instar 1.3.1649 → 1.3.1650

package/dist/commands/server.js

@@ -3,6 +3,7 @@
  * the boot-time TCC-protected path detection + /guards row (see the
  * TccProtectedPathGuard block beside the worktree detector).
  */
+import { configureClaudeChildAuth, sweepClaudeAuthEnvFiles } from '../core/claudeChildAuth.js';
 import { slackHistoryLabel } from '../messaging/slack/threadHistoryLabel.js';
 import { readPairingOwnerName } from '../threadline/pairingOwnerName.js';
 import { buildThrowawayJobGuard, checkThrowawayExpiry, describeExpiry, takeLastAutoStartRefusal, throwawayStartupDecision } from '../core/ThrowawayAgentGuard.js';
@@ -61,7 +62,7 @@ import { StandDownAudit } from '../core/StandDownAudit.js';
 import { resolveStandardsRegistry } from '../core/standardsRegistryPath.js';
 import { chunkLiteralForTmux, buildLiteralSendArgs } from '../core/tmuxLiteralSend.js';
 import { parseStandardsRegistry } from '../core/StandardsRegistryParser.js';
-import { loadConfig, ensureStateDir, detectTmuxPath, detectGeminiPath } from '../core/Config.js';
+import { loadConfig, ensureStateDir, detectTmuxPath, detectGeminiPath, detectClaudePath, readConfiguredAnthropicKey } from '../core/Config.js';
 import { handleProcessLevelError } from '../core/uncaughtExceptionPolicy.js';
 import { planInboundLossNotices } from '../core/inboundLossRouting.js';
 import { heartbeatFreshEnoughToRerecord } from '../core/MachineHeartbeat.js';
@@ -75,6 +76,7 @@ import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstan
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
 import { JOB_LEASE_POOL_AUTHORITY_READY } from '../scheduler/JobLeaseClaimStore.js';
 import { resolveRelayUnknownSenderTrustMode } from '../threadline/relayUnknownSenderTrust.js';
+import { featureEvidence } from '../monitoring/FeatureEvidenceLog.js';
 import { resolveEncryptToPinnedMode, encryptToPinnedModeName } from '../threadline/encryptToPinned.js';
 import { resolveRefuseDowngradeMode } from '../threadline/refuseDowngrade.js';
 import { MarkedPairingInviteFlow } from '../threadline/PairingPendingAcceptMarkers.js';
@@ -646,6 +648,9 @@ let _singleMachineFailoverGap = null;
 // `GET /pool/missing-login` can read the detector constructed deep in the mesh
 // peer-presence wiring. Null when the guard is dark (route 503s).
 let _missingLoginSession = null;
+// The journal compaction pass runs at boot, before the evidence log is wired by
+// AgentServer; its row is held here and written straight after that construction.
+let _pendingCompactionEvidence = null;
 // Module-level handle for the SessionPoolFailoverRunner driver (§Rollout, Track H)
 // so `GET /session-pool/failover-runner` can read its status(). Null when the
 // runner is dark (dev-gated) — the route 503s. Constructed inside the rollout-gate
@@ -808,6 +813,8 @@ let _pinPlacementMetadata = null;
 let _ws13SustainedOnline = null;
 /** Cross-machine secret-sync (spec Phase 4): route-facing handle (push lever + read-only status). */
 let _secretSyncHandle = null;
+/** The boot-time escrow result, recorded as evidence once the evidence log is wired. Flags only, no key material. */
+let _recoveryEscrowEvidence = null;
 /** Pool Dashboard Streaming (POOL-DASHBOARD-STREAM-SPEC §2.3): shared single-use
  *  ticket store — minted by the `pool-stream-ticket` mesh verb, consumed by the
  *  WebSocketManager's /pool-stream upgrade. Constructed in the mesh-setup block. */
@@ -1001,6 +1008,7 @@ let _spawnAdmission = null;
 /** Native app conversations (mobile-native-conversations, increment 1) — late-bound for the replication observers. */
 let _appConversationService = null;
 let _ecosystemLedger = null;
+let _recommendedServicesLedger = null;
 // trustworthy-machine-load C5: one fixed holding notice per topic per overload
 // episode when EVERY machine refuses new work (30-min cooldown; the message
 // itself is already in durable custody, this only tells the user why it waits).
@@ -2484,6 +2492,14 @@ getHubClassifierDeps) {
                             modelTier: clsDeps.modelTier,
                         });
                         const willAct = result.isCommand && !clsDeps.dryRun;
+                        // Same scope as the audit below: LLM-engaged verdicts, never the prefilter-skip bulk.
