instar 1.3.142 → 1.3.144

package/dist/server/machineAuth.js

@@ -105,16 +105,42 @@ export function machineAuthMiddleware(deps) {
         next();
     };
 }
+/**
+ * Process-global monotonic sequence for ALL machineAuth-signed outbound requests.
+ *
+ * The receiver's NonceStore tracks ONE monotonic sequence PER SENDING MACHINE
+ * (src/core/NonceStore.ts) — so EVERY signed channel from this process (lease
+ * broadcast, machine heartbeat, handoff, reply-marker, live-tail, …) MUST draw
+ * from a single shared counter. They previously each used their own
+ * `Date.now()`-seeded counter; the fast-firing heartbeat pushed the receiver's
+ * per-machine watermark high while the slow lease counter stayed low, so every
+ * lease broadcast was rejected as an out-of-order replay and the standby never
+ * learned the holder (found live 2026-05-31:
+ * `Sequence 1780200440053 <= last seen 1780200440744`). Seeding from `Date.now()`
+ * keeps it monotonic across a process restart (wall-clock only advances), so the
+ * receiver's persisted watermark from a prior run is never above our fresh seed.
+ */
+let __machineAuthSequence = Date.now();
+/** The next process-global machineAuth sequence (strictly increasing). */
+export function nextMachineAuthSequence() {
+    __machineAuthSequence += 1;
+    return __machineAuthSequence;
+}
 /**
  * Sign an outgoing request with machine credentials.
  *
  * @param machineId - This machine's ID
  * @param privateKeyPem - Ed25519 private key in PEM format
  * @param body - The request body (will be JSON stringified for hashing)
- * @param sequence - The sequence number for this request
+ * @param _legacySequence - IGNORED. Retained for signature compatibility with
+ *   existing callers. The sequence is now drawn from the process-global
+ *   `nextMachineAuthSequence()` so every channel shares one monotonic counter
+ *   (see the note above — per-caller counters collided on the receiver's
+ *   per-machine watermark). New callers may omit it.
  * @returns Headers to include in the request
  */
-export function signRequest(machineId, privateKeyPem, body, sequence) {
+export function signRequest(machineId, privateKeyPem, body, _legacySequence) {
+    const sequence = nextMachineAuthSequence();
     const timestamp = Math.floor(Date.now() / 1000).toString();
     const nonce = crypto.randomBytes(16).toString('hex');
     const bodyHash = crypto.createHash('sha256')

package/dist/server/machineAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"machineAuth.js","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAyB1D,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;QACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QAEnE,iCAAiC;QACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,eAAe;gBACtB,SAAS;gBACT,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBACrE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC1C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,6BAA6B;QAC7D,KAAK,EACL,MAAM,EACN,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAEnF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;iBACpD,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,6CAA6C;QAC5C,GAAW,CAAC,WAAW,GAAG;YACzB,SAAS;YACT,QAAQ,EAAE,MAAM;SACY,CAAC;QAE/B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,aAAqB,EACrB,IAAa,EACb,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzC,OAAO;QACL,cAAc,EAAE,SAAS;QACzB,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,+CAA+C;QAC/C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa;YAC7C,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IAC3B,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"machineAuth.js","sourceRoot":"","sources":["../../src/server/machineAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAyB1D,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqB;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAuB,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;QACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QAEnE,iCAAiC;QACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,eAAe;gBACtB,SAAS;gBACT,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBACrE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC1C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,6BAA6B;QAC7D,KAAK,EACL,MAAM,EACN,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAEnF,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACtB,KAAK,EAAE,mBAAmB;oBAC1B,SAAS;oBACT,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;iBACpD,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,iBAAiB;gBACxB,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS;aACpD,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,6CAA6C;QAC5C,GAAW,CAAC,WAAW,GAAG;YACzB,SAAS;YACT,QAAQ,EAAE,MAAM;SACY,CAAC;QAE/B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,IAAI,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB;IACrC,qBAAqB,IAAI,CAAC,CAAC;IAC3B,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,aAAqB,EACrB,IAAa,EACb,eAAwB;IAExB,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzC,OAAO;QACL,cAAc,EAAE,SAAS;QACzB,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,+CAA+C;QAC/C,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa;YAC7C,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,SAAS,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IAC3B,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.142",
+  "version": "1.3.144",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-31T04:37:55.427Z",
-  "instarVersion": "1.3.142",
+  "generatedAt": "2026-05-31T04:48:35.698Z",
+  "instarVersion": "1.3.144",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -1521,7 +1521,7 @@
       "type": "subsystem",
       "domain": "communication",
       "sourcePath": "src/lifeline/TelegramLifeline.ts",
-      "contentHash": "03f9fc147f3e520e114e32df64fe6ba2a69f58664c3cb94f495532d47f5bcded",
+      "contentHash": "6105f8a126654011c81e900be2c049ff52dc1b9b369831432ad910a9650dc84e",
       "since": "2025-01-01"
     },
     "subsystem:orphan-process-reaper": {

