instar 1.3.1649 → 1.3.1651

package/dist/providers/adapters/anthropic-headless/transport/oneShotCompletion.js

@@ -7,6 +7,7 @@
  * collapse the two paths once the adapter is wired into the rest of
  * Instar's source.
  */
+import { applyClaudeChildAuth, configuredClaudeOauthKey } from '../../../../core/claudeChildAuth.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { CapabilityFlag } from '../../../capabilities.js';
@@ -45,8 +46,10 @@ class AnthropicHeadlessOneShotCompletion {
         const childEnv = { ...process.env };
         delete childEnv['CLAUDECODE'];
         delete childEnv['CLAUDE_SESSION_ID'];
-        // Inject auth credential if configured
-        if (this.config.credential) {
+        // Inject auth credential if configured. The agent's configured key wins over one read from the
+        // server's env, matching session launch (spec cloud-key-internal-calls).
+        applyClaudeChildAuth(childEnv);
+        if (this.config.credential && !configuredClaudeOauthKey()) {
             if (this.config.credential.startsWith('sk-ant-oat')) {
                 childEnv['CLAUDE_CODE_OAUTH_TOKEN'] = this.config.credential;
                 delete childEnv['ANTHROPIC_API_KEY'];

package/dist/providers/adapters/anthropic-headless/transport/oneShotCompletion.js.map

@@ -1 +1 @@
-{"version":3,"file":"oneShotCompletion.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/transport/oneShotCompletion.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAA0B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,kCAAkC;IAGT,MAAM;IAF1B,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEvD,YAA6B,MAA+B;sBAA/B,MAAM;IAA4B,CAAC;IAEhE,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,OAAkC;QAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;QAEtF,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,MAAM;YACN,SAAS;YACT,KAAK;YACL,aAAa;YACb,GAAG;YACH,iBAAiB;YACjB,MAAM;YACN,gEAAgE;YAChE,mBAAmB;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,gEAAgE;YAChE,qDAAqD;QACvD,CAAC;QAED,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAErC,uCAAuC;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7D,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvD,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE;gBACnE,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO;gBAC/B,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBACnB,KAAK,EAAE,IAAI;gBACX,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;aACzD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAwB,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,YAAY,CAAC,KAAwG,EAAE,MAAM,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA+B;IAE/B,OAAO,IAAI,kCAAkC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"oneShotCompletion.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/transport/oneShotCompletion.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACrG,OAAO,EAAE,QAAQ,EAA0B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,kCAAkC;IAGT,MAAM;IAF1B,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEvD,YAA6B,MAA+B;sBAA/B,MAAM;IAA4B,CAAC;IAEhE,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,OAAkC;QAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;QAEtF,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,MAAM;YACN,SAAS;YACT,KAAK;YACL,aAAa;YACb,GAAG;YACH,iBAAiB;YACjB,MAAM;YACN,gEAAgE;YAChE,mBAAmB;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,gEAAgE;YAChE,qDAAqD;QACvD,CAAC;QAED,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAErC,+FAA+F;QAC/F,yEAAyE;QACzE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7D,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvD,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE;gBACnE,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO;gBAC/B,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBACnB,KAAK,EAAE,IAAI;gBACX,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;aACzD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAwB,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,YAAY,CAAC,KAAwG,EAAE,MAAM,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA+B;IAE/B,OAAO,IAAI,kCAAkC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC"}

package/dist/recommended/RecommendedServicesLedger.d.ts

@@ -0,0 +1,91 @@
+import { type MachineKeyLookup, type MachineSigner } from '../core/AppRecordSignatures.js';
+export declare const NO_REASONS: readonly ['cost', 'privacy', 'not-needed', 'have-another', 'other', 'none'];
+export type NoReason = (typeof NO_REASONS)[number];
+export declare const CHOICE_ORIGINS: readonly ['first-offer', 'change', 'cool-off', 'person-asked', 'owner-surface'];
+export type ChoiceOrigin = (typeof CHOICE_ORIGINS)[number] | `event:${string}`;
+interface RowSignature {
+    machineId: string;
+    signerKeyHash: string;
+    sig: string;
+}
+export interface ChoiceRow extends RowSignature {
+    type: 'choice';
+    eventId: string;
+    service: string;
+    choice: 'yes' | 'no';
+    shutdown: 'none' | 'authorized';
+    reason: NoReason;
+    origin: ChoiceOrigin;
+    offerTextHash: string;
+    supersedes: string[];
+    at: string;
+}
+export interface LegacyImportRow extends RowSignature {
+    type: 'legacy-import';
+    eventId: string;
+    service: string;
+    at: string;
+}
+export type LedgerRow = ChoiceRow | LegacyImportRow;
+export interface EffectiveChoice {
+    service: string;
+    choice: 'unset' | 'yes' | 'no';
+    origin: ChoiceOrigin | null;
+    /** A no refuses offers. Only an authorized shutdown stops a running service. */
+    shutdown: 'none' | 'authorized';
+    reason: NoReason | null;
+    /** An imported legacy decline: suppresses offers, grants and stops nothing. */
+    legacyDeclined: boolean;
+    at: string | null;
+}
+/** Validate a row's shape, not its signature. Exact fields only. */
+export declare function validateRow(raw: unknown): LedgerRow | null;
+/** One effective choice per service. A pure fold, so every machine reaches the same answer. */
+export declare function foldChoice(service: string, rows: readonly LedgerRow[]): EffectiveChoice;
+export declare function recommendedServicesDir(stateDir: string): string;
+export type IngestResult = 'added' | 'duplicate' | 'invalid' | 'bad-signature' | 'unverifiable' | 'full';
+export interface RecommendedServicesLedgerOptions {
+    stateDir: string;
+    signer: MachineSigner;
+    keyLookup: MachineKeyLookup;
+    now?: () => Date;
+}
+export declare class RecommendedServicesLedger {
+    private readonly opts;
+    private readonly file;
+    private readonly rows;
+    private hook;
+    private replicating;
+    constructor(opts: RecommendedServicesLedgerOptions);
+    setReplicationHook(hook: (row: LedgerRow) => void): void;
+    /** Set by the server from the store's real state: its emission is on, and peers pull. */
+    setReplicating(on: boolean): void;
+    /** False when choices stay on this machine. */
+    isReplicating(): boolean;
+    all(): LedgerRow[];
+    effective(service: string): EffectiveChoice;
+    /** The person's no. Sticky until a confirmed yes names it. */
+    recordNo(input: {
+        service: string;
+        shutdown: 'none' | 'authorized';
+        reason: NoReason;
+        origin: ChoiceOrigin;
+        offerTextHash?: string;
+    }): ChoiceRow;
+    /** A confirmed yes replaces every no standing at this moment, and only those. */
+    recordYes(input: {
+        service: string;
+        origin: ChoiceOrigin;
+        offerTextHash: string;
+    }): ChoiceRow;
+    /** Idempotent per service: one import row is enough, whichever machine wrote it. */
+    recordLegacyImport(service: string): LegacyImportRow | null;
+    /** A peer's row lands only when it verifies under the pinned key of the machine it names. */
+    ingestReplicated(raw: unknown): IngestResult;
+    private appendChoice;
+    private signAndStore;
+    private store;
+    private at;
+}
+export {};
+//# sourceMappingURL=RecommendedServicesLedger.d.ts.map

