instar 1.3.1211 → 1.3.1213

package/dist/server/routes.js

@@ -8,7 +8,7 @@ import { Router } from 'express';
 import { telegramFetch } from '../messaging/telegram-egress.js';
 import { emergencyStopUserMessage } from '../messaging/shared/emergencyStopUserMessage.js';
 import { execFileSync } from 'node:child_process';
-import { createHash, timingSafeEqual, randomUUID } from 'node:crypto';
+import { createHash, createHmac, timingSafeEqual, randomBytes, randomUUID } from 'node:crypto';
 import { governor as selfActionGovernorSurface } from '../monitoring/selfaction/governor.js';
 import { classifyActionClaim } from '../core/action-claim.js';
 import { sharedG3SoakLedger, decideLeaseGatedSpawn } from '../core/leaseGatedSpawn.js';
@@ -145,6 +145,8 @@ import { ATTENTION_PRIORITIES, ATTENTION_STATUSES, normalizeAttentionPriority, n
 import { dashboardRefreshFailure } from './DashboardRefreshDiagnostics.js';
 import { formatLocalTimestamp } from '../utils/localTime.js';
 import { evaluateBetweenWindowAdmission } from '../core/BetweenWindowAdmissionGate.js';
+import { signMessage as signAgentMessage, verifyMessage as verifyAgentSignature } from '../core/agentSignatureProvenance.js';
+import { WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE, EchoWindowLedgerStore, ProductionMessageEvidenceAuthority, ProductionRuntimeRegistry, compileWindowSources, createLedger, evaluateFromAuthorities, evaluateClosure, transitionLedger, runNativeAdmissionAdapter, applyWaiver, evaluateLifecycleTick, admissionSnapshotDigest, sourceFreshnessIssues, evaluateLifecycleGuard, deriveFailureRemediation, runWindowLifecyclePostLiveCheck, bindRuntimeAuthority, evaluateExecutor, REQUIRED_WINDOW_DUTIES, WINDOW_DRY_RUN_INVENTORY, } from '../core/WindowLifecycleObligationLedger.js';
 const execFile = promisify(execFileCb);
 /**
  * Per-session continue-ceiling (spec § (b) Outcomes).
@@ -1069,6 +1071,809 @@ export function createRoutes(ctx) {
         });
         return res.status(result.admitted ? 200 : 409).json(result);
     });
+    // @write-domain:machine-local — Echo-only Window-28 lifecycle authority.
+    // Every handler validates immutable agent/scope before touching its local store.
+    const windowRequestScope = (body) => {
+        const b = body;
+        return b?.agentId === WINDOW_LEDGER_AGENT && b.scope === WINDOW_LEDGER_SCOPE && ctx.config.projectName === WINDOW_LEDGER_AGENT;
+    };
+    const windowStore = new EchoWindowLedgerStore(ctx.config.stateDir);
+    const windowNow = () => ctx.windowLifecycleNow?.() ?? new Date().toISOString();
+    const runtimeRegistry = () => new ProductionRuntimeRegistry(() => {
+        const running = ctx.sessionManager.listRunningSessions();
+        const duties = new Map((windowStore.load(WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE)?.obligations ?? []).map(duty => [duty.id, duty]));
+        return (ctx.commitmentTracker?.getAll() ?? []).flatMap(commitment => {
+            if (!commitment.externalKey || !commitment.beaconEnabled)
+                return [];
+            const duty = duties.get(commitment.externalKey);
+            if (!duty || !commitment.createdAt || !Number.isFinite(Date.parse(commitment.createdAt)) || Date.parse(commitment.createdAt) > Date.parse(duty.deadline.dueAt))
+                return [];
+            const session = commitment.sessionEpoch ? running.find(s => s.claudeSessionId === commitment.sessionEpoch) : undefined;
+            const driverPath = commitment.topicId === undefined ? null : path.join(ctx.config.stateDir, 'autonomous', `active-${commitment.topicId}.json`);
+            let driverPresent = false;
+            let driverMatches = false;
+            if (driverPath) {
+                try {
+                    const driver = JSON.parse(fs.readFileSync(driverPath, 'utf8'));
+                    driverPresent = true;
+                    driverMatches = String(driver.topic) === String(commitment.topicId) && driver.windowId === duty.windowId && driver.status !== 'stopped';
+                }
+                catch { /* @silent-fallback-ok — unreadable authority fails closed as not live */ }
+            }
+            const completionMature = commitment.status === 'delivered' && !!commitment.resolvedAt && Date.parse(commitment.resolvedAt) <= Date.parse(windowNow());
+            return [{ executorId: commitment.id, owner: commitment.boundBy ?? 'server:commitment-tracker', kind: 'commitment-beacon', registryCoordinates: `obligation:${commitment.externalKey}`,
+                    enabled: commitment.beaconEnabled === true, dryRun: false, running: !!session, heartbeatAt: commitment.lastHeartbeatAt,
+                    nextAttemptAt: commitment.nextUpdateDueAt, deliversOutput: true, sinkReachable: ctx.telegram !== null,
+                    suppressionActive: commitment.beaconSuppressed === true || commitment.beaconPaused === true,
+                    needsClientDriver: true, driverPresent, driverMatches,
+                    triggerEnabled: commitment.status === 'pending' && !!commitment.checkInAt, durableTriggerState: !!commitment.checkInAt, eligibilityAt: commitment.checkInAt,
+                    assignedAt: commitment.createdAt, completedAt: completionMature ? commitment.resolvedAt : undefined, completionDigest: completionMature ? createHash('sha256').update(`${commitment.id}:${commitment.resolvedAt}:${commitment.deliveryMessageId ?? ''}`).digest('hex') : undefined, deliveryMessageId: commitment.deliveryMessageId, deliveryTopicId: commitment.topicId }];
+        });
+    });
+    const messageEvidenceAuthority = () => new ProductionMessageEvidenceAuthority(path.join(ctx.config.stateDir, 'telegram-messages.jsonl'), (topicId, messageId) => {
+        const row = ctx.telegram?.getTopicHistory(topicId, 1_000).find(item => item.messageId === messageId);
+        if (!row || row.topicId === null)
+            return null;
+        const operator = ctx.topicOperatorStore?.asVerifiedOperator(topicId);
+        const verifiedOperator = !!operator && String(row.telegramUserId) === String(operator.uid) && row.fromUser && row.forwarded === false;
+        return { messageId: row.messageId, topicId: row.topicId, text: row.text, fromUser: row.fromUser, timestamp: row.timestamp, senderUid: row.telegramUserId === undefined ? undefined : String(row.telegramUserId), verifiedOperator, sessionName: row.sessionName, provenance: row.provenance, authorship: row.authorship };
+    });
+    const runtimeSemanticFacts = (obligation) => {
+        if (/^start\.(?:named-worker-lanes|delegation-majority-boundary|machine-model-distribution)$/.test(obligation.id)) {
+            const charterPath = obligation.sourceSpans.map(span => span.source).find(source => /CHARTER/i.test(path.basename(source))) ?? path.join(ctx.config.stateDir, obligation.windowId, `WINDOW-${obligation.windowId.replace(/^w/i, '')}-CHARTER.md`);
+            let charter = '';
+            try {
+                if (charterPath)
+                    charter = fs.readFileSync(charterPath, 'utf8');
+            }
+            catch { /* @silent-fallback-ok — unavailable authority fails closed as empty */ }
+            const laneIds = [...new Set(Array.from(charter.matchAll(/\bLane\s+([A-Z])\b/g), match => match[1]))];
+            const workerRecords = ctx.subagentTracker ? ctx.subagentTracker.listSessions().flatMap(sessionId => ctx.subagentTracker.getSessionRecords(sessionId)).filter(record => /codey|worker/i.test(`${record.agentType} ${record.agentId}`)) : [];
+            const machines = ctx.listPoolMachines?.() ?? [];
+            const blocker = charter.match(/(?:offline|unavailable|memory pressure|blocked)[^.\n]*/i)?.[0] ?? '';
+            const workerAssignments = workerRecords.flatMap(record => { const laneId = record.agentType.match(/lane[- :]+([A-Z])/i)?.[1]?.toUpperCase(); const machineId = record.agentType.match(/machine[- :]+([A-Za-z0-9_-]+)/i)?.[1]; if (!laneId || !machineId || !record.transcriptPath || !record.startedAt || (!record.stoppedAt && !ctx.sessionManager.listRunningSessions().some(session => session.claudeSessionId === record.sessionId)))
+                return []; try {
+                const bytes = fs.readFileSync(record.transcriptPath);
+                if (!bytes.length)
+                    return [];
+                return [{ workerId: record.agentId, laneId, machineId, transcriptHash: createHash('sha256').update(bytes).digest('hex'), transcriptBytes: bytes.length }];
+            }
+            catch { /* @silent-fallback-ok — absent worker transcript is negative authority */
+                return [];
+            } });
+            const poolIds = new Set(machines.map(machine => machine.machineId));
+            const unavailableNamed = blocker.match(/\b(?:laptop|mini|studio|[A-Za-z0-9_-]+)\b/i)?.[0]?.toLowerCase();
+            const machineBlockerVerified = !!blocker && !!unavailableNamed && !machines.some(machine => machine.machineId.toLowerCase() === unavailableNamed || machine.nickname?.toLowerCase() === unavailableNamed) && machines.every(machine => machine.lastKnownUrl !== null);
+            if (obligation.id === 'start.named-worker-lanes')
+                return { laneIds, laneSourceHash: charter ? createHash('sha256').update(charter).digest('hex') : '' };
+            if (obligation.id === 'start.delegation-majority-boundary')
+                return { workerAssignments, offloadedLaneShare: laneIds.length ? new Set(workerAssignments.map(item => item.laneId)).size / laneIds.length : 0, laneIds };