+                        if (result.source !== 'prefilter-skip') {
+                            featureEvidence.record('threadline.hubIntent', {
+                                kind: result.source === 'fail-open' ? 'error' : 'fired',
+                                reason: result.source === 'fail-open' ? 'classifier-fail-open' : result.isCommand ? (willAct ? 'swallow' : 'would-swallow') : 'would-pass',
+                                context: { topicId, dryRun: clsDeps.dryRun, source: result.source, intent: result.intent ?? null, confidence: result.confidence ?? null, targetTopicId: result.targetTopicId ?? null },
+                            });
+                        }
                         // Audit the soak: log LLM-engaged decisions (a prefilter-skip is the
                         // bulk of traffic and always a would-pass — skipping it cuts volume
                         // AND the message-preview privacy surface). Never gates the message.
@@ -2528,6 +2544,7 @@ getHubClassifierDeps) {
             }
             catch (err) {
                 console.warn(`[telegram] hub-command intercept error (fail-open): ${err instanceof Error ? err.message : err}`);
+                featureEvidence.record('threadline.hubIntent', { kind: 'error', reason: 'intercept-threw-fail-open', context: { errorName: err instanceof Error ? err.name : 'unknown' } });
             }
         }
         // ── Fix commands from notification messages ──────────────────────
@@ -3861,6 +3878,10 @@ export async function startServer(options) {
         watchPaths: ['updates.autoApply', 'sessions.maxSessions', 'monitoring'],
     });
     liveConfig.start();
+    // Every server-side `claude` child gets the configured sign-in key from here, read per call so a
+    // restored key applies at once (spec cloud-key-internal-calls). Off: sessions.claudeChildAuth.enabled.
+    configureClaudeChildAuth(() => liveConfig.get('sessions.claudeChildAuth.enabled', true) === false ? undefined : config.sessions?.anthropicApiKey, () => config.sessions?.anthropicBaseUrl);
+    sweepClaudeAuthEnvFiles(config.stateDir);
     // Threadline → Telegram bridge config — settings surface for the bridge
     // module. Default-OFF auto-create ships from day one;
     // see TelegramBridgeConfig for the policy.
@@ -4075,6 +4096,7 @@ export async function startServer(options) {
         // covers the window on the fleet. D4-verified read-only (localhost-only inbound
         // socket, zero outbound). Belt-and-suspenders, not a boot reorder.
         let bootBeacon;
+        let bootBeaconBindErrorCode = null;
         if (resolveDevAgentGate(config.monitoring?.bootHealthBeacon?.enabled, config)) {
             try {
                 bootBeacon = new BootHealthBeacon(config.port);
@@ -4086,6 +4108,7 @@ export async function startServer(options) {
                 // failure must NEVER block the server boot (the startupGrace bump still
                 // covers the health window). Logged here, not swallowed silently.
                 bootBeacon = undefined;
+                bootBeaconBindErrorCode = err?.code ?? 'unknown';
                 console.error('  Boot health beacon failed to start (non-fatal):', err instanceof Error ? err.message : err);
             }
         }
@@ -4779,6 +4802,9 @@ export async function startServer(options) {
         // docs/specs/ecosystem-idea-pipeline.md: inert registration; the store is injected below whenever the pipeline is on.
         const { ECOSYSTEM_IDEAS_KIND_REGISTRATION } = await import('../ecosystem/EcosystemIdeasReplicatedStore.js');
         replicatedKindRegistry.register(ECOSYSTEM_IDEAS_KIND_REGISTRATION);
+        // docs/specs/recommended-services.md: a person's choices follow them across machines.
+        const { RECOMMENDED_SERVICES_KIND_REGISTRATION } = await import('../recommended/RecommendedServicesReplicatedStore.js');
+        replicatedKindRegistry.register(RECOMMENDED_SERVICES_KIND_REGISTRATION);
         // mobile-native-conversations §4.8 — the `mobileDeviceKeyLedger` kind (inert registration; on
         // whenever native app conversations are on, so a signed record can be checked on any machine).
         const { DEVICE_KEY_LEDGER_KIND_REGISTRATION } = await import('../core/MobileDeviceKeyLedgerReplicatedStore.js');
@@ -4940,13 +4966,35 @@ export async function startServer(options) {
                 const compactionConfig = config.multiMachine?.coherenceJournal?.replication?.compaction;
                 if (compactionConfig?.run === true) {
                     const { ReplicatedJournalCompactor } = await import('../core/ReplicatedJournalCompactor.js');
-                    new ReplicatedJournalCompactor({
-                        stateDir: config.stateDir,
-                        registry: replicatedKindRegistry,
-                        enabled: true,
-                        dryRun: compactionConfig.dryRun ?? true,
-                        logger: (m) => console.log(pc.dim(`  ${m}`)),
-                    }).run();
+                    try {
+                        const compaction = new ReplicatedJournalCompactor({
+                            stateDir: config.stateDir,
+                            registry: replicatedKindRegistry,
+                            enabled: true,
+                            dryRun: compactionConfig.dryRun ?? true,
+                            logger: (m) => console.log(pc.dim(`  ${m}`)),
+                        }).run();
+                        _pendingCompactionEvidence = {
+                            kind: 'fired',
+                            reason: compaction.dryRun ? 'would-compact' : 'compacted',
+                            context: {
+                                dryRun: compaction.dryRun,
+                                filesCompacted: compaction.filesCompacted,
+                                originalRecords: compaction.originalRecords,
+                                compactedRecords: compaction.compactedRecords,
+                                bytesBefore: compaction.bytesBefore,
+                                bytesAfter: compaction.bytesAfter,
+                            },
+                        };
+                    }
+                    catch (compactionErr) {
+                        _pendingCompactionEvidence = {
+                            kind: 'error',
+                            reason: 'compaction-failed',
+                            context: { dryRun: compactionConfig.dryRun ?? true, errorName: compactionErr instanceof Error ? compactionErr.name : 'unknown' },
+                        };
+                        throw compactionErr;
+                    }
                     // A real run replaced streams atomically; rebuild from the committed files.
