instar 1.3.1322 → 1.3.1324

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAoI7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAocD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAitwBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAoI7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAqfD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2zwBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -644,6 +644,50 @@ let _resolveRouterUrl = null;
 /** Every OTHER active machine with a known URL — backs GET /sessions?scope=pool
  *  (pool-wide session aggregation for the dashboard). Set in the same mesh block. */
 let _resolvePeerUrls = null;
+/** A2A inbound message-id ledger controller (docs/specs/a2a-inbound-id-ledger.md).
+ *  Built at the inbound-queue sweep's boot site (before recoverPendingInjects),
+ *  shared with the relay consumer and AgentServer. Null ⇒ never constructed. */
+let _inboundIdLedger = null;
+/** True while the listener daemon owns inbound relay handling (no capability then). */
+let _inboundIdLedgerDaemonDeferred = false;
+/** Late-bound holder for the pool registry (assigned where it is constructed) —
+ *  read by annotatePeerHandoff for online status + routerReceivedAt ordering. */
+let _machinePoolRegistryForAnnotation = null;
+let _peerHandoffAnnotator = null;
+/**
+ * Inbound-id ledger §4: the annotate-only peer read for a marked resend. Asks
+ * at most 8 online peers (ordered by routerReceivedAt), 500 ms shared timeout,
+ * 16 in flight process-wide, a per-peer breaker, early return on the first
+ * `handed-off`. Its answer ONLY words the resent-copy notice — it can never
+ * stop a message. Never PoolPollCache: a direct, uncached fetch.
+ */
+async function annotatePeerHandoff(config, ledger, senderKey, messageId) {
+    if (!_peerHandoffAnnotator) {
+        const { createPeerHandoffAnnotator } = await import('../threadline/inboundIdLedgerWiring.js');
+        _peerHandoffAnnotator = createPeerHandoffAnnotator({
+            peers: () => (_resolvePeerUrls?.() ?? [])
+                .map((p) => ({ ...p, cap: _machinePoolRegistryForAnnotation?.getCapacity(p.machineId) ?? null }))
+                .filter((p) => p.cap?.online !== false)
+                .map((p) => ({ machineId: p.machineId, url: p.url, routerReceivedAt: p.cap?.routerReceivedAt ?? null })),
+            isUrlAllowed: (url) => isPeerUrlAllowedForCredentials(url, config.multiMachine?.peerUrlAllowlist).ok,
+            authToken: config.authToken ?? '',
+            agentId: config.projectName,
+            counters: {
+                annotated: () => _inboundIdLedger?.peek()?.bump('peerAnnotated'),
+                unavailable: (reason) => _inboundIdLedger?.peek()?.bumpPeerCheckUnavailable(reason),
+            },
+        });
+    }
+    void ledger;
+    try {
+        return await _peerHandoffAnnotator(senderKey, messageId);
+    }
+    catch {
+        // @silent-fallback-ok — annotate-only read: a failure is counted and only changes the notice wording.
+        _inboundIdLedger?.peek()?.bumpPeerCheckUnavailable('error');
+        return false;
+    }
+}
 /** WS1.2 sender leg: order a REMOTE owner to drain `sessionKey` for a transfer
  *  to `target` (signed mesh `drain` verb). Set in the mesh-client block; null =
  *  pool dark / no client — the transfer route degrades to today's pin path. */
@@ -10355,6 +10399,41 @@ export async function startServer(options) {
         // the health endpoint (synchronous tmux has-session calls) and cause the
         // lifeline to restart the server in a tight loop.
         await sessionManager.purgeDeadSessions();
+        // ── A2A inbound message-id ledger (docs/specs/a2a-inbound-id-ledger.md) ──
+        // Opened HERE, at the inbound-queue sweep's boot site and BEFORE
+        // recoverPendingInjects, when the feature resolves on (dev gate when
+        // `enabled` is omitted). Read LIVE: a false→true flip opens lazily on the
+        // first ingress; true→false closes it and stops its timers. An unopenable
+        // file leaves the ledger dark (today's behaviour) with one degradation.