+            return { workerAssignments: workerAssignments.filter(item => poolIds.has(item.machineId)), machineIds: machines.map(machine => machine.machineId), namedBlocker: blocker, machineBlockerVerified };
+        }
+        if (obligation.id === 'continuous.telegram.profile-resolved') {
+            const registry = ctx.playwrightRegistry?.() ?? new PlaywrightProfileRegistry({ stateDir: ctx.config.stateDir, projectDir: ctx.config.projectDir, listVaultNames: () => [] });
+            const resolved = registry.resolve('telegram');
+            const profile = resolved.profile;
+            if (profile && profile.id === obligation.predicate.expected?.profile && resolved.dirExists !== false)
+                return { profile: profile.id, profileAuthority: 'playwright-profile-registry' };
+            return {};
+        }
+        if (obligation.id === 'continuous.telegram.signature-verified') {
+            try {
+                const raw = JSON.parse(fs.readFileSync(path.join(ctx.config.stateDir, 'identity.json'), 'utf8'));
+                if (typeof raw.publicKey !== 'string')
+                    return {};
+                const key = Buffer.from(raw.publicKey, 'base64');
+                const fingerprint = key.toString('hex').slice(0, 32);
+                return key.length === 32 && fingerprint === obligation.predicate.expected?.fingerprint ? { signatureVerified: true, fingerprint } : {};
+            }
+            catch { /* @silent-fallback-ok — missing identity is a fail-closed negative */
+                return {};
+            }
+        }
+        return {};
+    };
+    const verifyEchoSignedOutbound = (row) => {
+        if (row.fromUser || row.authorship !== 'agent-outbound' || row.topicId === null)
+            return null;
+        try {
+            const raw = JSON.parse(fs.readFileSync(path.join(ctx.config.stateDir, 'identity.json'), 'utf8'));
+            if (typeof raw.publicKey !== 'string')
+                return null;
+            const key = Buffer.from(raw.publicKey, 'base64');
+            const verdict = verifyAgentSignature({ raw: row.text, expectedTopicId: row.topicId, resolvePublicKey: agentId => agentId === 'echo' ? key : null, nowSeconds: Math.floor(Date.parse(windowNow()) / 1000) });
+            return verdict.classification === 'agent-verified' && verdict.agentId === 'echo' ? verdict : null;
+        }
+        catch { /* @silent-fallback-ok — signature uncertainty fails closed */
+            return null;
+        }
+    };
+    const isHighLevelSynthesis = (text) => text.trim().length >= 120 && /\b(?:synthesis|summary)\b/i.test(text) && /\b(?:progress|completed|landed)\b/i.test(text) && /\b(?:blocker|risk|none)\b/i.test(text) && /\bnext\b/i.test(text);
+    const parseCanonicalPlanPosition = (markdown) => { const nodeId = markdown.match(/^Node-ID:\s*([A-Za-z0-9_-]+)\s*$/m)?.[1]; const charterId = markdown.match(/^Charter-ID:\s*([A-Za-z0-9_-]+)\s*$/m)?.[1]; const pathIds = markdown.match(/^Leaf-to-root:\s*([A-Za-z0-9_-]+(?:\s*>\s*[A-Za-z0-9_-]+)+)\s*$/m)?.[1]?.split(/\s*>\s*/); return nodeId && charterId && pathIds?.[0] === nodeId && pathIds.at(-1) === 'root' ? { nodeId, charterId, pathIds } : null; };
+    const stallInspectionPath = path.join(ctx.config.stateDir, 'window-lifecycle', 'stall-inspections.jsonl');
+    const remediationPath = path.join(ctx.config.stateDir, 'window-lifecycle', 'remediations.jsonl');
+    const readRemediationEpisodes = () => { try {
+        return fs.readFileSync(remediationPath, 'utf8').trim().split('\n').filter(Boolean).map(line => JSON.parse(line));
+    }
+    catch { /* @silent-fallback-ok — no readable episodes grants no exemption */
+        return [];
+    } };
+    const remediationEpisodeDigest = (obligation) => createHash('sha256').update(JSON.stringify({ windowId: obligation.windowId, obligationId: obligation.id, action: obligation.failureAction, status: obligation.status, evidenceNonces: obligation.evidence.map(item => item.nonce).sort() })).digest('hex');
+    const remediationResolutionIsLive = (obligation, episode) => {
+        if (episode.disposition !== 'resolved-with-live-evidence' || !episode.topicId || !episode.messageId || !episode.evidenceHash || !episode.resolvedAt)
+            return false;
+        const row = ctx.telegram?.getTopicHistory(episode.topicId, 1_000).find(item => item.messageId === episode.messageId);
+        if (!row || Date.parse(row.timestamp) <= Date.parse(episode.createdAt) || Date.parse(row.timestamp) > Date.parse(windowNow()) || createHash('sha256').update(row.text).digest('hex') !== episode.evidenceHash)
+            return false;
+        const remediation = deriveFailureRemediation(obligation);
+        const signed = !row.fromUser ? verifyEchoSignedOutbound(row) : null;
+        const correctedCounts = obligation.failureAction === 'correct-before-report' && /corrected counts?:/i.test(row.text) && /\bsource:/i.test(row.text) && /\b[A-Za-z][\w -]*\s*=\s*\d+\b/.test(row.text);
+        const replacementSynthesis = obligation.failureAction === 'correct-next-synthesis' && isHighLevelSynthesis(row.text);
+        return remediation.repostRequired ? episode.topicId === 43003 && !!signed && row.text.length >= 80 && /\b(?:coordination|assessment|disagreement)\b/i.test(row.text) : remediation.correctionRequired ? episode.topicId === 36966 && !!signed && (correctedCounts || replacementSynthesis) : remediation.scopeReviewRequired && row.fromUser && episode.topicId === 36966 && String(row.telegramUserId) === String(ctx.topicOperatorStore?.asVerifiedOperator(episode.topicId)?.uid) && /\bscope\b/i.test(row.text) && /\b(?:continue|stop|timebox)\b/i.test(row.text);
+    };
+    const stallInspectionDigest = (row) => createHash('sha256').update(JSON.stringify(row)).digest('hex');
+    const readStallInspection = (obligationId) => { try {
+        const rows = fs.readFileSync(stallInspectionPath, 'utf8').trim().split('\n').filter(Boolean).map(line => JSON.parse(line)).reverse();
+        const row = rows.find(item => item.obligationId === obligationId);
+        if (!row)
+            return null;
+        const { inspectionHash, ...payload } = row;
+        return inspectionHash === stallInspectionDigest(payload) ? row : null;
+    }
+    catch { /* @silent-fallback-ok — unreadable inspection cannot prove completion */
+        return null;
+    } };
+    const ensureStallInspection = (obligation) => { if (!/^cadence\.stall-check\.30m@/.test(obligation.id) || Date.parse(windowNow()) > Date.parse(obligation.deadline.dueAt) + obligation.deadline.graceMs || !ctx.watchdog?.isEnabled())
+        return null; const activeSessionIds = ctx.sessionManager.listRunningSessions().map(session => session.tmuxSession).sort(); const observation = ctx.watchdog.inspectSessionsForStall(windowNow()); const watchdogIds = observation.sessions.map(session => session.name).sort(); if (!ctx.watchdog.verifyStallInspection(observation) || !Number.isSafeInteger(observation.pollRevision) || observation.pollRevision < 1 || observation.observedAt !== windowNow() || JSON.stringify(activeSessionIds) !== JSON.stringify(watchdogIds) || observation.sessions.some(session => typeof session.outputObserved !== 'boolean' || typeof session.escalationActive !== 'boolean' || session.decisionEvaluated !== true || typeof session.decisionEvaluatedAt !== 'string' || Date.parse(session.decisionEvaluatedAt) < Date.parse(obligation.deadline.dueAt)))
+        return null; const payload = { obligationId: obligation.id, inspectedAt: observation.observedAt, watchdogPollRevision: observation.pollRevision, watchdogAuthorityEpoch: observation.authorityEpoch, watchdogAuthorityProof: observation.authorityProof, activeSessionIds, inspectedSessionIds: watchdogIds, sessionResults: observation.sessions, watchdogEnabled: true }; const row = { ...payload, inspectionHash: stallInspectionDigest(payload) }; fs.mkdirSync(path.dirname(stallInspectionPath), { recursive: true, mode: 0o700 }); fs.appendFileSync(stallInspectionPath, `${JSON.stringify(row)}\n`, { mode: 0o600 }); return row; };
+    const runtimeCompletionProof = (obligation, real) => { const base = { executorId: real.executorId, completedAt: real.completedAt, completionDigest: real.completionDigest }; if (!/^cadence\.stall-check\.30m@/.test(obligation.id))
+        return { runtimeCompletion: base }; const inspection = readStallInspection(obligation.id); if (!inspection || !ctx.watchdog?.isEnabled())
+        return null; const authorityValid = ctx.watchdog.verifyStallInspection({ observedAt: inspection.inspectedAt, authorityEpoch: inspection.watchdogAuthorityEpoch, pollRevision: inspection.watchdogPollRevision, authorityProof: inspection.watchdogAuthorityProof, sessions: inspection.sessionResults }); return authorityValid ? { runtimeCompletion: base, ...inspection } : null; };
+    const proofPayload = (obligation, extra = {}) => JSON.stringify({ obligationId: obligation.id, verdict: 'pass', sourceHashes: obligation.sourceSpans.map(s => s.hash), ...obligation.predicate.expected, ...runtimeSemanticFacts(obligation), ...extra });
+    const deterministicPayload = (ledger, obligation) => {
+        if (sourceFreshnessIssues(ledger).length)
+            return null;
+        if (obligation.id === 'start.compilation-proof')