                 }
                 coherenceJournal.setReplicatedRecordCommitObserver((kind, entries) => {
@@ -4973,6 +5021,14 @@ export async function startServer(options) {
                         for (const e of entries)
                             _ecosystemLedger.ingestReplicated(e.data.event);
                     }
+                    // A person's choices: each row lands only when it verifies under the machine it names.
+                    if (kind === 'recommended-service-record' && _recommendedServicesLedger) {
+                        for (const e of entries) {
+                            const r = _recommendedServicesLedger.ingestReplicated(e.data.row);
+                            if (r === 'bad-signature' || r === 'unverifiable')
+                                console.warn(`  [recommended-services] a replicated row was not accepted (${r})`);
+                        }
+                    }
                     // Device-key ledger rows: each lands only when it verifies under the pinned key of the machine it names.
                     if (kind === 'mobile-device-key-ledger-row' && _appConversationService?.deps.keyLedger) {
                         const ledger = _appConversationService.deps.keyLedger;
@@ -5088,6 +5144,11 @@ export async function startServer(options) {
         const _appNativeOn = _isMobileNativeEnabled(config);
         const _stateSyncStoresResolved = (() => {
             let s = _stateSyncStoresBase ?? {};
+            // On wherever the journal is live: a yes or no belongs to the person, not one machine
+            // (docs/specs/recommended-services.md). Without the journal there is no applier, so it isn't advertised.
+            const _recommendedServicesOn = !!coherenceJournal && _stateSyncStoresBase?.recommendedServices?.enabled !== false;
+            if (_recommendedServicesOn)
+                s = { ...s, recommendedServices: { enabled: true } };
             if (_appNativeOn)
                 s = { ...s, appConversations: { enabled: true }, mobileDeviceKeyLedger: { enabled: true } };
             if (resolveDevAgentGate(config.ecosystemIdeas?.enabled, config))
@@ -5098,7 +5159,7 @@ export async function startServer(options) {
                 s = { ...s, topicPins: { enabled: true } };
             if (_staleOwnerReleaseResolved)
                 s = { ...s, topicClaimAnnotations: { enabled: true } };
-            return _appNativeOn || _accountFollowMeEnabled || _pinReplicateEnabled || _staleOwnerReleaseResolved || _stateSyncStoresBase ? s : _stateSyncStoresBase;
+            return _recommendedServicesOn || _appNativeOn || _accountFollowMeEnabled || _pinReplicateEnabled || _staleOwnerReleaseResolved || _stateSyncStoresBase ? s : _stateSyncStoresBase;
         })();
         // WS2 send-side: the generic journal-backed record emitter (the concrete emitter
         // the per-store managers' emit hooks call). Needs the journal sink, the HLC clock,
@@ -7682,6 +7743,7 @@ export async function startServer(options) {
                         // Never let a pauser fault take down the boot path or the interval.
                         clpLastError = err instanceof Error ? err.message : String(err);
                         console.error(pc.red(`  CrashLoopPauser pass failed: ${clpLastError}`));
+                        featureEvidence.record('monitoring.crashLoopPauser', { kind: 'error', reason: 'pause pass failed', context: { dryRun: clpDryRun, errorName: err instanceof Error ? err.name : 'unknown' } });
                     }
                 };
                 const clpInitialDelay = clpCfg.initialPassDelayMs ?? 10 * 60_000;
@@ -8808,6 +8870,50 @@ export async function startServer(options) {
                 console.warn(`  [app-conversations] wiring failed: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        // docs/specs/recommended-services.md: built here so its rows replicate; no identity means no ledger, and the routes answer 503.