package/upgrades/1.3.143.md

@@ -0,0 +1,44 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Multi-machine: fixes the next bug blocking cross-machine session transfer.**
+When two machines talk, each message carries an ever-increasing number so the
+receiver can reject replayed old messages. A machine has several lines of
+communication to its peer (the in-charge lease, the heartbeat, handoffs, the live
+tail), and each kept its own number seeded from the clock — so they drifted apart.
+The receiver only tracks one highest-number-seen per machine, so the fast
+heartbeat pushed that number high and the quieter lease line's messages then
+looked out-of-order and were dropped as replays. The standby machine therefore
+never received the lease announcement and refused to take over a conversation.
+This change makes every line on a machine share ONE ever-increasing number from a
+single chokepoint, so legitimate messages are never mistaken for replays. The
+receiver's replay protection (unique tokens + a 30-second freshness window + the
+per-machine number) is unchanged. Single-machine agents are unaffected.
+
+## What to Tell Your User
+
+If you run on one machine, nothing changes. If you run one agent across two
+machines, this fixes a hidden issue where the second machine was silently dropping
+the messages that tell it which machine is in charge — a step toward moving a
+conversation between machines working end to end. Nothing to configure.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Shared machine-auth sequence | Automatic. All of a machine's signed peer requests now share one monotonic sequence, so the lease/heartbeat/handoff/live-tail channels no longer collide on the receiver's per-machine replay watermark. No configuration. |
+
+## Evidence
+
+- `tests/unit/machine-auth.test.ts` (21) updated to the new chokepoint contract,
+  plus a regression: two channels signing via signRequest stay strictly monotonic
+  (no cross-transport collision), and a direct NonceStore stale-sequence-rejection
+  test (receiver behavior preserved).
+- `tests/integration/machine-routes.test.ts` (23) green — no sequence regression.
+- `tsc --noEmit` + repo lint clean.
+- Live evidence that motivated it: the standby's security log showed
+  "Sequence …053 <= last seen …744" rejecting every lease broadcast.
+- Side-effects: `upgrades/side-effects/machineauth-shared-sequence.md`.