+        try {
+            const { buildInboundIdLedgerController } = await import('../threadline/InboundIdLedger.js');
+            _inboundIdLedger = buildInboundIdLedgerController({
+                stateDir: config.stateDir,
+                agentId: config.projectName,
+                developmentAgent: config.developmentAgent,
+                readBlock: () => {
+                    const live = liveConfig.get('threadline', undefined);
+                    return (live?.inboundIdLedger
+                        ?? config.threadline?.inboundIdLedger);
+                },
+                reportDegradation: (d) => DegradationReporter.getInstance().report(d),
+            });
+            const bootLedger = _inboundIdLedger.current();
+            if (bootLedger) {
+                console.log(pc.dim(`  [inbound-id-ledger] open (${bootLedger.deadEpochAdmittedAtBoot} row(s) left admitted by a prior process)`));
+            }
+        }
+        catch (err) {
+            // @silent-fallback-ok — ledger dark is today's behaviour; logged, and a file-open failure reports its own degradation.
+            console.warn(`[server] inbound-id ledger construction failed (non-fatal, ledger dark): ${err instanceof Error ? err.message : String(err)}`);
+            // Hand AgentServer a DARK controller so it never builds its own (the HTTP
+            // routes must not advertise a ledger the relay socket is running without).
+            try {
+                const { InboundIdLedgerController } = await import('../threadline/InboundIdLedger.js');
+                _inboundIdLedger = new InboundIdLedgerController({ isEnabled: () => false, open: () => { throw new Error('ledger dark'); } });
+            }
+            catch { /* @silent-fallback-ok — AgentServer falls back to its own construction */ }
+        }
         // ── Durable Inbound Message Queue: unconditional boot sweep (§5.3) ──
         // MUST run BEFORE recoverPendingInjects (boot ordering, spec §3.4): the
         // sweep consults injection receipts and vetoes PIS records for
@@ -16684,9 +16763,20 @@ export async function startServer(options) {
         // self-initializing schema) so the peer-health routes answer even when the
         // relay is off.
         let a2aDeliveryTracker = null;
+        let a2aSweep = null;
         try {
             const { A2ADeliveryTracker } = await import('../threadline/A2ADeliveryTracker.js');
             a2aDeliveryTracker = A2ADeliveryTracker.open(config.projectName, config.stateDir);
+            // Silence sweep (docs/specs/a2a-honest-delivery-outcomes.md §3) — the
+            // production wiring lives in honestDeliveryWiring so tests run this code.
+            {
+                const { startDeliverySweep } = await import('../threadline/honestDeliveryWiring.js');
+                a2aSweep = startDeliverySweep({
+                    tracker: a2aDeliveryTracker,
+                    auditPath: path.join(config.stateDir, '..', 'logs', 'a2a-delivery-verdicts.jsonl'),
+                    degradations: DegradationReporter.getInstance(),
+                });
+            }
         }
         catch (err) {
             // @silent-fallback-ok: cascade-isolation — a tracker open failure must never block
@@ -16975,6 +17065,30 @@ export async function startServer(options) {
             threadlineShutdown = threadline.shutdown;
             threadlineRelayClient = threadline.relayClient;
             threadlineGetLastRelayEvent = threadline.getLastRelayEvent;
+            // Inbound-id ledger §3/§6: daemon-inbox mode is not covered — never advertise there.
+            _inboundIdLedgerDaemonDeferred = threadline.daemonHandlingRelay === true;
+            // Inbound-id ledger §1: the gate consults the ledger AFTER the operation-
+            // permission check and BEFORE the rate limiter counts a data message; a
+            // terminal-row replay is dropped there and handed to the duplicate handler.
+            if (threadline.inboundGate) {
+                const { recordDuplicateAck } = await import('../threadline/inboundIdLedgerWiring.js');
+                threadline.inboundGate.setLedgerLookup((fp, id) => _inboundIdLedger?.current()?.lookup(fp, id) ?? 'unavailable', (fp, id) => {
+                    const l = _inboundIdLedger?.current();
+                    if (!l)
+                        return;
+                    l.bump('dedupById');
+                    l.bumpReplayDropped(fp);
+                    const row = l.getRow(fp, id);
+                    if (row)
+                        recordDuplicateAck(a2aDeliveryTracker, row);
+                });
+            }
+            // Honest delivery (docs/specs/a2a-honest-delivery-outcomes.md §5): ONE
+            // writer for relay verdicts on the long-lived ThreadlineClient.