+        try {
+            const { loadMachineSigner, identityKeyLookup } = await import('../core/AppRecordSignatures.js');
+            const { RecommendedServicesLedger } = await import('../recommended/RecommendedServicesLedger.js');
+            const recRepl = await import('../recommended/RecommendedServicesReplicatedStore.js');
+            const signer = loadMachineSigner(config.stateDir);
+            if (signer) {
+                const ledger = new RecommendedServicesLedger({ stateDir: config.stateDir, signer, keyLookup: identityKeyLookup(config.stateDir) });
+                if (replicatedRecordEmitter) {
+                    const emitter = replicatedRecordEmitter;
+                    const emitRow = (row) => {
+                        const { outcome } = emitter.emit(recRepl.RECOMMENDED_SERVICES_STORE_KEY, recRepl.deriveRecommendedServiceRecordKey(row.eventId), recRepl.buildRecommendedServiceRecordData(row));
+                        if (outcome !== 'emitted')
+                            console.warn(`  [recommended-services] a choice was not replicated yet (${outcome}); it is sent again at next boot`);
+                    };
+                    ledger.setReplicationHook(emitRow);
+                    ledger.setReplicating(_stateSyncStoresResolved?.recommendedServices?.enabled === true && config.multiMachine?.coherenceJournal?.replication?.enabled === true);
+                    // Rows written while the journal was off, or dropped by a rate cap, go out now.
+                    if (replicatedPeerStreamReader && cjOwnMachineId) {
+                        for (const row of ledger.all()) {
+                            if (row.machineId !== signer.machineId())
+                                continue;
+                            const rk = recRepl.deriveRecommendedServiceRecordKey(row.eventId);
+                            if (!replicatedPeerStreamReader.loadOriginRecords(recRepl.RECOMMENDED_SERVICES_STORE_KEY, rk).some((o) => o.origin === cjOwnMachineId))
+                                emitRow(row);
+                        }
+                    }
+                }
+                if (replicatedPeerStreamReader && cjOwnMachineId) {
+                    const reader = replicatedPeerStreamReader;
+                    for (const rk of reader.listRecordKeys(recRepl.RECOMMENDED_SERVICES_STORE_KEY)) {
+                        for (const r of reader.loadOriginRecords(recRepl.RECOMMENDED_SERVICES_STORE_KEY, rk)) {
+                            if (r.origin !== cjOwnMachineId)
+                                ledger.ingestReplicated(r.data.row);
+                        }
+                    }
+                }
+                _recommendedServicesLedger = ledger;
+            }
+        }
+        catch (err) {
+            // @silent-fallback-ok: reported; the routes answer 503 and nothing else depends on this
+            console.warn(`  [recommended-services] ledger wiring failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         // docs/specs/ecosystem-idea-pipeline.md: the ledger is built here so its events replicate; AgentServer builds the service.
         if (resolveDevAgentGate(config.ecosystemIdeas?.enabled, config)) {
             try {
@@ -14068,9 +14174,26 @@ export async function startServer(options) {
         if (replicatedRecordEmitter && _accountFollowMeEnabled) {
             const emitter = replicatedRecordEmitter;
             const { SUBSCRIPTION_ACCOUNT_META_STORE_KEY, deriveSubscriptionAccountMetaRecordKey, buildSubscriptionAccountMetaData, buildSubscriptionAccountMetaTombstoneData, } = await import('../core/SubscriptionAccountMetaReplicatedStore.js');
+            // Every quota change re-projects an account, so one row per op and outcome per ten minutes. No account ids.
+            const followMeEvidence = (op, outcome) => {
+                const failed = outcome === 'error' || outcome === 'unconfirmed' || outcome.startsWith('dropped:');
+                featureEvidence.recordAtMostEvery('multiMachine.accountFollowMe', `${op}:${outcome}`, 600_000, {
+                    kind: outcome === 'emitted' ? 'fired' : failed ? 'error' : 'held',
+                    reason: `account-meta-${op}:${outcome}`,
+                    context: { op, outcome },
+                });
+            };
             subscriptionPool.setMetaReplicationEmitter({
-                emitPut: (acct) => emitter.emit(SUBSCRIPTION_ACCOUNT_META_STORE_KEY, deriveSubscriptionAccountMetaRecordKey(acct.id), (hlc, origin, observed) => buildSubscriptionAccountMetaData({ account: acct, hlc, origin, observed })),
-                emitDelete: (accountId, deletedAt) => emitter.emit(SUBSCRIPTION_ACCOUNT_META_STORE_KEY, deriveSubscriptionAccountMetaRecordKey(accountId), (hlc, origin, observed) => buildSubscriptionAccountMetaTombstoneData({ accountId, hlc, origin, deletedAt, observed })),
+                emitPut: (acct) => {
+                    const projected = emitter.emit(SUBSCRIPTION_ACCOUNT_META_STORE_KEY, deriveSubscriptionAccountMetaRecordKey(acct.id), (hlc, origin, observed) => buildSubscriptionAccountMetaData({ account: acct, hlc, origin, observed }));
+                    followMeEvidence('put', projected.outcome);
+                    return projected;
+                },
+                emitDelete: (accountId, deletedAt) => {
+                    const projected = emitter.emit(SUBSCRIPTION_ACCOUNT_META_STORE_KEY, deriveSubscriptionAccountMetaRecordKey(accountId), (hlc, origin, observed) => buildSubscriptionAccountMetaTombstoneData({ accountId, hlc, origin, deletedAt, observed }));
+                    followMeEvidence('delete', projected.outcome);
+                    return projected;
+                },
             });
         }
         // POOL-AWARE QUOTA THROTTLE wiring (docs/specs/POOL-AWARE-QUOTA-THROTTLE-SPEC.md):
@@ -16350,6 +16473,23 @@ export async function startServer(options) {
                         externalBlockSweepMs: aoftRawCfg.externalBlockSweepMs,
                         holdsLease: () => (leaseCoordinatorRef ? leaseCoordinatorRef.holdsLease() : true),
                     });
+                    // The aoft.* events have no other reader: keep them, with no message text (ids and reason codes only).