+            return REQUIRED_WINDOW_DUTIES.every(d => ledger.compiledObligationIds.includes(d.id)) ? proofPayload(obligation, { compiledIds: ledger.compiledObligationIds }) : null;
+        if (obligation.id === 'continuous.derive-counts')
+            return proofPayload(obligation, { counts: [{ name: 'compiled', value: ledger.compiledObligationIds.length, items: ledger.compiledObligationIds }, { name: 'materialized', value: ledger.obligations.length, items: ledger.obligations.map(o => o.id) }] });
+        if (obligation.id === 'close.plan-staleness-guard') {
+            const planId = obligation.predicate.expected?.canonicalPlanId;
+            const view = planId ? ctx.viewer?.get(planId) : null;
+            const outcome = ledger.obligations.find(o => o.id === 'close.plan-outcome.semantic-diff')?.evidence.find(e => e.verifierPassed);
+            if (!view || !outcome?.verifiedPayload)
+                return null;
+            let proof;
+            try {
+                proof = JSON.parse(outcome.verifiedPayload);
+            }
+            catch { /* @silent-fallback-ok — malformed proof fails closed */
+                return null;
+            }
+            const version = view.updatedAt ?? view.createdAt;
+            if (proof.canonicalPlanId !== planId || proof.planVersionAtOutcome !== version || Date.parse(outcome.timestamp) < Date.parse(version))
+                return null;
+            return proofPayload(obligation, { planNodeId: proof.planNodeId, charterIncluded: proof.charterIncluded, canonicalPlanId: planId, planVersionAtOutcome: version });
+        }
+        if (obligation.id === 'close.consumer-proof') {
+            const check = runWindowLifecyclePostLiveCheck(ledger);
+            return check.passed ? proofPayload(obligation, { consumerObserved: true, consumerCheck: check }) : null;
+        }
+        if (obligation.id === 'close.terminal-census') {
+            const others = ledger.obligations.filter(o => o.id !== obligation.id && o.phase !== 'post-live');
+            if (!others.every(o => ['satisfied', 'waived-for-phase-transition', 'waived-for-debt'].includes(o.status)) || ledger.compiledObligationIds.some(id => !ledger.obligations.some(o => o.id === id)))
+                return null;
+            return proofPayload(obligation, { expectedIds: ledger.compiledObligationIds, actualIds: ledger.obligations.map(o => o.id) });
+        }
+        if (obligation.id === 'postlive.verdict.pass-required') {
+            if (ledger.state !== 'delivered_pending_post_live' || !ledger.obligations.filter(o => o.id !== obligation.id).every(o => ['satisfied', 'waived-for-phase-transition', 'waived-for-debt'].includes(o.status)))
+                return null;
+            const check = runWindowLifecyclePostLiveCheck(ledger);
+            return check.passed ? proofPayload(obligation, { postLivePassed: true, ...check }) : null;
+        }
+        return null;
+    };
+    const evidenceAuthority = () => ({ requery: (record) => {
+            const ledger = windowStore.load(WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE);
+            const native = ledger?.nativeEvaluations.find(item => item.nonce === record.nonce);
+            const obligation = ledger?.obligations.find(o => o.id === record.obligationId);
+            if (record.authority === 'runtime-registry-proof' && obligation) {
+                const real = runtimeRegistry().resolve(obligation.executorBinding.executorId, obligation.id);
+                if (!real)
+                    return null;
+                const requiresCompletion = obligation.predicate.recurring === true || obligation.id.includes('@');
+                let payload;
+                if (requiresCompletion) {
+                    if (!real.completedAt || !real.completionDigest || Date.parse(real.completedAt) > Date.parse(obligation.deadline.dueAt) + obligation.deadline.graceMs)
+                        return null;
+                    const completion = runtimeCompletionProof(obligation, real);
+                    if (!completion)
+                        return null;
+                    payload = proofPayload(obligation, completion);
+                }
+                else {
+                    const bound = bindRuntimeAuthority(obligation, runtimeRegistry());
+                    if (evaluateExecutor(bound, windowNow()).issues.length)
+                        return null;
+                    payload = proofPayload(obligation, { runtimeSnapshot: { executorId: real.executorId, registryCoordinates: real.registryCoordinates, heartbeatAt: real.heartbeatAt, nextAttemptAt: real.nextAttemptAt, running: real.running, driverPresent: real.driverPresent, driverMatches: real.driverMatches } });
+                }
+                if (createHash('sha256').update(payload).digest('hex') !== record.canonicalPayloadHash)
+                    return null;
+                return { ...record, verifierPassed: true, verifiedPayload: payload };
+            }
+            if (record.authority === 'deterministic-replay' && obligation) {
+                const payload = deterministicPayload(ledger, obligation);
+                if (!payload || createHash('sha256').update(payload).digest('hex') !== record.canonicalPayloadHash)
+                    return null;
+                return { ...record, verifierPassed: true, verifiedPayload: payload };
+            }
+            if (record.authority === 'content-bound-store-row' && obligation && record.nativeCoordinates?.storePath) {
+                try {
+                    const bytes = fs.readFileSync(record.nativeCoordinates.storePath);
+                    if (!obligation.sourceSpans.some(s => s.source === record.nativeCoordinates.storePath && s.hash === createHash('sha256').update(bytes).digest('hex')))
+                        return null;
+                    const payload = proofPayload(obligation, { charterExpiry: obligation.predicate.expected?.charterExpiry });
+                    if (createHash('sha256').update(payload).digest('hex') !== record.canonicalPayloadHash)
+                        return null;
+                    return { ...record, verifierPassed: true, verifiedPayload: payload };
+                }
+                catch { /* @silent-fallback-ok — store read uncertainty fails closed */
+                    return null;
+                }
+            }
+            if (record.authority !== 'native-local-store-presence') {
+                const verified = messageEvidenceAuthority().requery(record);
+                if (!verified || !obligation || verified.authority === 'content-bound-store-row')
+                    return verified;
+                const coords = record.nativeCoordinates;
+                const row = coords?.topicId !== undefined && coords.messageId !== undefined ? ctx.telegram?.getTopicHistory(coords.topicId, 1_000).find(item => item.messageId === coords.messageId) : undefined;
+                if (!row)
+                    return null;
+                const agentAuthorship = row.authorship === 'agent-outbound' || row.authorship === 'agent-verified';
+                const assignedProducer = obligation.executorBinding.owner;
+                const producerMatchesAssignment = typeof assignedProducer === 'string' && assignedProducer === record.producer && record.producer === `session:${row.sessionName ?? 'unknown'}`;
+                if (verified.authority === 'verified-operator-approval')
+                    return row.fromUser && row.forwarded === false ? verified : null;
+                if (/^continuous\.telegram\.(?:send-path-classified|signature-verified|act-as-principal-guard)$/.test(obligation.id)) {
+                    const signed = verifyEchoSignedOutbound(row);
+                    if (!signed || row.forwarded !== false || row.topicId !== 36966 || !producerMatchesAssignment)
+                        return null;
+                    return { ...verified, verifiedPayload: proofPayload(obligation, { signedMessageId: row.messageId, signedTopicId: row.topicId, signedAgentId: signed.agentId, signatureVerified: true, principalRiskCleared: true }) };
+                }
+                if (/^cadence\.report\.3h@/.test(obligation.id)) {
+                    if (!agentAuthorship || !producerMatchesAssignment || row.forwarded !== false || row.topicId !== 36966 || !isHighLevelSynthesis(row.text))
+                        return null;
+                    return { ...verified, verifiedPayload: proofPayload(obligation, { deliveredTopicId: row.topicId, deliveryMessageId: row.messageId, reportBodyHash: createHash('sha256').update(row.text).digest('hex'), synthesisSectionsVerified: true }) };
+                }
+                if (/plan-(?:input|position|outcome)/.test(obligation.id)) {
+                    let claim;
+                    try {
+                        claim = JSON.parse(row.text);
+                    }
+                    catch {
+                        return null;
+                    }
+                    const planId = obligation.predicate.expected?.canonicalPlanId;
+                    const view = typeof planId === 'string' ? ctx.viewer?.get(planId) : null;
+                    const position = view ? parseCanonicalPlanPosition(view.markdown) : null;
+                    if (!view || !position || claim.canonicalPlanId !== planId || claim.planNodeId !== position.nodeId || claim.charterIncluded !== true || position.charterId !== obligation.windowId || JSON.stringify(claim.leafToRoot) !== JSON.stringify(position.pathIds))