package/dist/recommended/RecommendedServicesLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesLedger.d.ts","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesLedger.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAC1C,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,UAAU,YAAI,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AACtG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,eAAO,MAAM,cAAc,YAAI,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAC9G,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAE/E,UAAU,YAAY;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAEhF,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAeD,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAwB1D;AAED,+FAA+F;AAC/F,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,eAAe,CAgBvF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,MAAM,CAAC;AAEzG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,yBAAyB;IAMxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,IAAI,CAA2C;IACvD,OAAO,CAAC,WAAW,CAAS;IAE5B,YAA6B,IAAI,EAAE,gCAAgC,EAQlE;IAED,kBAAkB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAEvD;IAED,yFAAyF;IACzF,cAAc,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAEhC;IAED,+CAA+C;IAC/C,aAAa,IAAI,OAAO,CAEvB;IAED,GAAG,IAAI,SAAS,EAAE,CAEjB;IAED,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAE1C;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAE/I;IAED,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAM5F;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAG1D;IAED,6FAA6F;IAC7F,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAgB3C;IAED,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,EAAE;CAGX"}

package/dist/recommended/RecommendedServicesLedger.js

@@ -0,0 +1,193 @@
+/**
+ * The record of a person's choices about recommended outside services
+ * (docs/specs/recommended-services.md).
+ *
+ * Append-only and signed per row by the writing machine's identity key, because auth tokens
+ * differ between machines. Rows replicate as the `recommendedServices` store and fold into one
+ * effective choice: a no stands until a yes names it in `supersedes`, so delayed replication
+ * and clock skew cannot undo a refusal. Imported legacy declines only suppress offers. They
+ * never count in the merge and never stop a running service.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ledgerRowPayload, readJsonlLines, verifyMachineSignature, } from '../core/AppRecordSignatures.js';
+export const NO_REASONS = ['cost', 'privacy', 'not-needed', 'have-another', 'other', 'none'];
+export const CHOICE_ORIGINS = ['first-offer', 'change', 'cool-off', 'person-asked', 'owner-surface'];
+const SERVICE_RE = /^[a-z][a-z0-9-]{0,63}$/;
+const ID_RE = /^[0-9a-f]{32}$/;
+const ORIGIN_RE = /^event:[a-z][a-z0-9-]{0,63}$/;
+const MAX_ROWS = 10_000;
+function signature(r) {
+    const { machineId, signerKeyHash, sig } = r;
+    if (typeof machineId !== 'string' || !machineId || machineId.length > 128)
+        return null;
+    if (typeof signerKeyHash !== 'string' || !signerKeyHash || signerKeyHash.length > 128)
+        return null;
+    if (typeof sig !== 'string' || !sig || sig.length > 512)
+        return null;
+    return { machineId, signerKeyHash, sig };
+}
+/** Validate a row's shape, not its signature. Exact fields only. */
+export function validateRow(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    const s = signature(r);
+    if (!s)
+        return null;
+    const { eventId, service, at } = r;
+    if (typeof eventId !== 'string' || !ID_RE.test(eventId))
+        return null;
+    if (typeof service !== 'string' || !SERVICE_RE.test(service))
+        return null;
+    if (typeof at !== 'string' || !Number.isFinite(Date.parse(at)))
+        return null;
+    if (r.type === 'legacy-import')
+        return { type: 'legacy-import', eventId, service, at, ...s };
+    if (r.type !== 'choice')
+        return null;
+    const { choice, shutdown, reason, origin, offerTextHash, supersedes } = r;
+    if (choice !== 'yes' && choice !== 'no')
+        return null;
+    if (shutdown !== 'none' && shutdown !== 'authorized')
+        return null;
+    if (!NO_REASONS.includes(reason))
+        return null;
+    if (typeof origin !== 'string')
+        return null;
+    if (!CHOICE_ORIGINS.includes(origin) && !ORIGIN_RE.test(origin))
+        return null;
+    if (typeof offerTextHash !== 'string' || offerTextHash.length > 128)
+        return null;
+    if (!Array.isArray(supersedes) || supersedes.length > 256)
+        return null;
+    if (!supersedes.every((id) => typeof id === 'string' && ID_RE.test(id)))
+        return null;
+    return {
+        type: 'choice', eventId, service, choice, shutdown, reason: reason,
+        origin: origin, offerTextHash, supersedes: supersedes, at, ...s,
+    };
+}
+/** One effective choice per service. A pure fold, so every machine reaches the same answer. */
+export function foldChoice(service, rows) {
+    const own = rows.filter((r) => r.service === service);
+    const choices = own.filter((r) => r.type === 'choice');
+    const replaced = new Set(choices.filter((c) => c.choice === 'yes').flatMap((c) => c.supersedes));
+    const byNewest = (a, b) => (a.at === b.at ? (a.eventId < b.eventId ? 1 : -1) : a.at < b.at ? 1 : -1);
+    const liveNos = choices.filter((c) => c.choice === 'no' && !replaced.has(c.eventId)).sort(byNewest);
+    const yeses = choices.filter((c) => c.choice === 'yes').sort(byNewest);
+    const legacyDeclined = own.some((r) => r.type === 'legacy-import');
+    const winner = liveNos[0] ?? yeses[0];
+    if (!winner)
+        return { service, choice: 'unset', origin: null, shutdown: 'none', reason: null, legacyDeclined, at: null };
+    const shutdown = liveNos.some((n) => n.shutdown === 'authorized') ? 'authorized' : 'none';
+    return {
+        service, choice: winner.choice, origin: winner.origin,
+        shutdown: winner.choice === 'no' ? shutdown : 'none',
+        reason: winner.choice === 'no' ? winner.reason : null, legacyDeclined, at: winner.at,
+    };
+}
+export function recommendedServicesDir(stateDir) {
+    return path.join(stateDir, 'state', 'recommended-services');
+}
+export class RecommendedServicesLedger {
+    opts;
+    file;
+    rows = new Map();
+    hook = null;
+    replicating = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.file = path.join(recommendedServicesDir(opts.stateDir), 'ledger.jsonl');
+        for (const line of readJsonlLines(this.file)) {
+            try {
+                const row = validateRow(JSON.parse(line));
+                if (row)
+                    this.rows.set(row.eventId, row);
+            }
+            catch { /* @silent-fallback-ok — one torn line; the row is re-read from peer streams at boot */ }
+        }
+    }
+    setReplicationHook(hook) {
+        this.hook = hook;
+    }
+    /** Set by the server from the store's real state: its emission is on, and peers pull. */
+    setReplicating(on) {
+        this.replicating = on;
+    }
+    /** False when choices stay on this machine. */
+    isReplicating() {
+        return this.replicating;
+    }
+    all() {
+        return [...this.rows.values()];
+    }
+    effective(service) {
+        return foldChoice(service, this.all());
+    }
+    /** The person's no. Sticky until a confirmed yes names it. */
+    recordNo(input) {
+        return this.appendChoice({ ...input, choice: 'no', supersedes: [] });
+    }
+    /** A confirmed yes replaces every no standing at this moment, and only those. */
+    recordYes(input) {
+        const replaced = new Set(this.all().flatMap((r) => (r.type === 'choice' && r.choice === 'yes' ? r.supersedes : [])));
+        const supersedes = this.all()
+            .filter((r) => r.type === 'choice' && r.service === input.service && r.choice === 'no' && !replaced.has(r.eventId))
+            .map((r) => r.eventId);
+        return this.appendChoice({ ...input, choice: 'yes', shutdown: 'none', reason: 'none', supersedes });
+    }
+    /** Idempotent per service: one import row is enough, whichever machine wrote it. */
+    recordLegacyImport(service) {
+        if (this.all().some((r) => r.type === 'legacy-import' && r.service === service))
+            return null;
+        return this.signAndStore({ type: 'legacy-import', eventId: newId(), service, at: this.at() });
+    }
+    /** A peer's row lands only when it verifies under the pinned key of the machine it names. */
+    ingestReplicated(raw) {
+        const row = validateRow(raw);
+        if (!row)
+            return 'invalid';
+        if (this.rows.has(row.eventId))
+            return 'duplicate';
+        if (this.rows.size >= MAX_ROWS)
+            return 'full';
+        const { sig, ...unsigned } = row;
+        const verdict = verifyMachineSignature(this.opts.keyLookup, { machineId: row.machineId, signerKeyHash: row.signerKeyHash, sig }, ledgerRowPayload(unsigned), Date.parse(row.at));
+        if (verdict === 'bad')
+            return 'bad-signature';
+        if (verdict !== 'ok')
+            return 'unverifiable';
+        this.store(row);
+        return 'added';
+    }
+    appendChoice(input) {
+        return this.signAndStore({
+            type: 'choice', eventId: newId(), service: input.service, choice: input.choice, shutdown: input.shutdown,
+            reason: input.reason, origin: input.origin, offerTextHash: input.offerTextHash ?? '', supersedes: input.supersedes, at: this.at(),
+        });
+    }
+    signAndStore(fields) {
+        const unsigned = { ...fields, machineId: this.opts.signer.machineId(), signerKeyHash: this.opts.signer.signerKeyHash() };
+        const { sig } = this.opts.signer.sign(ledgerRowPayload(unsigned));
+        const row = validateRow({ ...unsigned, sig });
+        if (!row)
+            throw new Error('recommended-services: refused to write a malformed row');
+        this.store(row);
+        this.hook?.(row);
+        return row;
+    }
+    store(row) {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        fs.appendFileSync(this.file, `${JSON.stringify(row)}\n`);
+        this.rows.set(row.eventId, row);
+    }
+    at() {
+        return (this.opts.now?.() ?? new Date()).toISOString();
+    }
+}
+function newId() {
+    return crypto.randomBytes(16).toString('hex');
+}
+//# sourceMappingURL=RecommendedServicesLedger.js.map