+                    for (const [event, kind] of [
+                        ['aoft.would-suppress', 'fired'], ['aoft.suppressed', 'fired'],
+                        ['aoft.would-reroute-terminal', 'fired'], ['aoft.terminal-rerouted', 'fired'],
+                        ['aoft.would-deadletter-external', 'fired'], ['aoft.deadlettered-external', 'fired'],
+                        ['aoft.external-block-recorded-internal', 'held'],
+                        ['aoft.graveyard-reconciled', 'fired'],
+                        ['aoft.beacon-id-leak', 'error'],
+                    ]) {
+                        promiseBeacon.on(event, (e) => {
+                            featureEvidence.record('commitments.agentOwnedFollowthrough', {
+                                kind,
+                                reason: event.replace('aoft.', '') + (e?.reason ? `: ${e.reason}` : ''),
+                                context: { commitmentId: e?.id ?? null, topicId: e?.topicId ?? null, sendKind: e?.kind ?? null, dryRun: event.includes('would-') || e?.dryRun === true, closed: e?.closed ?? null, wouldClose: e?.wouldClose ?? null, leakedTerms: Array.isArray(e?.terms) ? e.terms.length : null },
+                            });
+                        });
+                    }
                     promiseBeacon.start();
                     globalThis.__instarPromiseBeacon = promiseBeacon;
                     // ── AutonomousProgressHeartbeat ──────────────────────────────────
@@ -16467,6 +16607,30 @@ export async function startServer(options) {
                                 maxHeartbeatsPerRun: ahRawCfg.maxHeartbeatsPerRun,
                                 recentOutputChangeWindowMs: ahRawCfg.recentOutputChangeWindowMs,
                             });
+                            // The focus line is a session's own words: never in a row. Suppressions run every tick, so only a change of reason per topic writes one.
+                            const ahLastHold = new Map();
+                            autonomousHeartbeat.on('would-emit', (e) => {
+                                ahLastHold.delete(e.topicId);
+                                featureEvidence.record('monitoring.autonomousHeartbeat', { kind: 'fired', reason: 'would emit (dry run)', context: { topicId: e.topicId, minutesSilent: e.minutesSilent, dryRun: true } });
+                            });
+                            autonomousHeartbeat.on('emitted', (e) => {
+                                ahLastHold.delete(e.topicId);
+                                featureEvidence.record('monitoring.autonomousHeartbeat', { kind: 'fired', reason: 'emitted', context: { topicId: e.topicId, minutesSilent: e.minutesSilent, dryRun: false } });
+                            });
+                            autonomousHeartbeat.on('send-error', (e) => {
+                                featureEvidence.record('monitoring.autonomousHeartbeat', { kind: 'error', reason: 'send failed', context: { topicId: e.topicId, errorName: e.err instanceof Error ? e.err.name : 'unknown' } });
+                            });
+                            autonomousHeartbeat.on('tick-error', (err) => {
+                                featureEvidence.recordAtMostEvery('monitoring.autonomousHeartbeat', 'tick-error', 60 * 60 * 1000, { kind: 'error', reason: 'tick failed', context: { errorName: err instanceof Error ? err.name : 'unknown' } });
+                            });
+                            autonomousHeartbeat.on('suppressed', (e) => {
+                                if (ahLastHold.get(e.topicId) === e.reason)
+                                    return;
+                                if (ahLastHold.size >= 256)
+                                    ahLastHold.clear();
+                                ahLastHold.set(e.topicId, e.reason);
+                                featureEvidence.record('monitoring.autonomousHeartbeat', { kind: 'held', reason: `suppressed: ${e.reason}`, context: { topicId: e.topicId } });
+                            });
                             autonomousHeartbeat.start();
                             globalThis.__instarAutonomousHeartbeat = autonomousHeartbeat;
                             guardRegistry.register('monitoring.autonomousHeartbeat.enabled', () => autonomousHeartbeat.guardStatus());
@@ -19599,6 +19763,17 @@ export async function startServer(options) {
         });
         if (featureRegistryReady) {
             featureRegistry.bootstrap(config);
+            // docs/specs/recommended-services.md: old declines carry over before any list is built.