+                        return null;
+                }
+                const roleOk = obligation.responsibleRole === 'echo' ? agentAuthorship && producerMatchesAssignment : obligation.responsibleRole.startsWith('observer-') ? agentAuthorship && row.topicId === 43003 && producerMatchesAssignment : true;
+                return roleOk ? verified : null;
+            }
+            if (!native || native.windowId !== record.windowId || native.inputHash !== record.canonicalPayloadHash || native.output.admitted !== true)
+                return null;
+            try {
+                const current = fs.readFileSync(native.storePath);
+                if (current.length < native.storeBytesLength || createHash('sha256').update(current.subarray(0, native.storeBytesLength)).digest('hex') !== native.storeHash)
+                    return null;
+            }
+            catch { /* @silent-fallback-ok — native store uncertainty fails closed */
+                return null;
+            }
+            return { ...record, verifierPassed: true, verifiedPayload: JSON.stringify(native.output) };
+        } });
+    const materializeMachineEvidence = (ledger) => {
+        for (const obligation of ledger.obligations.filter(o => ['pending', 'unknown', 'open-unexecuted', 'blocked', 'failed'].includes(o.status) && (!o.eligibleAt || Date.parse(o.eligibleAt) <= Date.parse(windowNow())))) {
+            let payload = null;
+            let producer = '';
+            let storePath;
+            if (obligation.evidencePolicy.requiredAuthority === 'runtime-registry-proof') {
+                const bound = bindRuntimeAuthority(obligation, runtimeRegistry());
+                const real = runtimeRegistry().resolve(bound.executorBinding.executorId, obligation.id);
+                if (!real)
+                    continue;
+                const requiresCompletion = obligation.predicate.recurring === true || obligation.id.includes('@');
+                if (requiresCompletion) {
+                    if (!real.completedAt || !real.completionDigest || Date.parse(real.completedAt) > Date.parse(obligation.deadline.dueAt) + obligation.deadline.graceMs)
+                        continue;
+                    if (/^cadence\.stall-check\.30m@/.test(obligation.id) && !ensureStallInspection(obligation))
+                        continue;
+                    const completion = runtimeCompletionProof(obligation, real);
+                    if (!completion)
+                        continue;
+                    payload = proofPayload(obligation, completion);
+                }
+                else {
+                    if (evaluateExecutor(bound, windowNow()).issues.length)
+                        continue;
+                    payload = proofPayload(obligation, { runtimeSnapshot: { executorId: real.executorId, registryCoordinates: real.registryCoordinates, heartbeatAt: real.heartbeatAt, nextAttemptAt: real.nextAttemptAt, running: real.running, driverPresent: real.driverPresent, driverMatches: real.driverMatches } });
+                }
+                obligation.executorBinding = bound.executorBinding;
+                producer = `executor:${bound.executorBinding.executorId}`;
+            }
+            else if (obligation.evidencePolicy.requiredAuthority === 'deterministic-replay') {
+                payload = deterministicPayload(ledger, obligation);
+                producer = 'server:window-deterministic-replay';
+            }
+            else if (obligation.evidencePolicy.requiredAuthority === 'content-bound-store-row' && /^start\.(?:source-ingestion|window-expiry)/.test(obligation.id) && sourceFreshnessIssues(ledger).length === 0) {
+                storePath = obligation.sourceSpans[0]?.source;
+                payload = proofPayload(obligation, { charterExpiry: obligation.predicate.expected?.charterExpiry });
+                producer = 'server:source-authority';
+            }
+            if (!payload)
+                continue;
+            const digest = createHash('sha256').update(payload).digest('hex');
+            const nonce = `${obligation.evidencePolicy.requiredAuthority}:${digest}`;
+            if (obligation.evidence.some(e => e.nonce === nonce) || ledger.usedNonces.includes(nonce))
+                continue;
+            ledger.usedNonces.push(nonce);
+            obligation.evidence.push({ authority: obligation.evidencePolicy.requiredAuthority, agentId: 'echo', scope: 'echo-window-lifecycle', windowId: ledger.windowId, obligationId: obligation.id, sourceHashes: obligation.sourceSpans.map(s => s.hash), producer, timestamp: windowNow(), nonce, canonicalPayloadHash: digest, verifierPassed: true, verifiedPayload: payload, nativeCoordinates: storePath ? { storePath } : undefined });
+        }
+    };
+    const enforcementStatePath = path.join(ctx.config.stateDir, 'window-lifecycle', 'enforcement-state.json');
+    const shadowAuditPath = path.join(ctx.config.stateDir, 'window-lifecycle', 'shadow-would-block.jsonl');
+    const shadowCensusPath = path.join(ctx.config.stateDir, 'window-lifecycle', 'shadow-audit-census.json');
+    const maturationAuthorityPath = path.join(ctx.config.stateDir, 'window-lifecycle', 'maturation-authority.json');
+    const maturationAuthority = (() => { try {
+        const value = JSON.parse(fs.readFileSync(maturationAuthorityPath, 'utf8'));
+        const key = Buffer.from(value.key, 'base64');
+        if (!value.epoch || key.length !== 32)
+            throw new Error('invalid');
+        return { epoch: value.epoch, key };
+    }
+    catch { /* @silent-fallback-ok — first boot creates the machine-local authority */
+        const value = { epoch: randomUUID(), key: randomBytes(32) };
+        fs.mkdirSync(path.dirname(maturationAuthorityPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(maturationAuthorityPath, `${JSON.stringify({ epoch: value.epoch, key: value.key.toString('base64') })}\n`, { mode: 0o600 });
+        return value;
+    } })();
+    const graduationPath = (kind) => path.join(ctx.config.stateDir, 'window-lifecycle', kind === 'synthetic' ? 'graduation-synthetic.json' : 'graduation-real-window-shadow.json');
+    const signGraduation = (payload) => createHmac('sha256', maturationAuthority.key).update(JSON.stringify(payload)).digest('hex');
+    const validateGraduationReport = (report, kind) => { const { signature, ...payload } = report; const authoritativeWindow = kind === 'synthetic' ? 'synthetic-w28' : 'w28'; return report.lifecycleKind === kind && report.windowId === authoritativeWindow && report.producer === 'server:window-lifecycle-shadow' && report.authorityEpoch === maturationAuthority.epoch && report.falsePasses === 0 && report.falseBlocks === 0 && report.censusComplete === true && report.controlledOmissionBlocked === true && /^[a-f0-9]{64}$/.test(report.ledgerDigest) && /^[a-f0-9]{64}$/.test(report.admissionDigest) && /^[a-f0-9]{64}$/.test(report.closureDigest) && /^[a-f0-9]{64}$/.test(report.auditDigest) && typeof report.controlledOmissionReason === 'string' && report.controlledOmissionReason.includes('predicate') && report.controlledOmissionReason.includes('executor') && Date.parse(report.completedAt) <= Date.parse(windowNow()) && signature === signGraduation(payload); };
+    const readGraduationReports = () => { try {
+        const synthetic = JSON.parse(fs.readFileSync(graduationPath('synthetic'), 'utf8'));
+        const real = JSON.parse(fs.readFileSync(graduationPath('real-window-shadow'), 'utf8'));
+        const distinct = synthetic.lifecycleId !== real.lifecycleId && synthetic.lifecycleRunId !== real.lifecycleRunId && synthetic.ledgerDigest !== real.ledgerDigest && synthetic.auditDigest !== real.auditDigest;
+        return validateGraduationReport(synthetic, 'synthetic') && validateGraduationReport(real, 'real-window-shadow') && distinct ? { synthetic, real } : null;
+    }
+    catch { /* @silent-fallback-ok — absent/invalid reports cannot graduate */
+        return null;
+    } };
+    const saveEnforcementState = (state) => { fs.mkdirSync(path.dirname(enforcementStatePath), { recursive: true, mode: 0o700 }); const tmp = `${enforcementStatePath}.${process.pid}.tmp`; fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 }); fs.renameSync(tmp, enforcementStatePath); };
+    const loadEnforcementState = () => { let state; try {
+        state = JSON.parse(fs.readFileSync(enforcementStatePath, 'utf8'));
+        if (!['off', 'dry-run', 'enforced'].includes(state.mode) || !Number.isFinite(Date.parse(state.startedAt)) || !Number.isFinite(Date.parse(state.expiresAt)))
+            throw new Error('invalid');
+        if (state.mode === 'enforced') {
+            const reports = readGraduationReports();
+            if (!state.graduatedAt || !reports || JSON.stringify(state.evidenceDigests) !== JSON.stringify([reports.synthetic.signature, reports.real.signature])) {
+                state = { mode: 'dry-run', startedAt: state.startedAt, expiresAt: state.expiresAt, fault: 'graduation-authority-invalid' };
+                saveEnforcementState(state);
+            }
+        }
+    }
+    catch { /* @silent-fallback-ok — invalid state fails safe to dry-run and records a durable fault */
+        const startedAt = windowNow();
+        state = { mode: 'dry-run', startedAt, expiresAt: new Date(Date.parse(startedAt) + 14 * 86_400_000).toISOString(), fault: 'invalid-or-missing-enforcement-state' };