package/upgrades/1.3.144.md

@@ -0,0 +1,53 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Agent hard-sleep can now actually stop and wake the server (dark + dry-run).**
+The previous step taught an idle agent how to DECIDE whether it is safe to sleep but
+never acted. This step builds the mechanism that acts on that decision: when sleep is
+enabled and the agent is deeply idle and safe, its heavy background server is
+stopped to save the machine's resources, and it wakes the instant a message arrives.
+
+The handshake reuses the proven restart lifecycle: the decision layer writes a
+sleep-request file, the supervisor stops the server and marks it intentionally
+asleep (so it is NOT treated as a crash and is NOT auto-restarted), and an inbound
+message makes the lifeline write a wake-request that the supervisor honors by
+respawning the server. The waiting message is held in the existing durable queue and
+delivered once the server is healthy, so nothing is lost. A safety marker means that
+even if an outside watchdog force-restarts the agent mid-sleep, it reads the marker
+on startup and stays asleep instead of fighting it. The existing crash-recovery
+behavior is unchanged except in the one case where the agent chose to sleep, proven
+by the existing supervisor tests staying green.
+
+## What to Tell Your User
+
+Nothing changes on any normal agent — this ships off by default, and the file that
+triggers a sleep is only ever written when sleep is explicitly turned on. The future
+ability it builds toward: a completely idle agent quiets its server to save your
+machine, then wakes the moment you message it, holding your message until it is back
+up. Turning it on is a deliberate step we would validate on one test agent first.
+
+## Summary of New Capabilities
+
+- ServerSupervisor honors a sleep-request by stopping the server and entering an
+  intentionally-asleep state that suppresses auto-respawn; honors a wake-request by
+  respawning. A slept-marker keeps a rebooted (or watchdog-bounced) supervisor asleep.
+- The decision layer writes a TTL-stamped sleep-request only in live mode.
+- The lifeline writes a wake-request on the next inbound message when the server is
+  asleep; the existing forward-retry queue replays the held message after wake.
+- All gated by the existing monitoring.agentSleep config — OFF + dry-run by default.
+
+## Evidence
+
+- `tests/unit/ServerSupervisor-sleep-wake.test.ts` — sleep stops + marks + enters
+  slept; no-request no-op; expired-request ignored; wake respawns + clears; wake-when-
+  not-slept no-op; idempotent re-sleep; boot-marker signal.
+- `tests/unit/agentSleepWake.test.ts` — marker present writes the wake-request; no
+  marker is a no-op (steady-state awake never writes).
+- `tests/unit/SleepController.test.ts` — sleepRequestWriter writes the TTL-stamped flag.
+- Regression: the existing ServerSupervisor-handshake / supervisor-health-check /
+  supervisor-cpu-starvation suites stay green — the slept short-circuit is the only
+  loop-flow change and is a no-op until a live sleep-request is honored.
+- Side-effects: `upgrades/side-effects/agent-hard-sleep-mechanism.md`.