+            if (_recommendedServicesLedger) {
+                try {
+                    const { importLegacyDeclines } = await import('../recommended/legacyDeclines.js');
+                    importLegacyDeclines(_recommendedServicesLedger, (id) => featureRegistry.getState(id, 'default')?.discoveryState ?? null);
+                }
+                catch (err) {
+                    // @silent-fallback-ok: reported; idempotent, so it retries at next boot, and optional work never blocks startup
+                    console.warn(`  [recommended-services] old declines could not be imported yet: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
         }
         {
             const summaries = featureRegistry.getSummaries();
@@ -20474,6 +20649,102 @@ export async function startServer(options) {
             _swapAntiThrashEngine = null;
             _swapWorkGate = null;
         }
+        // A dead sign-in key on a key-only agent: confirmed, told, recovered (spec cloud-key-internal-calls).
+        // Wired here, outside the subscription pool block, because these agents may have no pool.
+        {
+            const { ClaudeKeyHealth, claudeKeyFingerprint, setActiveClaudeKeyHealth } = await import('../core/ClaudeKeyHealth.js');
+            const { buildClaudeKeyProbe } = await import('../core/claudeKeyProbe.js');
+            const { configuredClaudeOauthKey, setClaudeCallOutcomeListener } = await import('../core/claudeChildAuth.js');
+            const keyHealthOn = () => liveConfig.get('sessions.claudeKeyHealth.enabled', true) !== false;
+            const sendToSlackKey = async (routingKey, text) => {
+                const [channelId, threadTs] = routingKey.split(':');
+                await _slackAdapter.sendToChannel(channelId, text, threadTs ? { thread_ts: threadTs } : undefined);
+            };
+            // The disk read covers a topic bound after this server booted, as SessionRefresh does.
+            const topicForSession = (name) => telegram?.getTopicForSession(name) ?? telegram?.resolveTopicForSessionFromDisk?.(name) ?? null;
+            const claudeKeyHealth = new ClaudeKeyHealth({
+                stateFile: path.join(config.stateDir, 'state', 'claude-key-health.json'),
+                currentKey: () => (keyHealthOn() ? configuredClaudeOauthKey() : undefined),
+                currentRawKey: () => config.sessions.anthropicApiKey,
+                readKeyFromDisk: () => (keyHealthOn() ? readConfiguredAnthropicKey(config.stateDir) : undefined),
+                applyKey: (key) => {
+                    config.sessions.anthropicApiKey = key ?? undefined;
+                    sessionManager.setAnthropicKey(key);
+                },
+                probe: buildClaudeKeyProbe({
+                    claudePath: () => resolveFrameworkBinaryPath({
+                        framework: 'claude-code',
+                        frameworkBinaryPaths: config.sessions.frameworkBinaryPaths,
+                        claudePath: config.sessions.claudePath,
+                        configuredFramework: config.sessions.framework,
+                    }) ?? detectClaudePath(),
+                    baseUrl: () => config.sessions.anthropicBaseUrl,
+                }),
+                // Fixed server text straight to the adapters: the model is what is down, and `notify` returns
+                // nothing, so it can't say whether anyone was told.
+                notifyOperator: async (text) => {
+                    let delivered = false;
+                    const hubTopicId = state.get('agent-attention-topic') ?? 0;
+                    if (telegram && hubTopicId) {
+                        try {
+                            await telegram.sendToTopic(hubTopicId, text);
+                            delivered = true;
+                        }
+                        catch (err) { /* @silent-fallback-ok: `delivered` stays false, which drives the retry and its capped report */
+                            console.warn(`[ClaudeKeyHealth] Telegram notice failed: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    const attentionChannel = state.get('slack-attention-channel');
+                    if (_slackAdapter && attentionChannel) {
+                        try {
+                            await _slackAdapter.sendToChannel(attentionChannel, text);
+                            delivered = true;
+                        }
+                        catch (err) { /* @silent-fallback-ok: `delivered` stays false, which drives the retry and its capped report */
+                            console.warn(`[ClaudeKeyHealth] Slack notice failed: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    return delivered;
+                },
+                notifyPerson: async (sessionName, text) => {
+                    const topicId = topicForSession(sessionName);
+                    if (topicId !== null) {
+                        await telegram.sendToTopic(topicId, text);
+                        return true;
+                    }
+                    const routingKey = _slackAdapter?.getChannelForSession(sessionName) ?? null;
+                    if (routingKey !== null) {
+                        await sendToSlackKey(routingKey, text);
+                        return true;
+                    }
+                    return false;
+                },
+                listStuckSessions: async () => (await sessionManager.listSessionsAtLoginScreen()).filter((name) => topicForSession(name) !== null || (_slackAdapter?.getChannelForSession(name) ?? null) !== null),
+                sessionLaunchFingerprint: (tmuxSession) => {
+                    const launched = sessionManager.sessionLaunchKey(tmuxSession);