package/dist/recommended/RecommendedServicesLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesLedger.js","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,GAEzD,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEtG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAuC9G,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,SAAS,SAAS,CAAC,CAA0B;IAC3C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACvF,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7F,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAkB;QAC9E,MAAM,EAAE,MAAsB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAsB,EAAE,EAAE,EAAE,GAAG,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAA0B;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAE,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACpD,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAC9D,CAAC;AAWD,MAAM,OAAO,yBAAyB;IAMP,IAAI;IALhB,IAAI,CAAS;IACb,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,IAAI,GAAsC,IAAI,CAAC;IAC/C,WAAW,GAAG,KAAK,CAAC;IAE5B,YAA6B,IAAsC;oBAAtC,IAAI;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC,CAAC,uFAAuF,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,IAA8B;QAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,yFAAyF;IACzF,cAAc,CAAC,EAAW;QACxB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,+CAA+C;IAC/C,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAA2H;QAClI,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,SAAS,CAAC,KAAuE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;aAClI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAe;QAChC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAoB,CAAC;IACnH,CAAC;IAED,6FAA6F;IAC7F,gBAAgB,CAAC,GAAY;QAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC9C,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,OAAO,GAAG,sBAAsB,CACpC,IAAI,CAAC,IAAI,CAAC,SAAS,EACnB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,EACnE,gBAAgB,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACnB,CAAC;QACF,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,eAAe,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAAC,KAAqH;QACxI,OAAO,IAAI,CAAC,YAAY,CAAC;YACvB,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxG,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;SAClI,CAAc,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,MAA+B;QAClD,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;QACzH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,GAAc;QAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IAEO,EAAE;QACR,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,CAAC;CACF;AAED,SAAS,KAAK;IACZ,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/recommended/RecommendedServicesReplicatedStore.d.ts

@@ -0,0 +1,14 @@
+import type { StoreFieldSchema } from '../core/ReplicatedRecordEnvelope.js';
+import type { HlcTimestamp } from '../core/HybridLogicalClock.js';
+import { type LedgerRow } from './RecommendedServicesLedger.js';
+export declare const RECOMMENDED_SERVICE_RECORD_KIND = "recommended-service-record";
+export declare const RECOMMENDED_SERVICES_STORE_KEY = "recommendedServices";
+export declare function deriveRecommendedServiceRecordKey(eventId: string): string;
+export declare const recommendedServiceStoreSchema: StoreFieldSchema;
+export declare function buildRecommendedServiceRecordData(row: LedgerRow): (hlc: HlcTimestamp, origin: string, observed?: HlcTimestamp) => Record<string, unknown> | null;
+export declare const RECOMMENDED_SERVICES_KIND_REGISTRATION: {
+    readonly kind: "recommended-service-record";
+    readonly store: "recommendedServices";
+    readonly schema: StoreFieldSchema;
+};
+//# sourceMappingURL=RecommendedServicesReplicatedStore.d.ts.map