+        saveEnforcementState(state);
+    } if (state.mode === 'dry-run' && Date.parse(windowNow()) >= Date.parse(state.expiresAt)) {
+        state = { ...state, mode: 'off', fault: 'dark-window-expired-without-graduation' };
+        saveEnforcementState(state);
+    } return state; };
+    const signCensus = (entry) => createHmac('sha256', maturationAuthority.key).update(JSON.stringify(entry)).digest('hex');
+    const readShadowCensus = () => { try {
+        return JSON.parse(fs.readFileSync(shadowCensusPath, 'utf8'));
+    }
+    catch { /* @silent-fallback-ok — absent census grants no maturation authority */
+        return {};
+    } };
+    const saveShadowCensus = (value) => { fs.mkdirSync(path.dirname(shadowCensusPath), { recursive: true, mode: 0o700 }); const tmp = `${shadowCensusPath}.${process.pid}.tmp`; fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 }); fs.renameSync(tmp, shadowCensusPath); };
+    const initializeShadowCensus = (lifecycleRunId) => { const census = readShadowCensus(); const unsigned = { lifecycleRunId, count: 0, headHash: '0'.repeat(64) }; census[lifecycleRunId] = { ...unsigned, signature: signCensus(unsigned) }; saveShadowCensus(census); };
+    const auditWouldBlock = (action, reasons) => {
+        const ledger = windowStore.load(WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE);
+        if (!ledger)
+            return;
+        let expectedReasons;
+        if (action === 'admission')
+            expectedReasons = evaluateFromAuthorities(ledger.obligations, runtimeRegistry(), evidenceAuthority(), windowNow()).issues;
+        else if (action === 'lifecycle-tick')
+            expectedReasons = evaluateLifecycleTick(structuredClone(ledger), runtimeRegistry(), evidenceAuthority(), windowNow()).issues;
+        else
+            expectedReasons = evaluateLifecycleGuard(ledger, action).reasons;
+        const authorityDigest = createHash('sha256').update(JSON.stringify({ lifecycleRunId: ledger.lifecycleRunId, sourceHashes: ledger.sourceHashes, native: ledger.nativeEvaluations.at(-1) ?? null, obligations: ledger.obligations.map(item => ({ id: item.id, status: item.status, evidence: item.evidence.map(record => ({ nonce: record.nonce, hash: record.canonicalPayloadHash })), executor: item.executorBinding })) })).digest('hex');
+        const census = readShadowCensus();
+        const current = census[ledger.lifecycleRunId];
+        if (!current || current.signature !== signCensus({ lifecycleRunId: current.lifecycleRunId, count: current.count, headHash: current.headHash }))
+            return;
+        const unsigned = { at: windowNow(), mode: 'dry-run', lifecycleRunId: ledger.lifecycleRunId, sequence: current.count + 1, previousHash: current.headHash, action, observedBlock: true, reasons, expectedBlock: expectedReasons.length > 0, expectedReasons, authorityDigest };
+        const adjudicationSignature = createHmac('sha256', maturationAuthority.key).update(JSON.stringify(unsigned)).digest('hex');
+        const rowHash = createHash('sha256').update(JSON.stringify({ ...unsigned, adjudicationSignature })).digest('hex');
+        const row = { ...unsigned, adjudicationSignature, rowHash };
+        fs.mkdirSync(path.dirname(shadowAuditPath), { recursive: true, mode: 0o700 });
+        fs.appendFileSync(shadowAuditPath, `${JSON.stringify(row)}\n`, { mode: 0o600 });
+        const next = { lifecycleRunId: ledger.lifecycleRunId, count: row.sequence, headHash: row.rowHash };
+        census[ledger.lifecycleRunId] = { ...next, signature: signCensus(next) };
+        saveShadowCensus(census);
+    };
+    const produceGraduationReports = (ledger) => {
+        const closure = evaluateClosure(ledger);
+        if (ledger.state !== 'closed_clean' || closure.state !== 'closed_clean' || !ledger.admissionEvaluatedAt || !ledger.nativeEvaluations.length)
+            return false;
+        const kind = ledger.windowId === 'synthetic-w28' ? 'synthetic' : ledger.windowId === 'w28' ? 'real-window-shadow' : null;
+        if (!kind)
+            return false;
+        const postLive = runWindowLifecyclePostLiveCheck(ledger);
+        if (!postLive.passed)
+            return false;
+        let runAudits = [];
+        try {
+            runAudits = fs.readFileSync(shadowAuditPath, 'utf8').trim().split('\n').filter(Boolean).map(line => JSON.parse(line)).filter(row => row.lifecycleRunId === ledger.lifecycleRunId);
+        }
+        catch { /* @silent-fallback-ok — signed zero-row census is checked immediately below */ }
+        const censusEntry = readShadowCensus()[ledger.lifecycleRunId];
+        if (!censusEntry || censusEntry.signature !== signCensus({ lifecycleRunId: censusEntry.lifecycleRunId, count: censusEntry.count, headHash: censusEntry.headHash }) || censusEntry.count !== runAudits.length)
+            return false;
+        let expectedPrevious = '0'.repeat(64);
+        if (runAudits.some((row, index) => { const { adjudicationSignature, rowHash, ...unsigned } = row; const computedHash = createHash('sha256').update(JSON.stringify({ ...unsigned, adjudicationSignature })).digest('hex'); const invalid = row.sequence !== index + 1 || row.previousHash !== expectedPrevious || row.mode !== 'dry-run' || typeof row.expectedBlock !== 'boolean' || typeof row.observedBlock !== 'boolean' || !Array.isArray(row.expectedReasons) || !/^[a-f0-9]{64}$/.test(row.authorityDigest) || adjudicationSignature !== createHmac('sha256', maturationAuthority.key).update(JSON.stringify(unsigned)).digest('hex') || rowHash !== computedHash; expectedPrevious = rowHash; return invalid; }) || censusEntry.headHash !== expectedPrevious)
+            return false;
+        const omissionLedger = structuredClone(ledger);
+        omissionLedger.state = 'pre_start_gate';
+        const omissionTarget = omissionLedger.obligations.find(item => item.id === 'start.cadence-commitment');
+        if (!omissionTarget)
+            return false;
+        omissionTarget.status = 'pending';
+        omissionTarget.evidence = [];
+        omissionTarget.executorBinding = { ...omissionTarget.executorBinding, executorId: `controlled-omission:${ledger.lifecycleRunId}`, enabled: false, running: false };
+        const omissionEvaluation = evaluateFromAuthorities(omissionLedger.obligations, runtimeRegistry(), evidenceAuthority(), windowNow());
+        omissionLedger.obligations = omissionEvaluation.obligations;
+        const omissionClosure = evaluateClosure(omissionLedger);
+        const omissionReasons = [...omissionEvaluation.issues.filter(reason => reason.startsWith(`${omissionTarget.id}:`)), ...omissionClosure.issues.filter(reason => reason.includes(omissionTarget.id))];
+        const predicateRefused = omissionReasons.some(reason => reason.includes('predicate'));
+        const executorRefused = omissionReasons.some(reason => reason.includes('executor'));
+        const omissionObservedBlock = predicateRefused && executorRefused && !omissionEvaluation.admitted && omissionClosure.state === 'close_blocked';
+        if (!omissionObservedBlock)
+            return false;
+        const omissionReason = [...new Set(omissionReasons)].join(';');
+        const adjudicatedComparisons = [{ lifecycleRunId: ledger.lifecycleRunId, check: 'closed-clean-positive', expectedBlock: false, observedBlock: closure.state !== 'closed_clean', reasons: closure.issues }, { lifecycleRunId: ledger.lifecycleRunId, check: 'controlled-completion-omission', expectedBlock: true, observedBlock: omissionObservedBlock, reasons: omissionReasons }];
+        const comparisons = [...runAudits, ...adjudicatedComparisons];
+        const typed = [...runAudits, ...adjudicatedComparisons];
+        const falsePasses = typed.filter(item => item.expectedBlock === true && item.observedBlock !== true).length;
+        const falseBlocks = typed.filter(item => item.expectedBlock === false && item.observedBlock === true).length;
+        const censusComplete = ledger.compiledObligationIds.length === ledger.obligations.length && new Set(ledger.compiledObligationIds).size === ledger.compiledObligationIds.length && ledger.compiledObligationIds.every(id => ledger.obligations.some(item => item.id === id));
+        const ledgerDigest = createHash('sha256').update(JSON.stringify(ledger)).digest('hex');
+        const closureDigest = createHash('sha256').update(JSON.stringify(closure)).digest('hex');
+        const auditDigest = createHash('sha256').update(JSON.stringify(comparisons)).digest('hex');
+        const admissionDigest = createHash('sha256').update(JSON.stringify({ evaluatedAt: ledger.admissionEvaluatedAt, native: ledger.nativeEvaluations.at(-1), start: ledger.obligations.filter(item => item.phase === 'pre-start' || item.phase === 'start').map(item => ({ id: item.id, status: item.status, evidence: item.evidence.map(record => record.canonicalPayloadHash) })) })).digest('hex');
+        const payload = { lifecycleId: `${kind}:${ledger.lifecycleRunId}`, lifecycleRunId: ledger.lifecycleRunId, lifecycleKind: kind, windowId: ledger.windowId, completedAt: windowNow(), falsePasses, falseBlocks, censusComplete, controlledOmissionBlocked: omissionObservedBlock, controlledOmissionReason: omissionReason, ledgerDigest, admissionDigest, closureDigest, auditDigest, producer: 'server:window-lifecycle-shadow', authorityEpoch: maturationAuthority.epoch };
+        const report = { ...payload, signature: signGraduation(payload) };