+                    return launched ? claudeKeyFingerprint(launched) : null;
+                },
+                refresh: async (sessionName, prompt) => {
+                    if (!_sessionRefresh)
+                        return { ok: false, reason: 'session refresh not available' };
+                    const r = await _sessionRefresh.refreshSession({ sessionName, followUpPrompt: prompt, reason: 'claude-key-restored' });
+                    return r.ok ? { ok: true, newSessionName: r.newSessionName } : { ok: false, reason: r.code };
+                },
+                clearLoginReports: () => sessionManager.clearInteractiveLoginReports(),
+                report: ({ reason, impact }) => DegradationReporter.getInstance().report({
+                    feature: 'ClaudeKeyHealth',
+                    primary: 'the configured Claude sign-in key authenticates every model call',
+                    fallback: 'the operator is told and stuck conversations wait for a working key',
+                    reason,
+                    impact,
+                }),
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            setActiveClaudeKeyHealth(claudeKeyHealth);
+            setClaudeCallOutcomeListener((outcome) => claudeKeyHealth.noteCallOutcome(outcome));
+            sessionManager.prependInteractiveLoginExpiredSink((signal) => claudeKeyHealth.handle(signal));
+            void claudeKeyHealth.boot().catch((err) => console.warn(`[ClaudeKeyHealth] boot failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
         // SessionRefresh — agent-initiated session respawn. Requires a Telegram
         // adapter (v1 scope: Telegram-bound sessions only). The respawner closure
         // captures `topicMemory` by reference, so even if topicMemory is wired up
@@ -23415,6 +23686,7 @@ export async function startServer(options) {
                     // root at already-paired peers remains an explicit operator/PIN step;
                     // the bearer recovery path can never become the first root writer.
                     const escrow = machineRecoveryKey.ensure(meshSelfId, own.recoveryEpoch ?? 0, own.recoveryPublicKey);
+                    _recoveryEscrowEvidence = { minted: !!escrow, recoveryEpoch: own.recoveryEpoch ?? 0, hadRoot: !!own.recoveryPublicKey };
                     if (own.recoveryPublicKey && !escrow) {
                         try {
                             _meshAttentionRaise?.({
@@ -24619,6 +24891,9 @@ export async function startServer(options) {
                             // release replicates exactly like the user-move release does. A lost CAS
                             // (peer advanced the epoch first) is a no-op here — we never retry/force.
                             emitPlacement(sk, r, 'released', prevOwner);
+                            featureEvidence.record('multiMachine.ownershipFollowsLiveWork', r.ok
+                                ? { kind: 'fired', reason: 'release-on-complete: ownership released', context: { topicId: sk, part: 'release-on-complete', prevOwner: prevOwner ?? null } }
+                                : { kind: 'error', reason: 'release-on-complete: compare-and-set refused', context: { topicId: sk, part: 'release-on-complete', prevOwner: prevOwner ?? null } });
                         }
                         catch {
                             // @silent-fallback-ok — release-on-complete is best-effort housekeeping
@@ -27921,6 +28196,11 @@ export async function startServer(options) {
                         }
                         runMachineCoherenceEffects?.(effects, { telegram: () => tg ?? null });
                     };
+                    const meshEvidence = (kind, reason) => {
+                        featureEvidence.record('monitoring.meshCoherenceLiveCheck', { kind, reason, context: { uptimeSec: Math.round(process.uptime()), emitCap: config.monitoring?.meshCoherenceLiveCheck?.emitCap ?? null } });
+                    };
+                    const meshFired = (code) => { meshEvidence('fired', `divergence:${code}`); return true; };
+                    const meshHeld = (code) => meshEvidence('held', `emit-cap:${code}`);
                     const peerPresenceTick = () => {
                         void reconcileIdentityActivation().catch((err) => {
                             console.warn(`[identity-recovery] periodic activation reconciliation failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -27960,8 +28240,10 @@ export async function startServer(options) {
                                             if (emitCap === undefined || count < emitCap) { // emitCap is READ here
                                                 console.log(pc.yellow(`  ⚠ mesh-live-coherence [${w.code}]: ${w.message}`));
                                                 _meshCoherenceEmitCounts.set(w.code, count + 1);
-                                                firedThisTick = true;
+                                                firedThisTick = meshFired(w.code);
                                             }
+                                            else
+                                                meshHeld(w.code);
                                         }
                                     }
                                     recorder?.record({ feature: 'mesh-coherence-live', kind: 'event', outcome: firedThisTick ? 'fired' : 'noop' });
@@ -27979,6 +28261,8 @@ export async function startServer(options) {
                                         _meshCoherenceFailing = true;
                                     }
                                     _meshCoherenceConsecFailures += 1;
+                                    if (_meshCoherenceConsecFailures === 1)