package/dist/recommended/RecommendedServicesReplicatedStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesReplicatedStore.d.ts","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesReplicatedStore.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,qCAAqC,CAAC;AAChH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE7E,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAC5E,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAIpE,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,6BAA6B,EAAE,gBAM3C,CAAC;AAEF,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,SAAS,SACjD,YAAY,UAAU,MAAM,aAAa,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMpG;AAED,eAAO,MAAM,sCAAsC;aACjD,IAAI;aACJ,KAAK;aACL,MAAM;CACE,CAAC"}

package/dist/recommended/RecommendedServicesReplicatedStore.js

@@ -0,0 +1,34 @@
+/**
+ * The `recommendedServices` replicated-store kind (docs/specs/recommended-services.md,
+ * Multi-machine posture). Rows are immutable and keyed by eventId, so the union has no
+ * conflicts. The ledger verifies each row's signature before it lands.
+ */
+import crypto from 'node:crypto';
+import { validateRow } from './RecommendedServicesLedger.js';
+export const RECOMMENDED_SERVICE_RECORD_KIND = 'recommended-service-record';
+export const RECOMMENDED_SERVICES_STORE_KEY = 'recommendedServices';
+const KNOWN = ['row'];
+export function deriveRecommendedServiceRecordKey(eventId) {
+    return crypto.createHash('sha256').update(`recommended-services\u0000${eventId}`).digest('hex');
+}
+export const recommendedServiceStoreSchema = {
+    knownFields: KNOWN,
+    validate(raw, _ctx) {
+        const row = validateRow(raw.row);
+        return row ? { row } : null;
+    },
+};
+export function buildRecommendedServiceRecordData(row) {
+    return (hlc, origin, observed) => ({
+        row,
+        recordKey: deriveRecommendedServiceRecordKey(row.eventId),
+        hlc, op: 'put', origin,
+        ...(observed !== undefined ? { observed } : {}),
+    });
+}
+export const RECOMMENDED_SERVICES_KIND_REGISTRATION = {
+    kind: RECOMMENDED_SERVICE_RECORD_KIND,
+    store: RECOMMENDED_SERVICES_STORE_KEY,
+    schema: recommendedServiceStoreSchema,
+};
+//# sourceMappingURL=RecommendedServicesReplicatedStore.js.map

package/dist/recommended/RecommendedServicesReplicatedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesReplicatedStore.js","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesReplicatedStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAkB,MAAM,gCAAgC,CAAC;AAE7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAAqB,CAAC;AAEpE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAU,CAAC;AAE/B,MAAM,UAAU,iCAAiC,CAAC,OAAe;IAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,WAAW,EAAE,KAAyC;IACtD,QAAQ,CAAC,GAAsC,EAAE,IAA0B;QACzE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,GAAc;IAC9D,OAAO,CAAC,GAAiB,EAAE,MAAc,EAAE,QAAuB,EAAkC,EAAE,CAAC,CAAC;QACtG,GAAG;QACH,SAAS,EAAE,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QACzD,GAAG,EAAE,EAAE,EAAE,KAAqB,EAAE,MAAM;QACtC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,8BAA8B;IACrC,MAAM,EAAE,6BAA6B;CAC7B,CAAC"}

package/dist/recommended/legacyDeclines.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Maps the two old features whose offers these services replace
+ * (docs/specs/recommended-services.md, Store and Offers). The old offer paths refuse these ids
+ * in every state, and a person's old decline carries over as an import.
+ */
+import type { RecommendedServicesLedger } from './RecommendedServicesLedger.js';
+export declare const LEGACY_FEATURE_TO_SERVICE: Readonly<Record<string, string>>;
+export declare function isRetiredLegacyOffer(featureId: string): boolean;
+/** Import old declines before any list is built. Safe to run at every boot. */
+export declare function importLegacyDeclines(ledger: RecommendedServicesLedger, stateOf: (featureId: string) => string | null): number;
+//# sourceMappingURL=legacyDeclines.d.ts.map

package/dist/recommended/legacyDeclines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyDeclines.d.ts","sourceRoot":"","sources":["../../src/recommended/legacyDeclines.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrE,CAAC;AAEH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,yBAAyB,EACjC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAC5C,MAAM,CAMR"}

package/dist/recommended/legacyDeclines.js

@@ -0,0 +1,17 @@
+export const LEGACY_FEATURE_TO_SERVICE = Object.freeze({
+    'cloudflare-tunnel': 'cloudflare-domain',
+    'git-backup': 'github-state-backup',
+});
+export function isRetiredLegacyOffer(featureId) {
+    return Object.prototype.hasOwnProperty.call(LEGACY_FEATURE_TO_SERVICE, featureId);
+}
+/** Import old declines before any list is built. Safe to run at every boot. */
+export function importLegacyDeclines(ledger, stateOf) {
+    let imported = 0;
+    for (const [featureId, service] of Object.entries(LEGACY_FEATURE_TO_SERVICE)) {
+        if (stateOf(featureId) === 'declined' && ledger.recordLegacyImport(service))
+            imported += 1;
+    }
+    return imported;
+}
+//# sourceMappingURL=legacyDeclines.js.map

package/dist/recommended/legacyDeclines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyDeclines.js","sourceRoot":"","sources":["../../src/recommended/legacyDeclines.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,yBAAyB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACvF,mBAAmB,EAAE,mBAAmB;IACxC,YAAY,EAAE,qBAAqB;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAClC,MAAiC,EACjC,OAA6C;IAE7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/recommended/serviceIds.d.ts

@@ -0,0 +1,3 @@
+/** The services a person can choose about (docs/specs/recommended-services.md, The catalog). */
+export declare const RECOMMENDED_SERVICE_IDS: readonly string[];
+//# sourceMappingURL=serviceIds.d.ts.map

package/dist/recommended/serviceIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceIds.d.ts","sourceRoot":"","sources":["../../src/recommended/serviceIds.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGnD,CAAC"}

package/dist/recommended/serviceIds.js

@@ -0,0 +1,6 @@
+/** The services a person can choose about (docs/specs/recommended-services.md, The catalog). */
+export const RECOMMENDED_SERVICE_IDS = Object.freeze([
+    'tailscale', 'cloudflare-domain', 'telegram', 'jev', 'bitwarden',
+    'github-state-backup', 'second-ai-door', 'voice-transcription', 'email',
+]);
+//# sourceMappingURL=serviceIds.js.map

package/dist/recommended/serviceIds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceIds.js","sourceRoot":"","sources":["../../src/recommended/serviceIds.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW;IAChE,qBAAqB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,OAAO;CACxE,CAAC,CAAC"}