package/upgrades/side-effects/agent-hard-sleep-mechanism.md

@@ -0,0 +1,115 @@
+# Side-Effects Review — Agent hard-sleep stop+wake mechanism (Stage B, slice 2)
+
+**Version / slug:** `agent-hard-sleep-mechanism`
+**Date:** `2026-05-31`
+**Author:** `echo`
+**Second-pass reviewer:** `adversarial review performed — found a critical brick (wake-trigger gated on health) + a broken manual escape hatch; BOTH fixed + tested before commit. Concurs the dark code is inert. Enablement remains the reviewed gate (live on a test agent with Justin watching).`
+
+## Summary of the change
+
+Acts on the slice-1 SleepController verdict: in live mode it writes
+`state/sleep-requested.json`; the ServerSupervisor honors it by stopping the server
+tmux session and entering a `slept` state; the health loop then short-circuits
+(suppressing auto-respawn) and only watches for `state/wake-requested.json`, which
+the TelegramLifeline writes on the next inbound message → the supervisor respawns
+the server and the existing forward-retry queue replays the buffered message. Files:
+`SleepController.ts` (+`sleepRequestWriter`), `ServerSupervisor.ts`
+(checkSleepRequest/checkWakeRequest/`slept` guard/boot-marker), `TelegramLifeline.ts`
+(+`requestWakeIfSlept` via the pure `agentSleepWake.ts` helper). No new config (the
+slice-1 `monitoring.agentSleep` gates it), no new route, no agent-installed file.
+
+## Decision-point inventory
+
+- `ServerSupervisor` health-loop control flow — modify — adds ONE short-circuit: `if (slept) { checkWakeRequest(); return; }` at the loop top.
+- `ServerSupervisor.checkSleepRequest` / `checkWakeRequest` — add — the stop/respawn handlers (mirror checkRestartRequest).
+- `ServerSupervisor` boot — modify — reads `slept-marker.json` to stay asleep across a supervisor reboot.
+- `SleepController.requestSleep` consumer — add — `sleepRequestWriter` (live-mode only).
+- `TelegramLifeline.forwardToServer` — pass-through — prepends a non-blocking `requestWakeIfSlept()` side-call.
+
+---
+
+## 1. Over-block
+
+No block/allow surface over messages. The only "blocking-like" behavior is the
+`slept` short-circuit suppressing auto-respawn — which is exactly intended and gated
+on `slept`, set only after a live sleep-request is honored. A genuine crash (slept
+=== false) still flows through the unchanged `evaluateUnhealthyServer` path.
+
+## 2. Under-block
+
+Could the server fail to wake (the brick risk)? **The adversarial second-pass review
+caught a real brick in the first cut and it was fixed:** the wake-trigger was
+originally placed inside `forwardToServer()`, which is gated on `supervisor.healthy`
+— but a slept server is not healthy, so an inbound message took the "server down →
+queue" path and never wrote `wake-requested.json` → the server would never wake.
+**Fix:** `requestWakeIfSlept()` now runs at the TOP of `processUpdate()`, before any
+health gate, so EVERY inbound update writes the wake flag when slept (covered by the
+helper test + the corrected call-site). The review also caught that `/lifeline
+restart` (the manual escape hatch) didn't clear the slept-marker, so a manual restart
+re-read the marker and re-slept — **fixed** via `ServerSupervisor.wakeFromSleep()`,
+called from both `/lifeline restart` and `/lifeline reset` (tested).
+
+Remaining wake robustness: the supervisor checks the wake flag every 10s while slept;
+a single missed flag write self-heals on the next inbound; a fleet-watchdog mid-sleep
+bounce stays asleep via the boot-marker AND wakes on the next inbound. The
+scheduler-wake (a cron job due during sleep) is the one tracked gap (conservative-null
+for now), enablement-gated — dark default means no real agent is affected.
+
+## 3. Level-of-abstraction fit
+
+Correct. The mechanism reuses the proven `restart-requested.json` lifecycle shape
+(file flag consumed in the health loop) rather than inventing a new lifecycle; the
+stop is the existing tmux `kill-session`, the wake is the existing `spawnServer()`.
+The lifeline wake-trigger is extracted into a pure, unit-tested helper
+(`writeWakeRequestIfSlept`) rather than buried in the un-testable heavy class.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the SleepController remains the decision-maker (signal, with all guards);
+  this slice is the mechanism it drives. The stop IS an authority (stops a process),
+  but it is gated exactly like a planned restart: positive proof (the slice-1
+  would-sleep verdict with every guard), ships OFF + dry-run, never fires unless
+  enabled && !dryRun, and KEEPs-awake on any ambiguity upstream.
+
+## 5. Interactions
+
+- **Shadowing:** the `slept` short-circuit runs before the health/restart logic; it
+  is a no-op when `slept===false` (always, until a live sleep-request lands), so it
+  cannot shadow the existing restart/health paths in normal operation. Verified by
+  the unchanged `ServerSupervisor-handshake` + `supervisor-health-check` suites.
+- **Double-fire:** sleep is idempotent (`checkSleepRequest` early-returns when
+  already slept); wake is idempotent (early-returns when not slept). The
+  `sleep-requested`/`wake-requested` flags are consumed on read.
+- **Races:** the fleet watchdog vs sleep — resolved by the boot-marker (reboot stays
+  asleep). The lifeline writing a wake flag while the supervisor is mid-respawn —
+  harmless (the supervisor clears `slept` first, so a redundant wake flag is consumed
+  next tick as a no-op).
+- **Feedback loops:** none — the flags are one-shot, consumed by the consumer.
+
+## 6. External surfaces
+
+- **Install base:** pure additive source, no config/route/agent-installed-file
+  change → every agent picks it up on update; behavior is byte-identical until
+  `monitoring.agentSleep` is enabled live. The slice-1 dark default holds.
+- **Other agents / external systems:** none.
+- **Persistent state:** three transient `state/*.json` flags + one `slept-marker.json`
+  (best-effort, consumed/removed by the supervisor).
+- **Timing:** the existing 10s health tick; no new timer.
+
+## 7. Rollback cost
+
+Pure additive code, no config/migration. Revert → `checkSleepRequest` /
+`checkWakeRequest` / the `slept` guard / the lifeline side-call disappear; the
+supervisor + lifeline behave exactly as before. No persistent state needs cleanup
+(the flags are transient). No user-visible change during rollback (dark by default).
+
+## Conclusion
+
+This review confirmed the mechanism is a tightly-scoped, additive layer on the
+proven restart lifecycle, with ONE load-bearing change (the `slept` short-circuit)
+that is a no-op until a live sleep-request is honored and is regression-covered by
+the existing supervisor suites. The brick risk is closed at multiple layers
+(per-forward wake re-write, 10s wake poll, boot-stay-asleep marker). It ships dark;
+the enablement (turning sleep ON) is the reviewed validation step on a test agent.

