump may have delivered an OLDER frame late: an
+     * `awaitingHuman` for a gate the row already shows answered, or that gate's `resumed`. The
+     * revision counts arrivals, not order, so the cache cannot pick a winner; the first cut let the
+     * live side win and served a late ord-3 frame over a current ord-4 row, which let a decision
+     * naming ord 3 pass the gate check and answer ord 4. So no winner is picked. The read is run
+     * again, from scratch: the engine writes the row with the pause, so a re-read begun after the
+     * overlapping frame arrived reflects whatever that frame announced, and the first read that
+     * completes with nothing having landed is adopted.
      *
-     * Deliberately does NOT cross-check the run's live status first: that costs a `sessionsDetail()`
-     * on a read path, and the write side is already guarded — approving a run that has moved on is
-     * refused by the `status === 'awaiting_human'` check on `POST /runs/:id/gate`. So the worst a
-     * stale replay can do is show a prompt that then declines to be approved, and `reconcile` drops
-     * it on the next list. The failure mode is a confusing read, never a bad write.
+     * A clean read is the record's word in BOTH directions (crew#1083 round 3): a gate it finds
+     * replaces whatever an overlapped `ingest` folded meanwhile, and "no open gate" / "cannot read"
+     * EVICTS it — otherwise a late frame folded during attempt one outlived the clean attempt two
+     * that found its gate already answered, and was served as a cache hit, unread, from then on. A
+     * read that throws evicts the same way. After `RESOLVE_ATTEMPTS` overlapped reads nothing was
+     * verified, so nothing is served: the entry is evicted and the result is `'unstable'`, never the
+     * unverified entry — an ordinary ordered backlog (`awaitingHuman(2)`, `resumed(2)`,
+     * `awaitingHuman(3)`, one landing per read) left the cache holding ord 3 while every read found
+     * ord 4. The run is logged once.
+     *
+     * One read in flight per run (agy, round 4): while a read is running, an entry a live frame
+     * folds is unverified, so a concurrent `resolve` awaits the read in flight instead of taking the
+     * entry as a hit, and the entry is evicted before a re-read so a `get` meanwhile serves nothing
+     * unverified either.
      */
-    rebuild(runId, events) {
-        const replayed = new Map();
-        for (const event of events)
-            fold(replayed, event);
-        const entry = replayed.get(runId);
-        if (entry)
-            this.entries.set(runId, entry);
-        return entry;
+    async resolve(runId, read) {
+        const pending = this.inflight.get(runId);
+        if (pending !== undefined)
+            return pending;
+        const cached = this.entries.get(runId);
+        if (cached)
+            return cached;
+        const resolution = this.hydrate(runId, read).finally(() => {
+            this.inflight.delete(runId);
+        });
+        this.inflight.set(runId, resolution);
+        return resolution;
+    }
+    /** In-flight resolutions per run: `resolve` hands every concurrent caller the same one. */
+    inflight = new Map();
+    async hydrate(runId, read) {
+        for (let attempt = 1; attempt <= RESOLVE_ATTEMPTS; attempt++) {
+            const seen = this.revision(runId);
+            let found;
+            try {
+                found = await read();
+            }
+            catch (err) {
+                this.entries.delete(runId);
+                throw err;
+            }
+            if (this.revision(runId) !== seen) {
+                // Whatever a live frame folded during this read is unverified until the re-read settles.
+                this.entries.delete(runId);
+                continue;
+            }
+            if (isOpenGate(found))
+                this.entries.set(runId, found);
+            else
+                this.entries.delete(runId);
+            return found;
+        }
+        this.entries.delete(runId);
+        this.log.warn(`gate cache: live gate events for run ${runId} overlapped ${RESOLVE_ATTEMPTS} reads of its open gate; nothing verified, serving no gate`);
+        return 'unstable';
     }
-    /** The cached open gate for a run, if any. */
+    /**
+     * The cached open gate for a run, if any — and nothing while a read of it is in flight: an entry
+     * a live frame folded meanwhile is unverified until that read settles, so a sync caller (the GET
+     * route's hit path, a steering prompt) falls through to `resolve` and waits (agy, round 4).