package/dist/scaffold/templates.d.ts

@@ -118,6 +118,8 @@ export declare const REROUTED_LOGIN_EXPIRED_MARKER = "A job session stuck at an
 /** Rerouted-job expired-login awareness bullet. Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export declare const REROUTED_LOGIN_EXPIRED_BULLET = "- **A job session stuck at an expired login is ended in minutes**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows `Login expired \u00B7 Please run /login` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason `rerouted-login-expired`, a `SessionManager.monitorTick.reroutedLoginExpired` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. It also reports the sighting to the quota poller, which alone decides pool status: when that screen is Claude Code's own message line and the login's saved credential still reads, the account turns needs-reauth at once (cause `cli-login-expired-observed`) and the automatic sign-in repair starts; when the saved credential cannot be read, it takes two different sessions under that login showing the screen within an hour. If a user asks \"why did my scheduled jobs stop running?\" or \"why did a job end straight away?\" \u2014 check `GET /jobs` for a stale `nextScheduled`, then the server log for `stuck at an expired login`; the fix is signing that login in again.";
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export declare const CLAUDE_KEY_HEALTH_MARKER = "A rejected sign-in key is told and recovers";
+export declare const CLAUDE_KEY_HEALTH_BULLET = "- **A rejected sign-in key is told and recovers**: an agent signed in with one key (`sessions.credentials.anthropic`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and `GET /health` (with the auth header) shows `claudeKey.status: dead`. The fix is a new key from `claude setup-token`, put in place with `instar set-claude-key` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks \"why did you stop replying?\" or \"why does health say the model is failing?\" \u2192 read `claudeKey` in `GET /health`. Off switches: `sessions.claudeKeyHealth.enabled: false` and `sessions.claudeChildAuth.enabled: false`.";
 export declare const INTERACTIVE_LOGIN_EXPIRED_MARKER = "A conversation stuck at an expired login moves to a signed-in account";
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export declare const INTERACTIVE_LOGIN_EXPIRED_BULLET = "- **A conversation stuck at an expired login moves to a signed-in account**: a Telegram/topic session placed on a pool login whose Claude sign-in has expired shows `Login expired \u00B7 Please run /login` (newer Claude Code: `Not logged in \u00B7 Run /login`) on every turn. About a minute after the monitor first sees that screen in the session's live tail it (1) marks that account needs-reauth (cause `cli-login-expired-observed`, so new sessions avoid it and the automatic sign-in repair can start) \u2014 even when the saved token still reads quota, because the CLI's own screen is the stronger evidence, and a later quota poll does not flip it back while the saved credential is unchanged (a sign-in repair, or you setting it active again, always wins); and (2) resumes the session on a signed-in account through the same swap as `POST /subscription-pool/swap` (conversation preserved; one attempt per session per 10 minutes, at most three; protected sessions are never moved). Only Claude Code's own message line counts: a stale mention scrolled up the screen, a message quoting the text, or a tool result such as `claude auth status` printing it never triggers it. If the login's saved credential cannot be read at all (e.g. a locked keychain), one screen is not enough and the session is not moved until the account is confirmed dead. Off switch for the swap only: `subscriptionPool.loginExpiredSwap.enabled: false` (read live). If a user asks \"why did my conversation suddenly switch accounts?\" or \"why is this account showing needs sign-in when its quota looks fine?\" \u2014 check the server log for `stuck at an expired login` and `[LoginExpiredRecovery]`; a failed swap also reports a `SessionManager.monitorTick.interactiveLoginExpired` degradation. The fix for the account itself is signing that login in again.";

package/dist/scaffold/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CAq8DR;AAED,uDAAuD;AACvD,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2UR;AAED;;oDAEoD;AACpD,eAAO,MAAM,0BAA0B,8EAAwE,CAAC;AAChH,eAAO,MAAM,0BAA0B,8KAA2H,CAAC;AAEnK;gEACgE;AAChE,eAAO,MAAM,2BAA2B,gCAA2B,CAAC;AACpE,eAAO,MAAM,2BAA2B,iKAAkK,CAAC;AAE3M;;8DAE8D;AAC9D,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;mFACmF;AACnF,eAAO,MAAM,sCAAsC,qEAAqE,CAAC;AAEzH;;;;;;;;GAQG;AACH,yGAAyG;AACzG,eAAO,MAAM,wBAAwB,gXAAoX,CAAC;AAE1Z,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAexD;AAED,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B,mDAAmD,CAAC;AAE9F,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,kDAAkD,CAAC;AAE7F,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,qqCAAkpC,CAAC;AAE7rC,eAAO,MAAM,4BAA4B,sCAAsC,CAAC;AAEhF,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,0rBAAmrB,CAAC;AAE7tB,sEAAsE;AACtE,eAAO,MAAM,cAAc,8CAA+C,CAAC;AAC3E,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AACxE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,8tBAAkuB,CAAC;AAExwB;sDACsD;AACtD,eAAO,MAAM,cAAc,wvBAA0tB,CAAC;AAEtvB,eAAO,MAAM,qBAAqB,wDAAwD,CAAC;AAC3F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAwkL,CAAC;AAE5nL,eAAO,MAAM,wBAAwB,kDAAkD,CAAC;AAExF;sDACsD;AACtD,eAAO,MAAM,wBAAwB,yhCAAshC,CAAC;AAE5jC,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,mFAAmF,CAAC;AACvI,oHAAoH;AACpH,eAAO,MAAM,uCAAuC,kUAAkU,CAAC;AACvX,eAAO,MAAM,oCAAoC,2aAA2a,CAAC;AAC7d,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,gEAAgE,CAAC;AAE3G,6GAA6G;AAC7G,eAAO,MAAM,6BAA6B,stCAA0zB,CAAC;AAEr2B,kGAAkG;AAClG,eAAO,MAAM,gCAAgC,0EAA0E,CAAC;AAExH,uHAAuH;AACvH,eAAO,MAAM,gCAAgC,2yDAAmwD,CAAC;AAEjzD;+EAC+E;AAC/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,o4CAA+3C,CAAC;AAEn6C,eAAO,MAAM,6BAA6B,qvBAAquB,CAAC;AAEhxB;;+DAE+D;AAC/D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,wFAAwF,CAAC;AAEtI;;+DAE+D;AAC/D,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,6HAA6H,CAAC;AACtK,uGAAuG;AACvG,eAAO,MAAM,6BAA6B,+DAA+D,CAAC;AAE1G;;;wBAGwB;AACxB,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAGD;;+DAE+D;AAC/D,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;2DAE2D;AAC3D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;+DAE+D;AAC/D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CA08DR;AAED,uDAAuD;AACvD,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2UR;AAED;;oDAEoD;AACpD,eAAO,MAAM,0BAA0B,8EAAwE,CAAC;AAChH,eAAO,MAAM,0BAA0B,8KAA2H,CAAC;AAEnK;gEACgE;AAChE,eAAO,MAAM,2BAA2B,gCAA2B,CAAC;AACpE,eAAO,MAAM,2BAA2B,iKAAkK,CAAC;AAE3M;;8DAE8D;AAC9D,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;mFACmF;AACnF,eAAO,MAAM,sCAAsC,qEAAqE,CAAC;AAEzH;;;;;;;;GAQG;AACH,yGAAyG;AACzG,eAAO,MAAM,wBAAwB,gXAAoX,CAAC;AAE1Z,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAexD;AAED,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B,mDAAmD,CAAC;AAE9F,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,kDAAkD,CAAC;AAE7F,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,qqCAAkpC,CAAC;AAE7rC,eAAO,MAAM,4BAA4B,sCAAsC,CAAC;AAEhF,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,0rBAAmrB,CAAC;AAE7tB,sEAAsE;AACtE,eAAO,MAAM,cAAc,8CAA+C,CAAC;AAC3E,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AACxE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,8tBAAkuB,CAAC;AAExwB;sDACsD;AACtD,eAAO,MAAM,cAAc,wvBAA0tB,CAAC;AAEtvB,eAAO,MAAM,qBAAqB,wDAAwD,CAAC;AAC3F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAwkL,CAAC;AAE5nL,eAAO,MAAM,wBAAwB,kDAAkD,CAAC;AAExF;sDACsD;AACtD,eAAO,MAAM,wBAAwB,yhCAAshC,CAAC;AAE5jC,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,mFAAmF,CAAC;AACvI,oHAAoH;AACpH,eAAO,MAAM,uCAAuC,kUAAkU,CAAC;AACvX,eAAO,MAAM,oCAAoC,2aAA2a,CAAC;AAC7d,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,gEAAgE,CAAC;AAE3G,6GAA6G;AAC7G,eAAO,MAAM,6BAA6B,stCAA0zB,CAAC;AAEr2B,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,gDAAgD,CAAC;AACtF,eAAO,MAAM,wBAAwB,miCAA4hC,CAAC;AAElkC,eAAO,MAAM,gCAAgC,0EAA0E,CAAC;AAExH,uHAAuH;AACvH,eAAO,MAAM,gCAAgC,2yDAAmwD,CAAC;AAEjzD;+EAC+E;AAC/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,o4CAA+3C,CAAC;AAEn6C,eAAO,MAAM,6BAA6B,qvBAAquB,CAAC;AAEhxB;;+DAE+D;AAC/D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,wFAAwF,CAAC;AAEtI;;+DAE+D;AAC/D,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,6HAA6H,CAAC;AACtK,uGAAuG;AACvG,eAAO,MAAM,6BAA6B,+DAA+D,CAAC;AAE1G;;;wBAGwB;AACxB,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAGD;;+DAE+D;AAC/D,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;2DAE2D;AAC3D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;+DAE+D;AAC/D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}

