instar 1.3.1661 → 1.3.1663

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAmIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA+J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA4ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AA2mBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAoajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAm6BN;AA+sBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAg03BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAmIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAgK7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA4ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAinBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAoajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAm6BN;AA+sBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+93BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}

package/dist/commands/server.js

@@ -280,6 +280,7 @@ import { ThreadLog } from '../threadline/ThreadLog.js';
 import { ThreadMessageRecorder } from '../threadline/recordThreadMessage.js';
 import { recordInboundAck } from '../threadline/recordInboundAck.js';
 import { isAutoAckInbound, autoAckRecognition, looksLikeAutoAckText, createAckRateLimiter, runRelayAckStage, createRelayAckSettler, describeUndeliveredRouterResult } from '../threadline/autoAck.js';
+import { parseKindedAck } from '../threadline/requiredAck.js';
 /** ACT-091: the session manager's observed paste → the topic handler's inject outcome (starts the busy watch lazily). */
 function liveInjectOutcomeFromObservation(r) {
     if (r.state === 'queued-busy')
@@ -1132,6 +1133,12 @@ let _handbackSendOffer = null;
 // `_a2aAskTopicOwner` are assigned where the MeshRpcClient exists; until then a
 // standby answers today's 503 and a topic-bound reply takes today's path.
 let _a2aRelayForwardCtx = null;
+// a2a-required-acknowledgment: one service per server. Late-bound, because the spawn
+// manager's callbacks are wired before the tracker it writes to exists.
+let _requiredAckService = null;
+let _requiredAckRelayRoute = null;
+let _requiredAckRelayClient = () => null;
+let _requiredAckTrustManager = () => null;
 let _a2aAskTopicOwner = null;
 let _deliverA2aToMachine = null;
 // Subscription & Auth Standard P1.3 — quota-aware account-swap scheduler. Null
@@ -17908,7 +17915,7 @@ export async function startServer(options) {
         const threadResumeMap = new ThreadResumeMap(config.stateDir, config.stateDir, undefined, undefined, {
             // A thread bound to a claude-code session checks Claude transcripts only;
             // an unknown session name tries every layout (the bounded lookups).
-            frameworkResolver: (sessionName) => state.listSessions().find((s) => s.tmuxSession === sessionName)?.framework,
+            frameworkResolver: (sessionName) => state.findSessionByTmux(sessionName)?.framework,
         });
         // Threadline Phase 1 keystone: the Conversation single-source-of-truth +
         // the warrants-a-reply gate. The gate runs once at the relay inbound funnel
@@ -18411,6 +18418,17 @@ export async function startServer(options) {
                 const state = memoryMonitor?.getState();
                 return !state || state.state === 'normal';
             },
+            // a2a-required-acknowledgment D7: a session limit with a slot now free. A live
+            // read of the number admission reads; admission still decides.
+            isDrainRefusalLiveCleared: (marker) => {
+                if (!/session limit/i.test(marker.refusalSignature))
+                    return false;
+                const limit = config.sessions?.maxSessions ?? config.maxSessions ?? 5;
+                return sessionManager.listRunningSessions().length < limit;
+            },
+            // a2a-required-acknowledgment D3/D5.
+            onQueuedMessageDropped: (receipt, cause) => _requiredAckService?.onQueueDropped(receipt, cause),
+            onQueuedMessageDelivered: (receipt, session) => _requiredAckService?.onDelivered(receipt, session),
             onDrainRearm: (event) => {
                 console.log(`[spawn-manager] drain give-up latch re-armed for ${event.agent} ` +
                     `(target=${event.targetKey}, signature="${event.refusalSignature}", quiet=${event.rearmCooldownMs}ms)`);
@@ -18743,6 +18761,50 @@ export async function startServer(options) {
                     degradations: DegradationReporter.getInstance(),
                 });
             }
+            // A sender is never left guessing (docs/specs/a2a-required-acknowledgment.md).
+            // Always constructed: inbound kinded acks are consumed safely even when
+            // threadline.requiredAck.enabled is false.