+        fs.writeFileSync(graduationPath(kind), `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 });
+        return validateGraduationReport(report, kind);
+    };
+    ctx.windowLifecycleTick = ctx.config.projectName === WINDOW_LEDGER_AGENT ? () => {
+        const enforcement = loadEnforcementState();
+        if (enforcement.mode === 'off')
+            return;
+        const ledger = windowStore.load(WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE);
+        if (!ledger)
+            return;
+        if (ledger.state === 'closed_clean')
+            return;
+        if (ledger.state === 'closed_with_operator_waiver' || ledger.state === 'rolled_back')
+            return;
+        const stale = sourceFreshnessIssues(ledger);
+        if (stale.length) {
+            ledger.admission = undefined;
+            ledger.state = ledger.state.startsWith('active') ? 'active_mid_blocked' : ['close_due', 'delivered_pending_post_live', 'close_blocked'].includes(ledger.state) ? 'close_blocked' : 'start_blocked';
+            ledger.surfacedIssues ??= [];
+            const novelStale = stale.filter(issue => !ledger.surfacedIssues.includes(issue));
+            ledger.surfacedIssues.push(...novelStale);
+            windowStore.save(ledger);
+            if (novelStale.length && ctx.telegram)
+                void ctx.telegram.sendToTopic(43003, `Window lifecycle source authority changed:\n${novelStale.map(v => `- ${v}`).join('\n')}`, { provenance: 'automation' }).catch(error => { /* @silent-fallback-ok — delivery failure is logged; the durable block remains authoritative */ console.warn('[window-lifecycle] stale-source escalation failed:', error); });
+            return;
+        }
+        materializeMachineEvidence(ledger);
+        const result = evaluateLifecycleTick(ledger, runtimeRegistry(), evidenceAuthority(), windowNow());
+        result.ledger.surfacedIssues ??= [];
+        const novel = result.issues.filter(issue => !result.ledger.surfacedIssues.includes(issue));
+        result.ledger.surfacedIssues.push(...novel);
+        windowStore.save(result.ledger);
+        const episodes = readRemediationEpisodes();
+        const novelRemediations = (enforcement.mode === 'enforced' ? (result.ledger.requiredRemediations ?? []) : []).filter(remediation => { const duty = result.ledger.obligations.find(item => item.id === remediation.obligationId); if (!duty)
+            return false; const digest = remediationEpisodeDigest(duty); return !episodes.some(item => item.episodeDigest === digest); });
+        for (const remediation of novelRemediations) {
+            const duty = result.ledger.obligations.find(item => item.id === remediation.obligationId);
+            const episodeDigest = remediationEpisodeDigest(duty);
+            const remediationId = randomUUID();
+            const marker = `remediation:${remediationId}`;
+            result.ledger.surfacedIssues.push(marker);
+            fs.mkdirSync(path.dirname(remediationPath), { recursive: true, mode: 0o700 });
+            fs.appendFileSync(remediationPath, `${JSON.stringify({ remediationId, episodeDigest, obligationId: remediation.obligationId, action: remediation.action, owner: duty.responsibleRole, reason: duty.statement, createdAt: windowNow(), disposition: remediation.debtRequired ? 'registered-debt' : 'awaiting-authoritative-evidence', resolutionRoute: remediation.debtRequired ? undefined : `/window-lifecycle/remediation/${encodeURIComponent(remediation.obligationId)}/resolve` })}\n`, { mode: 0o600 });
+            if (remediation.observerTopicId && ctx.telegram) {
+                const verb = remediation.repostRequired ? 'Visible repost required' : remediation.scopeReviewRequired ? 'Operator scope/timebox review required' : remediation.correctionRequired ? 'Correction required before delivery' : remediation.debtRequired ? 'Debt registered' : 'Lifecycle duty blocked';
+                void ctx.telegram.sendToTopic(remediation.observerTopicId, `${verb}: ${remediation.obligationId} (${remediation.action}); remediation ${remediationId}`, { provenance: 'automation' }).catch(error => console.warn('[window-lifecycle] remediation delivery failed:', error));
+            }
+        }
+        if (novelRemediations.length)
+            windowStore.save(result.ledger);
+        if (enforcement.mode === 'dry-run' && novel.length)
+            auditWouldBlock('lifecycle-tick', novel);
+        if (novel.length && ctx.telegram)
+            void ctx.telegram.sendToTopic(43003, `Window lifecycle ${enforcement.mode === 'dry-run' ? 'shadow would block' : 'enforcement blocked progress'}:\n${novel.slice(0, 12).map(v => `- ${v}`).join('\n')}`, { provenance: 'automation' }).catch(error => console.warn('[window-lifecycle] escalation delivery failed:', error));
+    } : null;
+    router.post('/window-lifecycle/compile', (req, res) => {
+        if (!windowRequestScope(req.body))
+            return res.status(403).json({ error: 'echo-scope-required' });
+        const windowId = typeof req.body.windowId === 'string' && /^[a-z0-9-]{1,40}$/i.test(req.body.windowId) ? req.body.windowId : null;
+        if (!windowId)
+            return res.status(400).json({ error: 'valid windowId required' });
+        const charterPath = path.join(ctx.config.stateDir, windowId, `WINDOW-${windowId.replace(/^w/i, '')}-CHARTER.md`);
+        try {
+            const compiled = compileWindowSources({ agentId: 'echo', scope: 'echo-window-lifecycle', windowId, tenetsPath: path.join(ctx.config.projectDir, '.instar', 'TENETS.md'), charterPath, now: windowNow() });
+            const ledger = createLedger({ agentId: 'echo', scope: 'echo-window-lifecycle', windowId, compiled });
+            windowStore.save(ledger);
+            initializeShadowCensus(ledger.lifecycleRunId);
+            return res.status(201).json(ledger);
+        }
+        catch (error) { /* @silent-fallback-ok — compilation refusal is returned explicitly as HTTP 409 */
+            return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    router.post('/window-lifecycle/evidence', (req, res) => {
+        if (!windowRequestScope(req.body))
+            return res.status(403).json({ error: 'echo-scope-required' });
+        const ledger = windowStore.load('echo', 'echo-window-lifecycle');
+        if (!ledger)
+            return res.status(404).json({ error: 'ledger-not-found' });
+        const obligation = ledger.obligations.find(o => o.id === req.body.obligationId);
+        if (!obligation)
+            return res.status(404).json({ error: 'obligation-not-found' });
+        const topicId = Number(req.body.topicId);
+        const messageId = Number(req.body.messageId);
+        const requested = req.body.authority === 'verified-operator-approval' ? 'verified-operator-approval' : req.body.authority === 'live-requeried-message' ? 'live-requeried-message' : 'content-bound-store-row';
+        const live = ctx.telegram?.getTopicHistory(topicId, 1_000).find(item => item.messageId === messageId);
+        if (!live)
+            return res.status(409).json({ error: 'live-message-not-found' });
+        const producer = live.fromUser ? (live.telegramUserId === undefined ? 'telegram:unknown' : `telegram:${live.telegramUserId}`) : `session:${live.sessionName ?? 'unknown'}`;
+        const agentAuthorship = live.authorship === 'agent-outbound' || live.authorship === 'agent-verified';
+        const assignedProducer = obligation.executorBinding.owner;
+        const producerMatchesAssignment = typeof assignedProducer === 'string' && assignedProducer === producer;
+        const signedTelegramGuard = /^continuous\.telegram\.(?:send-path-classified|signature-verified|act-as-principal-guard)$/.test(obligation.id);
+        const operatorReport = /^cadence\.report\.3h@/.test(obligation.id) && topicId === 36966;
+        const roleMatches = signedTelegramGuard ? !!verifyEchoSignedOutbound(live) && producerMatchesAssignment : operatorReport ? agentAuthorship && producerMatchesAssignment : obligation.responsibleRole === 'echo' ? agentAuthorship && producerMatchesAssignment : obligation.responsibleRole.startsWith('observer-') ? agentAuthorship && topicId === 43003 && producerMatchesAssignment : true;
+        if (requested === 'live-requeried-message' && !roleMatches)
+            return res.status(409).json({ error: 'responsible-role-mismatch', expected: obligation.responsibleRole });
+        const nonce = randomUUID();
+        const candidate = { authority: requested, agentId: 'echo', scope: 'echo-window-lifecycle', windowId: ledger.windowId, obligationId: obligation.id, sourceHashes: obligation.sourceSpans.map(s => s.hash), producer, timestamp: live.timestamp, nonce, canonicalPayloadHash: createHash('sha256').update(live.text).digest('hex'), verifierPassed: false, nativeCoordinates: { topicId, messageId } };
+        const verified = evidenceAuthority().requery(candidate);
+        if (!verified)
+            return res.status(409).json({ error: 'evidence-verification-failed' });
+        if (ledger.usedNonces.includes(nonce))
+            return res.status(409).json({ error: 'nonce-replay' });
+        ledger.usedNonces.push(nonce);
+        obligation.evidence.push(verified);
+        obligation.status = 'satisfied';
+        ledger.admission = undefined;
+        windowStore.save(ledger);
+        return res.status(201).json(verified);
+    });
+    router.post('/window-lifecycle/evaluate', (req, res) => {