package/dist/scaffold/templates.js

@@ -19,7 +19,10 @@ import { JOB_DECLARED_FAILURE_AWARENESS } from "../scheduler/jobDeclaredFailure.
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
 import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, MATURATION_LADDER_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, MOBILE_PEOPLE_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, SESSION_HANDOFF_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION, MACHINE_BROWSER_CARE_CLAUDEMD_SECTION, PAIRING_WITHOUT_TELEGRAM_CLAUDEMD_SECTION, SLACK_FROM_APP_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_POOL_CLAUDEMD_SECTION, MACHINE_WEDGE_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { SURFACE_REFERRAL_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { RECOMMENDED_SERVICES_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { MINIMUM_OPERATOR_EFFORT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { POOL_READINESS_CLAUDE_MD_LINE } from '../core/PostUpdateMigrator.js';
 import { CODEX_DEVICE_LIMIT_CLAUDEMD_BULLET } from '../core/PostUpdateMigrator.js';
 import { UPDATE_APPLY_VERIFY_HOLD_CLAUDEMD_LINE } from '../core/PostUpdateMigrator.js';
 /**
@@ -417,6 +420,7 @@ ${REAPER_BACKGROUND_WORK_BULLET}
 ${STANDING_SESSIONS_BULLET}
 ${REROUTED_LOGIN_EXPIRED_BULLET}
 ${INTERACTIVE_LOGIN_EXPIRED_BULLET}
+${CLAUDE_KEY_HEALTH_BULLET}
 - **Busy-orphan detection** (\`busyOrphanDetection\`, OBSERVE-ONLY, dark by default; dev agents on): the inverse blind spot. CPU-progress is a proxy for "useful" — but a *useless* process that SPINS (a hot-loop, a wedged job burning CPU) looks "active" and would keep a session pinned. When an idle session (idle prompt + flat transcript) is held only by a child that's *burning* CPU across an extended dwell, the reaper records a \`busy-orphan-suspected\` audit row (and \`busy-orphan-cleared\` on recovery). It NEVER changes the keep/kill decision — it just makes the "useless-but-busy child pins an idle session" case measurable, so safe auto-reclaim can graduate later with data. Read \`logs/reaper-audit.jsonl\` (filter \`busy-orphan-suspected\`).
 - Why it matters: idle sessions pile up across agents until the machine starves (CPU *or* memory) and new sessions get "spawn denied" — silently breaking cross-agent messaging. This sweeps them, but only under real pressure.
 - See current state / why each session is kept or flagged: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/sessions/reaper\` (the \`pressure.inputs\` shows freePct, loadPerCore, \`cpuBusyPct\` — real sampled CPU busy %, the signal that decides \`cpuTier\` since reaper-pressure-signals; the 1-min load average is reported but no longer decisive, because it read 9.4/core at 36-44% idle (its macOS computation is poorly documented; the measured disagreement is the evidence) — plus the compressor OBSERVABLES \`compressorPct\`, \`decompressionsPerSec\` and \`kernelMemoryPressureLevel\` (reported, grading nothing: none of them separated that laptop from a healthy machine when measured) — plus \`cpuSignal\`, \`sampledAt\`, \`windowMs\` and the memTier/cpuTier breakdown. A CPU figure appears only once a full 30 s window has elapsed; shorter is \`null\` (unknown ⇒ memory-only), never a startup spike. Rollback lever: \`monitoring.sessionReaper.cpuSignal: 'load'\` restores the legacy grading exactly; the busy thresholds are \`cpuModerateBusyPct\`/\`cpuCriticalBusyPct\` (75/90), and there are no compressor thresholds because no compressor grade ships). On a machine pool, add \`?scope=pool\` to get every machine's snapshot; the local snapshot stays at the top level and \`pool.machines\` carries peers. A dark, old, unreachable, or malformed peer is a classified \`pool.failed\` row — never a 500 or a silently local-looking answer.
@@ -604,7 +608,8 @@ Two layers keep my machine-to-machine \"ropes\" (Tailscale / LAN / Cloudflare) h
 - **Idle vs broken machine (WS4.2):** the same \`pool.machines[]\` carries an explicit per-machine state so an idle machine never reads as broken. A machine with ZERO sessions gets \`pool.machines[].emptyState\` = \`online — no active sessions\` (heartbeat-fresh, just idle) / \`offline since <t>\` (known offline) / \`unreachable (last seen <t>)\` (was online, now not answering — the \`failed\` case). Honest derivation from the registry online flag + last-seen + the live fan-out — never a fabricated "looks fine". The dashboard sessions view renders these per-machine; a machine WITH sessions gets no empty-state (its tiles already name it). Single-machine install = just the lone self row.
 - **Honest machine state (trustworthy-machine-load, P1):** every \`pool.machines[]\` row now carries \`liveness\` = \`live\` / \`unreachable\` (shape \`struggling\` | \`refusing\` | \`silent\`) / \`stale\` / \`unknown\`, each with the evidence age and source, plus a ready-made \`livenessLine\` (\`<liveness>, last evidence <age> ago from <source>\`) and the freshest other-machine sighting ("Mac Mini reached it 3 min ago"). The last DIRECT contact is saved to disk, so a server restart renders \`stale, last evidence 20 min ago\` instead of "offline". **Never say a machine is "offline" without positive evidence** (a shutdown announcement or the sleep gate): quote the liveness, its age and its source — an overloaded machine looks exactly like a dead one to a plain timeout. Each row also carries a multi-signal \`loadReport\` (cores, CPU idle, available memory, native memory pressure, server event-loop lag, sessions in use) and \`loadVerdict\` = \`ok\` / \`elevated\` / \`saturated\` / \`impaired\` / \`unknown\` — a report older than 60 s reads \`unknown\`, and a peer on older code reads \`unknown\`, never \`ok\`. Reporting only: the \`online\` flag, placement and ownership keep their existing semantics in this phase.
 - **Overload admission (trustworthy-machine-load, P2):** each machine protects its own resources. When its own \`loadVerdict\` is \`saturated\` or \`impaired\` it CLOSES to new automatic work (scheduled jobs, helpers, placement of new conversations): the work waits and is retried, nothing is dropped, and existing conversations keep working. It reopens after five consecutive good samples (about 75 s). One host-wide **recovery slot** (shared by every agent on the machine) stays free so a session the operator asks for can always start and assess the machine. Placement never puts new work on a machine that is refusing it; if every machine refuses, the message stays in the durable inbound queue (\`all-machines-refusing-work\`). Registry First: \`GET /work-admission\` → \`{ enabled, dryRun, enforced, acceptingWork, lastVerdict, recoverySlot, counters }\`; each machine's \`loadReport.acceptingWork\` / \`admissionEnforced\` in \`GET /pool\`; audit \`logs/work-admission.jsonl\`. Ships dev-gated + dry-run (\`monitoring.workAdmission\`: it logs what it WOULD refuse, refuses nothing, and peers keep placing work here until \`dryRun:false\`). When the user asks "why didn't a job run / why is this machine not taking work?" → read \`GET /work-admission\` before guessing.