+            {
+                const ra = await import('../threadline/requiredAckService.js');
+                const raConfig = config;
+                const relayRoute = () => {
+                    const client = _requiredAckRelayClient();
+                    if (client && client.connectionState === 'connected') {
+                        return { kind: 'relay', send: (peerFp, ack, text, opts) => { client.sendKindedAck(peerFp, ack, text, opts); } };
+                    }
+                    return { kind: 'none' };
+                };
+                _requiredAckRelayRoute = relayRoute;
+                _requiredAckService = new ra.RequiredAckService({
+                    tracker: a2aDeliveryTracker,
+                    enabled: () => ra.resolveRequiredAckEnabled(liveConfig.get('threadline.requiredAck.enabled', undefined), raConfig),
+                    thresholds: () => ra.resolveRequiredAckThresholds(raConfig),
+                    route: () => {
+                        const direct = relayRoute();
+                        if (direct.kind === 'relay')
+                            return direct;
+                        const forwardAck = _a2aRelayForwardCtx?.relaySuppressedByStandby === true ? _a2aRelayForwardCtx.forwardAck : null;
+                        return forwardAck ? { kind: 'forward', send: forwardAck } : { kind: 'none' };
+                    },
+                    isStandby: () => _a2aRelayForwardCtx?.relaySuppressedByStandby === true,
+                    hasTrustProfile: (fp) => {
+                        const p = _requiredAckTrustManager()?.getProfileByFingerprint(fp);
+                        return !!p && !(p.relayFirstContact && p.source === 'setup-default');
+                    },
+                    isPinned: (fp) => !!_requiredAckTrustManager()?.getProfileByFingerprint(fp)?.peerIdentityPub,
+                    isSessionAlive: (name) => sessionManager.isSessionAlive(name),
+                    injectReminder: (name, text) => sessionManager.injectMessage(name, text, { firstParty: { source: 'a2a-ack-reminder' } }),
+                    laneOf: (name) => {
+                        const lane = sessionManager.listRunningSessions().find((sess) => sess.tmuxSession === name)?.launchLane;
+                        return lane === 'headless' ? 'headless' : lane === 'rerouted-interactive' ? 'interactive' : null;
+                    },
+                    threadPeer: (threadId) => threadResumeMap.get(threadId)?.remoteAgent ?? null,
+                });
+                const interrupted = _requiredAckService.recoverAfterRestart();
+                if (interrupted > 0)
+                    console.log(`[required-ack] ${interrupted} message(s) a restart interrupted; their senders will be told once the relay connects`);
+                _requiredAckService.start();
+            }
         }
         catch (err) {
             // @silent-fallback-ok: cascade-isolation — a tracker open failure must never block
@@ -19296,6 +19358,9 @@ export async function startServer(options) {
                 }
             }
             catch { /* @silent-fallback-ok — an advisory startup note must never endanger boot */ }
+            // a2a-required-acknowledgment: the service exists before the relay client does.
+            _requiredAckRelayClient = () => threadlineRelayClient;
+            _requiredAckTrustManager = () => (threadline.trustManager ?? null);
             if (threadlineRelayClient) {
                 // Wire relay message delivery through ThreadlineRouter (Phase 1).
                 // Replaces the ad-hoc handler with proper thread persistence, auto-ack,
@@ -19402,23 +19467,33 @@ export async function startServer(options) {
                     // before it returns; an exit that settles nothing (a throw) sends no
                     // ack, which is the honest result when nothing received the message.
                     const isTopicBoundReply = !!msg.threadId && threadResumeMap.get(msg.threadId)?.originTopicId !== undefined;
+                    // a2a-required-acknowledgment D1: plaintext arrives relay-authenticated;
+                    // anything else came through the decrypt path, encrypted and signed.