package/upgrades/side-effects/machineauth-shared-sequence.md

@@ -0,0 +1,60 @@
+# Side-Effects Review — machineAuth shared monotonic sequence
+
+**Version / slug:** `machineauth-shared-sequence`
+**Date:** `2026-05-31`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+`signRequest` (the single function every machineAuth-signed outbound request flows
+through) now assigns the X-Sequence from a process-global monotonic counter
+(`nextMachineAuthSequence()`, seeded from `Date.now()`) instead of the per-caller
+`sequence` argument (now ignored). Fixes the cross-transport replay collision: the
+receiver tracks one monotonic sequence per sending machine, but each channel had
+its own `Date.now()`-seeded counter, so a lower-seeded channel (the lease
+broadcast) was rejected as out-of-order forever.
+
+## Decision-point inventory
+
+1. **signRequest sequence source** → always `nextMachineAuthSequence()` (global,
+   monotonic), regardless of the passed arg.
+
+## 1. Over-block
+
+**What legitimate inputs does this reject?** None — it makes MORE requests succeed.
+Previously-rejected legitimate lease broadcasts now pass. The receiver's replay
+defenses are unchanged: nonce uniqueness + 30s timestamp window + per-machine
+monotonic sequence all still run. A genuine replay (reused nonce, or stale
+timestamp, or a sequence below the watermark) is still rejected exactly as before.
+
+## 2. Under-block
+
+**What does this still miss?** Nothing new. Anti-replay strength is unchanged; the
+fix only makes a single sender's many channels share one monotonic sequence
+(which is what the per-machine watermark always assumed). Cross-MACHINE replay is
+still caught (each machine has its own watermark on the receiver).
+
+## 3. Blast radius
+
+- `signRequest` is used by every machineAuth sender: lease broadcast, heartbeat,
+  handoff, reply-marker, live-tail, MessageRouter relay, and the `instar pair`/
+  handoff CLI. ALL now share the global counter — this is the intended fix (the
+  chokepoint guarantees no caller can bypass it).
+- The per-caller sequence counters in server.ts / MessageRouter become inert
+  (their value is ignored); left in place to minimize churn — harmless dead args.
+- Tests: `machine-auth.test.ts` (21) updated to the new contract + a regression
+  for the interleaved-channel monotonicity + a direct NonceStore stale-rejection
+  test. `machine-routes.test.ts` integration (23) green. tsc + lint clean.
+
+## 4. Rollback
+
+Pure code (no migration/config/schema). Rollback = revert the PR. The sequence
+reverts to per-caller, re-introducing the collision (so don't revert without
+re-introducing bug #3).
+
+## 5. Failure modes
+
+- Process restart → counter re-seeds from the new (higher) `Date.now()`, still
+  above any prior watermark. Monotonic across restarts by construction.
+- Concurrency → single-threaded JS; `nextMachineAuthSequence` increments atomically.