+     */
     get(runId) {
-        return this.entries.get(runId);
+        return this.inflight.has(runId) ? undefined : this.entries.get(runId);
+    }
+    /**
+     * Drop the run's cached gate: the engine's record shows another gate open, or none (crew#1083
+     * round 7). The next read hydrates from the record.
+     */
+    forget(runId) {
+        this.entries.delete(runId);
     }
     /**
-     * Adopt an entry hydrated from the DURABLE `interaction_requests` table (DES-PROJECT-001
-     * §5.3). With that table, this cache is finally what its own comments always claimed — a
-     * latency layer over durable truth: the route reads the table on a miss and parks the result
-     * here so the next poll is a map hit. `rebuild` (event-log replay) remains the fallback for
-     * engines predating the table.
+     * Seed the run's gate synchronously. Nothing can land between the caller's decision and this
+     * set, so it needs no guard; a read that awaited anything goes through `resolve`.
      */
     adopt(runId, entry) {
         this.entries.set(runId, entry);

package/dist/api/gate-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-cache.js","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,UAAU,GAA0C;QACxD,EAAE,EAAE,EAAE,mDAAmD,EAAE,MAAM,EAAE,gCAAgC,EAAE;QACrG,EAAE,EAAE,EAAE,oCAAoC,EAAE,MAAM,EAAE,yBAAyB,EAAE;QAC/E,EAAE,EAAE,EAAE,iDAAiD,EAAE,MAAM,EAAE,sCAAsC,EAAE;QACzG,EAAE,EAAE,EAAE,sEAAsE,EAAE,MAAM,EAAE,uBAAuB,EAAE;QAC/G,EAAE,EAAE,EAAE,sEAAsE,EAAE,MAAM,EAAE,2BAA2B,EAAE;QACnH;YACE,EAAE,EAAE,2FAA2F;YAC/F,MAAM,EAAE,oCAAoC;SAC7C;KACF,CAAC;IACF,sFAAsF;IACtF,MAAM,SAAS,GACb,oWAAoW,CAAC;IAEvW,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAAoC,EAAE,KAAgB;IAClE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnH,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM;oBACjB,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;oBAC7B,2FAA2F;oBAC3F,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,SAAS;IACH,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAa,EAAE,MAAmB;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAa,EAAE,KAAqB;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,SAAS,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CACpF,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"gate-cache.js","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,UAAU,GAA0C;QACxD,EAAE,EAAE,EAAE,mDAAmD,EAAE,MAAM,EAAE,gCAAgC,EAAE;QACrG,EAAE,EAAE,EAAE,oCAAoC,EAAE,MAAM,EAAE,yBAAyB,EAAE;QAC/E,EAAE,EAAE,EAAE,iDAAiD,EAAE,MAAM,EAAE,sCAAsC,EAAE;QACzG,EAAE,EAAE,EAAE,sEAAsE,EAAE,MAAM,EAAE,uBAAuB,EAAE;QAC/G,EAAE,EAAE,EAAE,sEAAsE,EAAE,MAAM,EAAE,2BAA2B,EAAE;QACnH;YACE,EAAE,EAAE,2FAA2F;YAC/F,MAAM,EAAE,oCAAoC;SAC7C;KACF,CAAC;IACF,sFAAsF;IACtF,MAAM,SAAS,GACb,oWAAoW,CAAC;IAEvW,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,OAAO,GAAY,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/G,MAAM,WAAW,GAAY,KAAK,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAK,WAAsB,IAAI,CAAC,IAAK,WAAsB,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3H,OAAO,EAAE,OAAO,EAAE,CAAC,GAAI,OAAoB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED;;;;;;;GAOG;AACH,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/G,SAAS,IAAI,CAAC,OAAoC,EAAE,KAAgB;IAClE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnH,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM;oBACjB,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;oBAC7B,2FAA2F;oBAC3F,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,cAAc,CAAC,KAAK,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAmB;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAgBD,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,UAAsC;IAC/D,