+            if (threadlineRelayClient) {
+                const { wireRelayVerdicts } = await import('../threadline/honestDeliveryWiring.js');
+                wireRelayVerdicts(threadlineRelayClient, () => a2aDeliveryTracker, DegradationReporter.getInstance());
+            }
             // Initialize unified trust system (three-layer model + MoltBridge)
             if (threadline.trustManager) {
                 try {
@@ -17047,9 +17161,22 @@ export async function startServer(options) {
                 if (threadline.inboundGate) {
                     threadline.inboundGate.setRouter(threadlineRouter);
                 }
+                const { runRelayInboundWithLedger } = await import('../threadline/inboundIdLedgerWiring.js');
+                const { InboundMessageGate: InboundGateStatics } = await import('../threadline/InboundMessageGate.js');
                 threadlineRelayClient.on('gate-passed', async (decision) => {
-                    if (!decision.message)
-                        return;
+                    // Inbound-id ledger (docs/specs/a2a-inbound-id-ledger.md §1) — THE
+                    // COMMIT POINT: runRelayInboundWithLedger commits as the first statement
+                    // after the null-check and the probe exclusion, BEFORE every side effect
+                    // (waiter, auto-ack, inbox append, implicit ack, warrants state,
+                    // dispatch), and finishes the attempt-owned ticket in a `finally`.
+                    await runRelayInboundWithLedger(decision, {
+                        ledger: () => _inboundIdLedger?.current() ?? null,
+                        tracker: () => a2aDeliveryTracker,
+                        extractMessageId: (m) => InboundGateStatics.extractMessageId(m),
+                        annotate: (ledger, senderKey, messageId) => annotatePeerHandoff(config, ledger, senderKey, messageId),
+                    }, (ledgerTicket, ledgerNotice) => handleGatePassedRelayMessage(decision, ledgerTicket, ledgerNotice));
+                });
+                async function handleGatePassedRelayMessage(decision, ledgerTicket, ledgerNotice) {
                     const msg = decision.message;
                     const senderFingerprint = msg.from;
                     const senderName = senderFingerprint.slice(0, 8);
@@ -17180,6 +17307,12 @@ export async function startServer(options) {
                                 humanInLoop: false,
                             });
                             if (decision.suppress) {
+                                // Inbound-id ledger: a pure no-reply verdict → `no-reply` (terminal);
+                                // a loop-budget suppression depends on loop state → `refused`.
+                                if (decision.verdict.budgetExhausted)
+                                    ledgerTicket?.recordRefused('loop-budget');
+                                else
+                                    ledgerTicket?.recordNoReply();
                                 console.log(`[relay] warrants-reply gate suppressed reply (${decision.verdict.signal}) for ${senderName} thread ${gateThreadId.slice(0, 8)}`);
                                 // On budget exhaustion, surface ONE status notice — never silently
                                 // drop. CMT-519: route it to the SILENT Threadline hub (not a
@@ -17244,12 +17377,13 @@ export async function startServer(options) {
                                 if (intent === 'pipe') {
                                     const result = await pipeSpawner.spawn({
                                         threadId: msg.threadId,
-                                        messageText: textContent,
+                                        messageText: ledgerNotice ? `[server notice: ${ledgerNotice}]\n\n${textContent}` : textContent,
                                         fromFingerprint: senderFingerprint,
                                         fromName: senderName,
                                         trustLevel,
                                     });
                                     if (result.spawned) {
+                                        ledgerTicket?.recordHandoff('pipe');
                                         console.log(`[relay] Pipe session spawned for ${senderName} (thread: ${msg.threadId.slice(0, 8)})`);
                                         return;
                                     }
@@ -17271,7 +17405,8 @@ export async function startServer(options) {
                     // `!threadResumeMap.get(...)` guard, now that get() no longer nulls them.)