+        if (!windowRequestScope(req.body))
+            return res.status(403).json({ error: 'echo-scope-required' });
+        const ledger = windowStore.load('echo', 'echo-window-lifecycle');
+        if (!ledger)
+            return res.status(404).json({ error: 'ledger-not-found' });
+        const stale = sourceFreshnessIssues(ledger);
+        if (stale.length)
+            return res.status(409).json({ admitted: false, state: 'start_blocked', issues: stale });
+        const native = ledger.nativeEvaluations.at(-1)?.output;
+        if (native?.admitted !== true)
+            return res.status(409).json({ admitted: false, state: 'start_blocked', issues: ['native-structural-preflight-missing-or-refused'] });
+        materializeMachineEvidence(ledger);
+        const result = evaluateFromAuthorities(ledger.obligations, runtimeRegistry(), evidenceAuthority(), windowNow());
+        ledger.obligations = result.obligations;
+        ledger.state = result.admitted ? 'active_start' : 'start_blocked';
+        ledger.admissionEvaluatedAt = windowNow();
+        ledger.admission = result.admitted ? { admitted: true, evaluatedAt: ledger.admissionEvaluatedAt, snapshotDigest: admissionSnapshotDigest(ledger) } : undefined;
+        windowStore.save(ledger);
+        if (!result.admitted && loadEnforcementState().mode === 'dry-run')
+            auditWouldBlock('admission', result.issues);
+        return res.status(result.admitted ? 200 : 409).json({ ...result, state: ledger.state });
+    });
+    router.post('/window-lifecycle/tick', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const ledger = windowStore.load('echo', 'echo-window-lifecycle'); if (!ledger)
+        return res.status(404).json({ error: 'ledger-not-found' }); const stale = sourceFreshnessIssues(ledger); if (stale.length) {
+        ctx.windowLifecycleTick?.();
+        return res.status(409).json({ ledger: windowStore.load('echo', 'echo-window-lifecycle'), issues: stale });
+    } materializeMachineEvidence(ledger); const result = evaluateLifecycleTick(ledger, runtimeRegistry(), evidenceAuthority(), windowNow()); windowStore.save(result.ledger); if (req.body.actuateRemediations === true)
+        ctx.windowLifecycleTick?.(); return res.status(result.issues.length ? 409 : 200).json(result); });
+    router.get('/window-lifecycle', (_req, res) => { if (ctx.config.projectName !== 'echo')
+        return res.status(404).json({ error: 'echo-scope-required' }); const ledger = windowStore.load('echo', 'echo-window-lifecycle'); return ledger ? res.json({ ledger, closure: evaluateClosure(ledger) }) : res.status(404).json({ error: 'ledger-not-found' }); });
+    router.post('/window-lifecycle/transition', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const stored = windowStore.load('echo', 'echo-window-lifecycle'); if (!stored)
+        return res.status(404).json({ error: 'ledger-not-found' }); try {
+        const stale = sourceFreshnessIssues(stored);
+        if (stale.length) {
+            ctx.windowLifecycleTick?.();
+            return res.status(409).json({ error: 'source-authority-stale', issues: stale });
+        }
+        materializeMachineEvidence(stored);
+        const checked = evaluateLifecycleTick(stored, runtimeRegistry(), evidenceAuthority(), windowNow()).ledger;
+        const next = transitionLedger(checked, req.body.target, { now: windowNow(), requeryWaiverApproval: waiver => { const evidence = checked.obligations.flatMap(o => o.evidence).find(e => e.authority === 'verified-operator-approval' && e.nativeCoordinates?.topicId === waiver.approvalCoordinates?.topicId && e.nativeCoordinates?.messageId === waiver.approvalCoordinates?.messageId); const verified = evidence ? evidenceAuthority().requery(evidence) : null; return verified?.verifiedPayload?.trim() === `approve waiver ${waiver.digest}`; } });
+        windowStore.save(next);
+        ctx.windowLifecycleTick?.();
+        return res.json(next);
+    }
+    catch (error) {
+        return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+    } });
+    router.post('/window-lifecycle/native-admission', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); try {
+        const current = windowStore.load('echo', 'echo-window-lifecycle');
+        if (!current)
+            return res.status(404).json({ error: 'ledger-not-found' });
+        if (req.body.windowId !== current.windowId)
+            return res.status(409).json({ error: 'wrong-window' });
+        const record = runNativeAdmissionAdapter({ agentId: 'echo', scope: 'echo-window-lifecycle', windowId: current.windowId, stateDir: ctx.config.stateDir, package: req.body.package, nonce: req.body.nonce });
+        const ledger = windowStore.appendNativeEvaluation('echo', 'echo-window-lifecycle', record);
+        const admitted = record.output.admitted === true;
+        if (admitted) {
+            const duty = ledger.obligations.find(o => o.id === 'preground.native-structural-preflight');
+            if (!duty)
+                throw new Error('native-preflight-obligation-missing');
+            duty.evidence.push({ authority: 'native-local-store-presence', agentId: 'echo', scope: 'echo-window-lifecycle', windowId: ledger.windowId, obligationId: duty.id, sourceHashes: duty.sourceSpans.map(s => s.hash), producer: `native:${record.evaluatorVersion}`, timestamp: record.evaluatedAt, nonce: record.nonce, canonicalPayloadHash: record.inputHash, verifierPassed: true, verifiedPayload: JSON.stringify(record.output), nativeCoordinates: { storePath: record.storePath } });
+            duty.status = 'satisfied';
+            windowStore.save(ledger);
+        }
+        ctx.windowLifecycleTick?.();
+        return res.status(admitted ? 200 : 409).json({ record, state: ledger.state });
+    }
+    catch (error) {
+        return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+    } });
+    router.post('/window-lifecycle/waiver', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const ledger = windowStore.load('echo', 'echo-window-lifecycle'); if (!ledger)
+        return res.status(404).json({ error: 'ledger-not-found' }); const waiver = req.body.waiver; const approval = ledger.obligations.flatMap(o => o.evidence).find(e => e.authority === 'verified-operator-approval' && e.nativeCoordinates?.topicId === waiver?.approvalCoordinates?.topicId && e.nativeCoordinates?.messageId === waiver?.approvalCoordinates?.messageId); const verified = approval ? evidenceAuthority().requery(approval) : null; if (!verified || verified.verifiedPayload?.trim() !== `approve waiver ${waiver.digest}`)
+        return res.status(403).json({ error: 'verified-exact-digest-operator-approval-required' }); try {
+        const next = applyWaiver(ledger, waiver, verified.producer);
+        next.admission = undefined;
+        windowStore.save(next);
+        ctx.windowLifecycleTick?.();
+        return res.json(next);
+    }
+    catch (error) { /* @silent-fallback-ok — invalid waiver refusal is returned explicitly as HTTP 409 */
+        return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+    } });
+    router.post('/window-lifecycle/rollback', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const ledger = windowStore.load('echo', 'echo-window-lifecycle'); if (!ledger)
+        return res.status(404).json({ error: 'ledger-not-found' }); const request = req.body.rollback; const approval = ledger.obligations.flatMap(o => o.evidence).find(e => e.authority === 'verified-operator-approval' && e.nativeCoordinates?.topicId === request?.approvalCoordinates?.topicId && e.nativeCoordinates?.messageId === request?.approvalCoordinates?.messageId); if (!approval)
+        return res.status(403).json({ error: 'verified-exact-digest-operator-rollback-required' }); try {
+        return res.json(windowStore.rollback('echo', 'echo-window-lifecycle', request, approval, evidenceAuthority()));
+    }
+    catch (error) {
+        return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+    } });
+    router.post('/window-lifecycle/reenable', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); try {
+        const inventory = [...WINDOW_DRY_RUN_INVENTORY];
+        return res.json(windowStore.reenable('echo', 'echo-window-lifecycle', path.join(ctx.config.stateDir, 'window-lifecycle', 'fault-fixed-evidence.json'), () => { const runner = path.join(ctx.config.projectDir, 'node_modules', '.bin', 'vitest'); const output = withSyncOp(() => execFileSync(runner, ['run', ...inventory], { cwd: ctx.config.projectDir, encoding: 'utf8', timeout: 300_000, maxBuffer: 16 * 1024 * 1024 })); return { passed: true, command: `${runner} run ${inventory.join(' ')}`, completedAt: windowNow(), outputHash: createHash('sha256').update(output).digest('hex'), testInventory: inventory }; }, windowNow()));
+    }
+    catch (error) {
+        return res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+    } });
+    router.get('/window-lifecycle/enforcement', (_req, res) => ctx.config.projectName === 'echo' ? res.json(loadEnforcementState()) : res.status(404).json({ error: 'echo-scope-required' }));
+    router.post('/window-lifecycle/enforcement/record-shadow', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); if (loadEnforcementState().mode !== 'dry-run')
+        return res.status(409).json({ error: 'shadow-recording-requires-dry-run' }); const ledger = windowStore.load('echo', 'echo-window-lifecycle'); if (!ledger)