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC;AAC/D,CAAC;AAOD,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,SAAS;IASS;IARZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7D;;;;OAIG;IACc,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvD,YAA6B,MAAoB,OAAO;QAA3B,QAAG,GAAH,GAAG,CAAwB;IAAG,CAAC;IAE5D,8CAA8C;IAC9C,MAAM,CAAC,KAAgB;QACrB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,IAA6B;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,2FAA2F;IAC1E,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE/D,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,IAA6B;QAChE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,yFAAyF;gBACzF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;gBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,wCAAwC,KAAK,eAAe,gBAAgB,4DAA4D,CACzI,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAa,EAAE,KAAqB;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,SAAS,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CACpF,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}

package/dist/api/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/api/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,KAAK,EAA8E,MAAM,kBAAkB,CAAC;AAE1H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAKlE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB3C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;IAc9B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CH,CAAC;AACL,eAAO,MAAM,mBAAmB;;IAG5B,+FAA+F;;IAE/F,0FAA0F;;;;;;;;;;EAGnF,CAAC;AACZ,eAAO,MAAM,oBAAoB;;;;;;EAA8C,CAAC;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAG8F,CAAC;AAC9H,eAAO,MAAM,kBAAkB;;;;;;EAA4C,CAAC;AAE5E,eAAO,MAAM,aAAa;;;;;;;;;;;;EAMf,CAAC;AACZ,eAAO,MAAM,cAAc;;;;;;EAA2D,CAAC;AACvF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUiF,CAAC;AACrH,eAAO,MAAM,iBAAiB;;;;;;EAA6D,CAAC;AAC5F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;IACrE,qGAAqG;IACrG,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,yFAAyF;IACzF,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;CACzC;AAiED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA2XhF"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/api/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,KAAK,EAAyF,MAAM,kBAAkB,CAAC;AAErI,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAKlE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB3C,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;IAc9B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CH,CAAC;AACL,eAAO,MAAM,mBAAmB;;IAG5B,+FAA+F;;IAE/F,0FAA0F;;;;;;;;;;EAGnF,CAAC;AACZ,eAAO,MAAM,oBAAoB;;;;;;EAA8C,CAAC;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAG8F,CAAC;AAC9H,eAAO,MAAM,kBAAkB;;;;;;EAA4C,CAAC;AAE5E,eAAO,MAAM,aAAa;;;;;;;;;;;;EAMf,CAAC;AACZ,eAAO,MAAM,cAAc;;;;;;EAA2D,CAAC;AACvF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUiF,CAAC;AACrH,eAAO,MAAM,iBAAiB;;;;;;EAA6D,CAAC;AAC5F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AAEZ,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;IACrE,qGAAqG;IACrG,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,yFAAyF;IACzF,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;CACzC;AAiED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAyYhF"}

package/dist/api/mcp.js

@@ -276,6 +276,9 @@ export function registerMcpRoutes(app, deps) {
         config: { manifest: { statusCodes: [405] } },
         handler: async (_req, reply) => reply.code(405).header('Allow', 'POST').send({ error: 'method_not_allowed' }),
     });
+    // (crew#993) A withdraw-then-change of one server's registration runs under the policies' lock
+    // for that server, the one approve and revoke take. With no policies there are no approvals to race.