                     const isTopicBoundReply = !!msg.threadId && threadResumeMap.get(msg.threadId)?.originTopicId !== undefined;
                     if (listenerManager && listenerManager.shouldUseListener(trustLevel, textContent.length) && !isTopicBoundReply) {
-                        listenerManager.writeToInbox({ from: senderFingerprint, senderName, trustLevel, threadId: msg.threadId ?? getSyntheticThreadId(senderFingerprint), text: textContent });
+                        listenerManager.writeToInbox({ from: senderFingerprint, senderName, trustLevel, threadId: msg.threadId ?? getSyntheticThreadId(senderFingerprint), text: ledgerNotice ? `[server notice: ${ledgerNotice}]\n\n${textContent}` : textContent });
+                        ledgerTicket?.recordHandoff('listener');
                         console.log(`[relay] Routed to listener inbox from ${senderName} (trust: ${trustLevel})`);
                         return;
                     }
@@ -17296,22 +17431,24 @@ export async function startServer(options) {
                         trustLevel,
                         preferWarmSession,
                     };
-                    let result = await threadlineRouter.handleInboundMessage(envelope, relayContext);
+                    let result = await threadlineRouter.handleInboundMessage(envelope, relayContext, { resentNotice: ledgerNotice });
                     // Fallback only when a threadless message could not be associated
                     // with any thread. A refusal can be unhandled while still carrying
                     // the router-resolved threadId; retrying that payload would hand the
                     // same refused message to the router twice.
                     if (!result.handled && !result.threadId && !msg.threadId) {
                         envelope.message.threadId = getSyntheticThreadId(senderFingerprint);
-                        result = await threadlineRouter.handleInboundMessage(envelope, relayContext);
+                        result = await threadlineRouter.handleInboundMessage(envelope, relayContext, { resentNotice: ledgerNotice });
                     }
+                    // Inbound-id ledger: the outcome of the LAST path tried, through the allowlist.
+                    ledgerTicket?.recordRouterResult(result);
                     if (result.error)
                         console.warn(`[relay] Router error: ${result.error}`);
                     if (result.spawned)
                         console.log(`[relay] Spawned session for ${senderName} (trust: ${trustLevel}, thread: ${result.threadId})`);
                     if (result.resumed)
                         console.log(`[relay] Resumed session for ${senderName} (thread: ${result.threadId})`);
-                });
+                }
                 // Relay client is passed to AgentServer → RouteContext for the /threadline/relay-send endpoint
                 console.log(pc.green(`  Threadline: relay connected to ${config.threadline?.relayUrl ?? DEFAULT_RELAY_HOST}`));
             }
@@ -20172,6 +20309,8 @@ export async function startServer(options) {
                 // B4 Decision 10 — hand the skew-immune registry to the lease-liveness
                 // closures (forward-ref declared at function-body scope above the lease).
                 leaseLivenessRegistry = machinePoolRegistry;
+                // Inbound-id ledger §4: annotatePeerHandoff reads online status + order here.
+                _machinePoolRegistryForAnnotation = machinePoolRegistry;
                 const poolSelfId = machineHeartbeat?.config?.machineId ??
                     (poolIdMgr.hasIdentity() ? poolIdMgr.loadIdentity().machineId : null);
                 // WS4.3 journal-lease cutover (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.3,
@@ -26210,7 +26349,7 @@ export async function startServer(options) {
         const server = new AgentServer({ config, singleInstanceLock, terminateSessionAuthority: terminateWithAuthority, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, telegramOrigin: telegramOriginBoot?.runtime, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographerRoots: cartographerRoots ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: m.nickname ?? m.machineId, url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, getLastRelayEvent: threadlineGetLastRelayEvent, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, getLastRelayEvent: threadlineGetLastRelayEvent, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         const readIdentityProjectionPeerRows = async () => {
             const peers = _resolvePeerUrls?.() ?? [];
             const extra = config.multiMachine?.peerUrlAllowlist;
@@ -27661,6 +27800,8 @@ export async function startServer(options) {
                 clearInterval(warmReapTimer);
                 warmReapTimer = null;
             } // Warm-Session A2A reap tick
+            a2aSweep?.stop();
+            a2aSweep = null; // honest-delivery silence sweep
             try {
                 _topicProfileOrchestrator?.dispose();
             }