+        return res.status(404).json({ error: 'ledger-not-found' }); return produceGraduationReports(ledger) ? res.status(201).json({ recorded: true, reports: readGraduationReports() }) : res.status(409).json({ error: 'shadow-lifecycle-incomplete-or-criteria-failed', closure: evaluateClosure(ledger), postLive: runWindowLifecyclePostLiveCheck(ledger) }); });
+    router.post('/window-lifecycle/enforcement/graduate', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const state = loadEnforcementState(); if (state.mode !== 'dry-run')
+        return res.status(409).json({ error: 'graduation-requires-dry-run' }); const reports = readGraduationReports(); if (!reports)
+        return res.status(409).json({ error: 'graduation-authority-evidence-missing-or-invalid' }); const next = { ...state, mode: 'enforced', graduatedAt: windowNow(), evidenceDigests: [reports.synthetic.signature, reports.real.signature] }; saveEnforcementState(next); return res.json(next); });
+    router.post('/window-lifecycle/enforcement/off', (req, res) => { if (!windowRequestScope(req.body))
+        return res.status(403).json({ error: 'echo-scope-required' }); const reason = typeof req.body.reason === 'string' && req.body.reason.trim() ? req.body.reason.trim() : 'operator-disabled'; const next = { ...loadEnforcementState(), mode: 'off', fault: reason }; saveEnforcementState(next); return res.json(next); });
+    router.post('/window-lifecycle/remediation/:obligationId/resolve', (req, res) => {
+        if (!windowRequestScope(req.body))
+            return res.status(403).json({ error: 'echo-scope-required' });
+        const ledger = windowStore.load('echo', 'echo-window-lifecycle');
+        if (!ledger)
+            return res.status(404).json({ error: 'ledger-not-found' });
+        const obligation = ledger.obligations.find(item => item.id === req.params.obligationId);
+        if (!obligation)
+            return res.status(404).json({ error: 'obligation-not-found' });
+        if (!['pending', 'unknown', 'open-unexecuted', 'failed', 'blocked', 'expired'].includes(obligation.status))
+            return res.status(409).json({ error: 'remediation-duty-not-unresolved' });
+        const remediation = deriveFailureRemediation(obligation);
+        if (!remediation.repostRequired && !remediation.correctionRequired && !remediation.scopeReviewRequired)
+            return res.status(409).json({ error: 'remediation-not-evidence-resolvable' });
+        const remediationId = typeof req.body.remediationId === 'string' ? req.body.remediationId : '';
+        const episodes = readRemediationEpisodes();
+        const episode = [...episodes].reverse().find(item => item.remediationId === remediationId && item.obligationId === obligation.id && item.episodeDigest === remediationEpisodeDigest(obligation) && item.disposition === 'awaiting-authoritative-evidence');
+        if (!episode || episodes.some(item => item.remediationId === remediationId && item.disposition === 'resolved-with-live-evidence'))
+            return res.status(409).json({ error: 'active-remediation-episode-required' });
+        const topicId = Number(req.body.topicId);
+        const messageId = Number(req.body.messageId);
+        const row = ctx.telegram?.getTopicHistory(topicId, 1_000).find(item => item.messageId === messageId);
+        if (!row || Date.parse(row.timestamp) <= Date.parse(episode.createdAt) || Date.parse(row.timestamp) > Date.parse(windowNow()))
+            return res.status(409).json({ error: 'fresh-live-remediation-evidence-required' });
+        const artifact = { ...episode, disposition: 'resolved-with-live-evidence', resolvedAt: windowNow(), topicId, messageId, evidenceHash: createHash('sha256').update(row.text).digest('hex') };
+        if (!remediationResolutionIsLive(obligation, artifact))
+            return res.status(409).json({ error: 'remediation-evidence-semantic-mismatch' });
+        fs.appendFileSync(remediationPath, `${JSON.stringify(artifact)}\n`, { mode: 0o600 });
+        return res.json(artifact);
+    });
+    // Echo-only enforcement plane over the production mutation doors declared by
+    // the lifecycle duties. Registered after the lifecycle recovery/evidence
+    // routes so those remain usable while enforcement is blocking progress.
+    router.use((req, res, next) => {
+        if (ctx.config.projectName !== WINDOW_LEDGER_AGENT || req.method !== 'POST')
+            return next();
+        const ledger = windowStore.load(WINDOW_LEDGER_AGENT, WINDOW_LEDGER_SCOPE);
+        if (!ledger)
+            return next();
+        const enforcement = loadEnforcementState();
+        if (enforcement.mode === 'off')
+            return next();
+        const action = /^\/sessions\/(?:spawn|create|refresh|restart-all)|^\/autonomous\/(?:register|native-goal\/set)|^\/autonomous\/[^/]+\/scope-accretion-override|^\/jobs\/[^/]+\/(?:trigger|run)|^\/messages\/spawn-request|^\/telegram\/topics/.test(req.path) ? 'new-scope'
+            : /^\/telegram\/(?:reply|post-update)/.test(req.path) ? 'telegram-send'
+                : /^\/autonomous\/(?:evaluate-completion|[^/]+\/run-end)/.test(req.path) ? 'completion-claim' : null;
+        if (!action)
+            return next();
+        const verdict = evaluateLifecycleGuard(ledger, action);
+        if (enforcement.mode === 'dry-run') {
+            if (!verdict.allowed)
+                auditWouldBlock(action, verdict.reasons);
+            return next();
+        }
+        if (!verdict.allowed)
+            return res.status(409).json({ error: 'window-lifecycle-enforcement', action, reasons: verdict.reasons });
+        if (action === 'telegram-send') {
+            const episodes = readRemediationEpisodes();
+            const corrections = ledger.obligations.filter(item => { if (!['pending', 'unknown', 'open-unexecuted', 'failed', 'blocked', 'expired'].includes(item.status) || !deriveFailureRemediation(item).correctionRequired)
+                return false; const digest = remediationEpisodeDigest(item); return !episodes.some(episode => episode.episodeDigest === digest && episode.disposition === 'resolved-with-live-evidence' && remediationResolutionIsLive(item, episode)); });
+            const selected = corrections.find(item => { const episode = [...episodes].reverse().find(entry => entry.remediationId === req.body?.remediationId && entry.obligationId === item.id && entry.episodeDigest === remediationEpisodeDigest(item) && entry.disposition === 'awaiting-authoritative-evidence'); if (!episode || typeof req.body?.text !== 'string')
+                return false; return item.failureAction === 'correct-before-report' ? /corrected counts?:/i.test(req.body.text) && /\bsource:/i.test(req.body.text) && /\b[A-Za-z][\w -]*\s*=\s*\d+\b/.test(req.body.text) : isHighLevelSynthesis(req.body.text); });
+            if (corrections.length && !selected)
+                return res.status(409).json({ error: 'window-lifecycle-correction-required', remediationIds: episodes.filter(episode => corrections.some(item => item.id === episode.obligationId) && episode.disposition === 'awaiting-authoritative-evidence').map(episode => episode.remediationId) });
+        }
+        if (action === 'telegram-send') {
+            try {
+                const topicMatch = req.path.match(/^\/telegram\/(?:reply|post-update)\/(\d+)/);
+                const topicId = Number(topicMatch?.[1] ?? (req.path === '/telegram/post-update' ? ctx.state.get('agent-updates-topic') : req.body?.topicId));
+                const text = req.body?.text;
+                const registry = ctx.playwrightRegistry?.() ?? new PlaywrightProfileRegistry({ stateDir: ctx.config.stateDir, projectDir: ctx.config.projectDir, listVaultNames: () => [] });
+                const profileId = registry.resolve('telegram').profile?.id;
+                if (profileId !== 'justin-telegram')
+                    throw new Error(`send-time-profile-invalid:${profileId ?? 'missing'}`);
+                if (!Number.isSafeInteger(topicId) || typeof text !== 'string')
+                    throw new Error(`send-time-payload-invalid:topic=${topicId}:text=${typeof text}`);
+                const identity = JSON.parse(fs.readFileSync(path.join(ctx.config.stateDir, 'identity.json'), 'utf8'));
+                if (identity.privateKeyEncryption && identity.privateKeyEncryption !== 'none' || typeof identity.privateKey !== 'string')
+                    throw new Error('send-time-signing-key-unavailable');
+                const signed = signAgentMessage({ agentId: 'echo', topicId, body: text, privateKey: Buffer.from(identity.privateKey, 'base64'), timestamp: Math.floor(Date.parse(windowNow()) / 1000) });
+                req.body.text = signed.text;
+                const checked = verifyEchoSignedOutbound({ text: signed.text, topicId, timestamp: windowNow(), fromUser: false, authorship: 'agent-outbound' });
+                if (!checked)
+                    throw new Error('send-time-signature-verification-failed');
+            }
+            catch (error) {
+                return res.status(409).json({ error: 'window-lifecycle-send-time-guard', reason: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        return next();
+    });
     // Content-hash dedup for the agent-to-agent relay-agent ingress path. Guards
     // the duplicate-reply bug where a sender that times out on the receiver's
     // session spawn retries with a FRESH message.id, slipping past the id-based