-- **Overload shed (trustworthy-machine-load, P3):** a machine that has refused new work for 3 minutes moves its EXISTING conversations off, one at a time, to a healthy machine (direct contact under 2 min, \`loadVerdict\` \`ok\`, not refusing work, at least 2 free session slots after what it has already reserved there). The move is an ordinary cooperative ownership transfer through the reconciler, like a pin move but never written as a pin. Pinned conversations, Slack conversations and conversations with a live autonomous run stay. Brakes: at most 2 moves an hour, 2 tries per conversation per overload episode, the same conversation is not moved again for 30 min, and a machine seen refusing work in the last 30 min never receives moved work. A started transfer is driven to claim or cancelled after its deadline even if the plan behind it is gone. Stale-owner notices say "struggling" or "refusing" when that is the evidence. Registry First: \`GET /overload-shed\` → \`{ enabled, dryRun, overloadedSince, isSource, liveMove, reservations, movesLastHour, counters }\`; audit \`logs/overload-shed.jsonl\`. Ships dev-gated + dry-run (\`monitoring.overloadShed\`: it logs what it WOULD move, moves nothing, and also moves nothing while overload admission is in dry-run). When the user asks "why did my conversation move machines?" or "why is this overloaded machine still holding work?" → read \`GET /overload-shed\` before guessing.
+${POOL_READINESS_CLAUDE_MD_LINE}
+- **Overload shed (trustworthy-machine-load, P3):** a machine that has refused new work for 3 minutes AND is at 85% or more of its session limit moves a conversation off, one at a time, to a healthy machine (direct contact under 2 min, \`loadVerdict\` \`ok\`, not refusing work, at least 2 free session slots after what it has already reserved there). Only conversations with a running session that has sat quiet for 10 minutes move, so this frees session slots and memory, not CPU. The move goes through the same drain as a manual transfer: the session here closes and the conversation carries on there at its next message. Pinned conversations, Slack conversations and conversations with a live autonomous run stay. Brakes: at most 2 moves an hour, 2 tries per conversation per overload episode, a moved conversation stays put for 6 hours wherever it landed, and a machine seen refusing work in the last 30 min never receives moved work. Live moves need pool stage \`rebalance\`, a fresh rebalance proof on this machine, and \`dryRun: false\`; otherwise it only logs what it WOULD move. Each machine earns its proof with \`POST /session-pool/rebalance-proof\` \`{ topic, to }\` (202 with a run id; \`GET /session-pool/rebalance-proof/RUN_ID\` for the result), which really moves a topic listed in \`multiMachine.sessionPool.rebalanceProofTopics\` and passes only if the old session is gone and the target answers once. A proof lasts 30 days; without a fresh one the stage steps down to \`live-transfer\`. Stale-owner notices say "struggling" or "refusing" when that is the evidence. Registry First: \`GET /overload-shed\` → \`{ enabled, dryRun, overloadedSince, isSource, liveMove, reservations, movesLastHour, counters }\`; audit \`logs/overload-shed.jsonl\` (\`would-move\` and \`move-outcome\` rows carry the numbers behind each decision). Ships dev-gated + dry-run (\`monitoring.overloadShed\`). When the user asks "why did my conversation move machines?" or "why is this overloaded machine still holding work?" → read \`GET /overload-shed\` before guessing.
 - **Post-transfer closeout (automatic):** when a topic moves to another machine, the OLD machine's session for it is closed automatically (closed by the transfer's drain step when the current machine can drain, otherwise within ~2 reaper ticks) — no duplicate sessions doing duplicate work. The close is recorded in the reap-log with reason "topic moved to <machine>"; protected sessions are never auto-closed.
 - **Quota-aware placement (automatic):** capacity heartbeats carry each machine's LLM-account quota state, and placement avoids machines whose account is currently rate-limited/blocked (no more topics placed onto a silent machine). A hard pin still wins (flagged \`pinned-machine-quota-blocked\`); if EVERY machine is blocked, placement proceeds least-loaded with \`all-machines-quota-blocked\` flagged. \`GET /pool\` shows each machine's \`quotaState\`.
 - **Signed-out machines are skipped (automatic):** the same heartbeat also says whether the machine has any signed-in account for the framework new conversations run on (from its subscription pool). A machine where every such account needs sign-in reports \`quotaState.reason: no-signed-in-account\`, and placement sends new conversations elsewhere instead of to a session that would sit at "Not logged in". A hard pin still wins (flagged \`pinned-machine-not-signed-in\`). Unknown (no pool, or no account for that framework) never blocks. When the user asks "why did my new topic go silent / land on a machine that can't log in?" → read that machine's \`quotaState\` in \`GET /pool\`.
@@ -1021,6 +1026,7 @@ ${ROUTING_SPEND_CLAUDEMD_SECTION(port)}
 ${MATURATION_BOARD_CLAUDEMD_SECTION(port)}
 ${MATURATION_LADDER_CLAUDEMD_SECTION(port)}
 ${QUEUE_PACE_CLAUDEMD_SECTION(port)}
+${RECOMMENDED_SERVICES_CLAUDEMD_SECTION(port)}
 ${ECOSYSTEM_IDEAS_CLAUDEMD_SECTION(port)}
 ${MOBILE_PAIRING_CLAUDEMD_SECTION(port)}
 ${MOBILE_CHAT_CLAUDEMD_SECTION(port)}
@@ -1822,6 +1828,8 @@ Record what I learn. Build infrastructure, not one-offs. Grow to meet the user's
 Your messages to the user pass an always-on LLM gate (the tone gate) before they send. It reviews high-stakes leaks (CLI commands, file paths, config keys, endpoints) AND the self-stop anti-patterns (B15–B19: quitting on yourself for a context/fatigue reason, calling a doable thing impossible, parking your own work on the user). The two families are treated DIFFERENTLY — the leak/representation rules are overridable nudges (see below); the self-stop family stays a hard block, because there the check exists to constrain YOU and your reason for overriding would come from the very reasoning it distrusts. It judges the behavioral rules **by MEANING, not by literal phrases — a paraphrase of the anti-pattern is caught exactly the same as the canonical wording**, so do not assume rewording evades it. The gate FAILS CLOSED (holds the message, queued for retry — never silently delivers) if it can't produce a verdict (provider down, unparseable output, or a slow-review timeout); the operator kill-switch is \`toneGate.failClosedOnExhaustion\`. Constitution: "Intelligent Prompts — An LLM Gate Must Not String-Match".
 