+                    const arrivedEncrypted = decision.reason !== 'relay-authenticated' && decision.reason !== 'probe';
                     const relayAckDeps = {
                         autoAckEnabled: config.threadline?.autoAck !== false,
                         autoAckMessage: config.threadline?.autoAckMessage,
                         isAckRateLimited,
                         sendAck: (to, text, threadId) => { threadlineRelayClient.sendAck(to, text, threadId); },
                         recordDelivery: recordRelayDelivery,
+                        consumeKindedAck: (ack) => {
+                            _requiredAckService?.consumeInboundAck({ from: senderFingerprint, ack, arrivedEncrypted });
+                        },
                     };
                     const relayAckInput = {
                         isAutoAck, trustLevel, msgType, senderFingerprint, threadId: msg.threadId, ticket: ledgerTicket,
+                        kindedAck: parseKindedAck(msg.content),
                         deferSend: true,
                     };
                     const relayAck = createRelayAckSettler(relayAckDeps, relayAckInput);
                     const ackStage = runRelayAckStage(relayAckDeps, relayAckInput);
                     if (ackStage === 'ack-consumed') {
-                        console.log(`[relay] delivery ack from ${senderName} (thread: ${msg.threadId ?? 'none'}, by ${autoAckRecognition({ type: msgType, text: textContent })}) recorded — not acked, not routed`);
+                        console.log(`[relay] ${relayAckInput.kindedAck ? 'kinded' : 'delivery'} ack from ${senderName} (thread: ${msg.threadId ?? 'none'}, by ${autoAckRecognition({ type: msgType, text: textContent })}) ${relayAckInput.kindedAck ? 'consumed' : 'recorded'} — not acked, not routed`);
                         return;
                     }
+                    // a2a-required-acknowledgment D1: after the trust check, per ordinary message.
+                    if (msgType !== 'status' && decision.reason !== 'probe')
+                        _requiredAckService?.notePeerMessage(senderFingerprint, msg.content);
                     // Canonical inbox write — single source of truth across all routing branches.
                     // Runs once at relay-ingest, BEFORE pipe / warm-listener / cold-spawn branching,
                     // so .instar/threadline/inbox.jsonl.active reflects every inbound message regardless
@@ -19646,12 +19721,17 @@ export async function startServer(options) {
                     // (trustMeetsFloor), NEVER string `>=`. When false (or feature off), the
                     // router takes the proven cold-spawn path byte-for-byte.
                     const preferWarmSession = warmEnabled && !isTopicBoundReply && trustMeetsFloor(trustLevel, warmTrustFloor);
+                    // a2a-required-acknowledgment D4: pipe and listener paths never get here.
+                    const requiredAckHandle = decision.reason === 'probe' ? null : (_requiredAckService?.prepare({
+                        peerFp: senderFingerprint, messageId: msg.messageId, threadId: msg.threadId ?? null, triggerEncrypted: arrivedEncrypted,
+                    }) ?? null);
                     const relayContext = {
                         trust: { kind: 'plaintext-tofu', senderFingerprint },
                         senderFingerprint,
                         senderName,
                         trustLevel,
                         preferWarmSession,
+                        ...(requiredAckHandle ? { requiredAck: { instruction: requiredAckHandle.instruction, receipt: requiredAckHandle.receipt } } : {}),
                     };
                     let result = await threadlineRouter.handleInboundMessage(envelope, relayContext, { resentNotice: ledgerNotice });
                     // Fallback only when a threadless message could not be associated
@@ -19664,6 +19744,8 @@ export async function startServer(options) {
                     }
                     // Inbound-id ledger: the outcome of the LAST path tried, through the allowlist.
                     ledgerTicket?.recordRouterResult(result);
+                    // a2a-required-acknowledgment D2/D5: tell the sender what really happened.
+                    _requiredAckService?.settleRouterResult(requiredAckHandle, result);
                     if (result.error)
                         console.warn(`[relay] Router error: ${result.error}`);
                     if (result.spawned)
@@ -20936,7 +21018,11 @@ export async function startServer(options) {
         // A dead sign-in key on a key-only agent: confirmed, told, recovered (spec cloud-key-internal-calls).
         // Wired here, outside the subscription pool block, because these agents may have no pool.