+    const exclusive = (name, fn) => (deps.policies === undefined ? fn() : deps.policies.exclusive(name, fn));
     const registry = (reply) => {
         if (deps.registry !== undefined)
             return deps.registry;
@@ -342,16 +345,22 @@ export function registerMcpRoutes(app, deps) {
                 await r.checkEgress(parsed.data.previewHash, allowOrigin);
             }
             const held = parsed.data.previewHash === undefined ? null : r.peekPreview(parsed.data.previewHash);
-            if (held !== null && deps.policies !== undefined) {
-                const tokens = await deps.policies.withdrawnBySave(held);
-                if (tokens.length > 0) {
-                    const rules = await deps.policies.withdraw(tokens).catch((e) => { auditPartial(deps, req, e, tokens); throw e; });
-                    deps.audit.record('mcp.approval.withdrawn', deps.actorOf(req), { detail: { subjects: tokens, rules, why: 'schema_changed' } });
-                    for (const id of rules)
-                        deps.audit.record('governance.rule.upserted', deps.actorOf(req), { detail: { id, source: 'mcp-approval' } });
+            const commit = async () => {
+                if (held !== null && deps.policies !== undefined) {
+                    const tokens = await deps.policies.withdrawnBySave(held);
+                    if (tokens.length > 0) {
+                        const rules = await deps.policies.withdraw(tokens).catch((e) => { auditPartial(deps, req, e, tokens); throw e; });
+                        deps.audit.record('mcp.approval.withdrawn', deps.actorOf(req), { detail: { subjects: tokens, rules, why: 'schema_changed' } });
+                        for (const id of rules)
+                            deps.audit.record('governance.rule.upserted', deps.actorOf(req), { detail: { id, source: 'mcp-approval' } });
+                    }
                 }
-            }
-            const server = await r.save(parsed.data.previewHash, enabledWrites, allowOrigin);
+                return r.save(parsed.data.previewHash, enabledWrites, allowOrigin);
+            };
+            // (crew#993) The withdrawal and the save are one step for the server: an approval for it
+            // waits until the save commits, then is judged against the new registration. With no held
+            // preview the save refuses (409) and nothing is withdrawn, so there is nothing to serialize.
+            const server = held === null ? await commit() : await exclusive(held.name, commit);
             deps.audit.record('mcp.server.saved', deps.actorOf(req), {
                 detail: {
                     name: server.name,
@@ -400,17 +409,21 @@ export function registerMcpRoutes(app, deps) {
         if (r === null)
             return reply;
         try {
-            await r.get(req.params.name); // 404 before anything is withdrawn
-            if (deps.policies !== undefined) {
-                const tokens = await deps.policies.tokensOf(req.params.name);
-                if (tokens.length > 0) {
-                    const rules = await deps.policies.withdraw(tokens).catch((e) => { auditPartial(deps, req, e, tokens); throw e; });
-                    deps.audit.record('mcp.approval.withdrawn', deps.actorOf(req), { detail: { subjects: tokens, rules, why: 'server_removed' } });
-                    for (const id of rules)
-                        deps.audit.record('governance.rule.upserted', deps.actorOf(req), { detail: { id, source: 'mcp-approval' } });
+            // (crew#993) One step for the server, like the save: no approval lands between the
+            // withdrawal and the removal.
+            await exclusive(req.params.name, async () => {
+                await r.get(req.params.name); // 404 before anything is withdrawn
+                if (deps.policies !== undefined) {
+                    const tokens = await deps.policies.tokensOf(req.params.name);
+                    if (tokens.length > 0) {
+                        const rules = await deps.policies.withdraw(tokens).catch((e) => { auditPartial(deps, req, e, tokens); throw e; });
+                        deps.audit.record('mcp.approval.withdrawn', deps.actorOf(req), { detail: { subjects: tokens, rules, why: 'server_removed' } });
+                        for (const id of rules)
+                            deps.audit.record('governance.rule.upserted', deps.actorOf(req), { detail: { id, source: 'mcp-approval' } });
+                    }
                 }
-            }
-            await r.remove(req.params.name);
+                await r.remove(req.params.name);
+            });
             deps.audit.record('mcp.server.removed', deps.actorOf(req), { detail: { name: req.params.name } });
             return { removed: req.params.name };
         }