 ${TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION}
+
+${SURFACE_REFERRAL_CLAUDEMD_SECTION}
 ### Context-Aware Outbound Review (why was my message flagged / would my reply have been blocked?)
 
 Beyond the tone gate, a response-review pipeline (nine specialist reviewers driven by a Stop hook) evaluates each finished conversational turn. On most installs it is OFF BY CONFIG — \`GET /review/history\` returns 501 there; say so honestly rather than guessing. Where it runs, it is usually in WATCH MODE (\`responseReview.observeOnly: true\`): verdicts are recorded, nothing is blocked. The context-aware layer (⚗️ experimental, dev-gated dark: \`responseReview.conversationalContext\`) feeds the opted-in reviewer a bounded, untrusted-data-enveloped slice of recent conversation so "the operator asked for this technical detail" is an input it can actually judge — a one-way carve-out (it can only move a would-block toward PASS, never license credentials/PII, never touch the deterministic policy layer).
@@ -2671,6 +2679,8 @@ export const REROUTED_LOGIN_EXPIRED_MARKER = 'A job session stuck at an expired
 /** Rerouted-job expired-login awareness bullet. Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export const REROUTED_LOGIN_EXPIRED_BULLET = `- **${REROUTED_LOGIN_EXPIRED_MARKER}**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows \`Login expired · Please run /login\` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason \`rerouted-login-expired\`, a \`SessionManager.monitorTick.reroutedLoginExpired\` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. ${REROUTED_LOGIN_EXPIRED_POOL_SENTENCE} If a user asks "why did my scheduled jobs stop running?" or "why did a job end straight away?" — check \`GET /jobs\` for a stale \`nextScheduled\`, then the server log for \`stuck at an expired login\`; the fix is signing that login in again.`;
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export const CLAUDE_KEY_HEALTH_MARKER = 'A rejected sign-in key is told and recovers';
+export const CLAUDE_KEY_HEALTH_BULLET = `- **${CLAUDE_KEY_HEALTH_MARKER}**: an agent signed in with one key (\`sessions.credentials.anthropic\`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and \`GET /health\` (with the auth header) shows \`claudeKey.status: dead\`. The fix is a new key from \`claude setup-token\`, put in place with \`instar set-claude-key\` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks "why did you stop replying?" or "why does health say the model is failing?" → read \`claudeKey\` in \`GET /health\`. Off switches: \`sessions.claudeKeyHealth.enabled: false\` and \`sessions.claudeChildAuth.enabled: false\`.`;
 export const INTERACTIVE_LOGIN_EXPIRED_MARKER = 'A conversation stuck at an expired login moves to a signed-in account';
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export const INTERACTIVE_LOGIN_EXPIRED_BULLET = `- **${INTERACTIVE_LOGIN_EXPIRED_MARKER}**: a Telegram/topic session placed on a pool login whose Claude sign-in has expired shows \`Login expired · Please run /login\` (newer Claude Code: \`Not logged in · Run /login\`) on every turn. About a minute after the monitor first sees that screen in the session's live tail it (1) marks that account needs-reauth (cause \`cli-login-expired-observed\`, so new sessions avoid it and the automatic sign-in repair can start) — even when the saved token still reads quota, because the CLI's own screen is the stronger evidence, and a later quota poll does not flip it back while the saved credential is unchanged (a sign-in repair, or you setting it active again, always wins); and (2) resumes the session on a signed-in account through the same swap as \`POST /subscription-pool/swap\` (conversation preserved; one attempt per session per 10 minutes, at most three; protected sessions are never moved). Only Claude Code's own message line counts: a stale mention scrolled up the screen, a message quoting the text, or a tool result such as \`claude auth status\` printing it never triggers it. If the login's saved credential cannot be read at all (e.g. a locked keychain), one screen is not enough and the session is not moved until the account is confirmed dead. Off switch for the swap only: \`subscriptionPool.loginExpiredSwap.enabled: false\` (read live). If a user asks "why did my conversation suddenly switch accounts?" or "why is this account showing needs sign-in when its quota looks fine?" — check the server log for \`stuck at an expired login\` and \`[LoginExpiredRecovery]\`; a failed swap also reports a \`SessionManager.monitorTick.interactiveLoginExpired\` degradation. The fix for the account itself is signing that login in again.`;