+                                        meshEvidence('error', 'live-state-read-failed');
                                 }
                             }
                         }
@@ -29642,10 +29926,12 @@ export async function startServer(options) {
                 console.warn('[instar] Windows desktop bootstrap diagnostic could not be persisted');
             }
         }
-        const server = new AgentServer({ config, ecosystemLedger: _ecosystemLedger ?? undefined, singleInstanceLock, agentIdentity: _agentIdentityDeps, terminateSessionAuthority: terminateWithAuthority, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, telegramOrigin: telegramOriginBoot?.runtime, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, jobAnomalySendAutomationReply: sendAutomationReply, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographerRoots: cartographerRoots ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, verifiedEntityName(m.machineId, m.nickname) ?? ''])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? '', url: p.url })); if (peers.length === 0) {
+        const server = new AgentServer({ config, ecosystemLedger: _ecosystemLedger ?? undefined, recommendedServicesLedger: _recommendedServicesLedger ?? undefined, singleInstanceLock, agentIdentity: _agentIdentityDeps, terminateSessionAuthority: terminateWithAuthority, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, telegramOrigin: telegramOriginBoot?.runtime, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, jobAnomalySendAutomationReply: sendAutomationReply, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographerRoots: cartographerRoots ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, verifiedEntityName(m.machineId, m.nickname) ?? ''])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? '', url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: verifiedEntityName(m.machineId, m.nickname) ?? '', url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx });
+        if (_pendingCompactionEvidence)
+            featureEvidence.record('multiMachine.coherenceJournal.replication.compaction', _pendingCompactionEvidence); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         const readIdentityProjectionPeerRows = async () => {
             const peers = _resolvePeerUrls?.() ?? [];
             const extra = config.multiMachine?.peerUrlAllowlist;
@@ -29996,6 +30282,7 @@ export async function startServer(options) {
                     subjectMachineId: proposed.machineId, epoch: proposed.recoveryEpoch ?? 0,
                     contentHash: operatorGrantMod.recoveryRootDelegationHash(proposed), dryRun,
                 });
+                featureEvidence.record('multiMachine.recoveryKeyEscrow', { kind: 'fired', reason: dryRun ? 'would rotate the recovery root from a peer' : 'rotated the recovery root from a peer', context: { machineId: proposed.machineId, recoveryEpoch: proposed.recoveryEpoch ?? 0, dryRun } });
                 if (dryRun)
                     return 'would-rotate';
                 identityStore.apply({
@@ -30590,10 +30877,14 @@ export async function startServer(options) {
         // port (force-closes lingering sockets, awaits 'close') BEFORE listen, so the
         // gap is sub-second and the supervisor never observes a hole. No-op if the
         // beacon was never started (dark) or already failed.
+        // A failed bind happened before the evidence log was wired (at AgentServer construction), so it is kept and written here.
+        if (bootBeaconBindErrorCode)
+            featureEvidence.record('monitoring.bootHealthBeacon', { kind: 'error', reason: 'could not bind during boot', context: { code: bootBeaconBindErrorCode, port: config.port } });
         try {
             await bootBeacon?.stop();
         }
         catch (err) {
+            featureEvidence.record('monitoring.bootHealthBeacon', { kind: 'error', reason: 'handoff failed: stop threw', context: { port: config.port, errorName: err instanceof Error ? err.name : 'unknown' } });
             // @silent-fallback-ok — a beacon stop failure must not stop the real server
             // from binding; logged, and the OS releases the listening socket regardless.
             console.error('  Boot health beacon stop failed (continuing to bind real server):', err instanceof Error ? err.message : err);
@@ -30604,6 +30895,16 @@ export async function startServer(options) {
         // no per-session write admission.
         sessionManager.startMonitoring();
         await server.start();
+        // Boot recovery runs before the evidence log exists, so its verdict is recorded here.
+        if (resolveDevAgentGate(config.multiMachine?.recoveryKeyEscrow?.enabled, config)) {
+            const escrowDryRun = config.multiMachine?.recoveryKeyEscrow?.dryRun !== false;
+            featureEvidence.record('multiMachine.recoveryKeyEscrow', {
+                kind: bootRecoveryOutcome === 'disabled' || (_recoveryEscrowEvidence && !_recoveryEscrowEvidence.minted && _recoveryEscrowEvidence.hadRoot) ? 'error'
+                    : bootRecoveryOutcome === 'coherence-held' ? 'held' : 'fired',
+                reason: bootRecoveryOutcome === 'disabled' ? 'boot recovery unavailable' : `boot recovery: ${bootRecoveryOutcome}`,
+                context: { outcome: bootRecoveryOutcome, dryRun: escrowDryRun, minted: _recoveryEscrowEvidence?.minted ?? null, hadRoot: _recoveryEscrowEvidence?.hadRoot ?? null, recoveryEpoch: _recoveryEscrowEvidence?.recoveryEpoch ?? null },
+            });
+        }
         // After listen: a stop's condition usually turns met across a restart onto the
         // fixed version, and the wake brief sends a session straight to a route.
         agentStopSurfacer?.start();