         {
-            const { ClaudeKeyHealth, claudeKeyFingerprint, setActiveClaudeKeyHealth } = await import('../core/ClaudeKeyHealth.js');
+            const { ClaudeKeyHealth, claudeKeyFingerprint, setActiveClaudeKeyHealth, KEY_NOTICE_TEXTS } = await import('../core/ClaudeKeyHealth.js');
+            const { heldMessages, answeredSince, buildKeyRecoveryPrompt, deliverOperatorNotice, operatorSlackIds, slackConversationLines } = await import('../core/claudeKeyRecovery.js');
+            const { deriveRole: deriveOrgRole } = await import('../permissions/SlackPrincipalResolver.js');
+            const { SESSION_BACK_NOTICE: keyBackNotice } = await import('../messaging/userNotices.js');
+            const keyNoticeTexts = [...KEY_NOTICE_TEXTS, keyBackNotice];
             const { buildClaudeKeyProbe } = await import('../core/claudeKeyProbe.js');
             const { configuredClaudeOauthKey, setClaudeCallOutcomeListener } = await import('../core/claudeChildAuth.js');
             const keyHealthOn = () => liveConfig.get('sessions.claudeKeyHealth.enabled', true) !== false;
@@ -20946,6 +21032,51 @@ export async function startServer(options) {
             };
             // The disk read covers a topic bound after this server booted, as SessionRefresh does.
             const topicForSession = (name) => telegram?.getTopicForSession(name) ?? telegram?.resolveTopicForSessionFromDisk?.(name) ?? null;
+            // One conversation's recent lines, platform-neutral. Slack: the ring buffer (it knows which
+            // messages were not addressed to the agent), or Slack itself when the buffer is empty or
+            // `authoritative` is asked for.
+            const keyConversationLines = async (sessionName, authoritative = false) => {
+                const topicId = topicForSession(sessionName);
+                if (topicId !== null && telegram) {
+                    // Server automation (standby notes, notices) is neither a person nor the agent answering.
+                    const lines = telegram.getTopicHistory(topicId, 50)
+                        .filter((e) => e.fromUser || e.provenance !== 'automation')
+                        .map((e) => ({
+                        at: Date.parse(e.timestamp), fromAgent: !e.fromUser, who: e.senderName || e.senderUsername || 'someone', text: e.text ?? '',
+                    }));
+                    return { lines, channel: { platform: 'telegram', topicId } };
+                }
+                const routingKey = _slackAdapter?.getChannelForSession(sessionName) ?? null;
+                if (routingKey === null || !_slackAdapter)
+                    return null;
+                const slack = _slackAdapter;
+                const { channelId, threadTs } = slack.parseRoutingKey(routingKey);
+                // A thread session is its thread. A channel session serves the whole channel, threads
+                // included, and replies into the thread its latest message came from.
+                const inConversation = (m) => threadTs ? (m.thread_ts === threadTs || m.ts === threadTs) : true;
+                let messages = authoritative ? [] : slack.getChannelMessages(channelId, 200).filter(inConversation);
+                if (messages.length === 0)
+                    messages = await slack.recentConversationMessages(routingKey, 50);
+                const lines = slackConversationLines(messages, {
+                    botUserId: slack.getBotUserId?.() ?? null,
+                    isPerson: (userId) => slack.isAuthorized(userId),
+                    isServerPost: (ts) => slack.isServerAutomationPost(channelId, ts),
+                });
+                return { lines, channel: { platform: 'slack', channelId, ...(threadTs ? { threadTs } : {}) } };
+            };
+            // The operator on Slack: authorized people whose profile is an owner or admin (read fresh,
+            // so a profile added after boot counts).
+            const keyOperators = (slack) => {
+                let profiles = [];
+                try {
+                    profiles = new UserManager(config.stateDir, config.users).listUsers()
+                        .map((u) => ({ slackUserId: u.slackUserId, role: deriveOrgRole(u.permissions, u.orgRole) }));
+                }
+                catch (err) { /* @silent-fallback-ok: no profiles means a small authorized list stands in (operatorSlackIds) */
+                    console.warn(`[ClaudeKeyHealth] could not read user profiles: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                return operatorSlackIds(slack.getAuthorizedUserIds(), profiles);
+            };
             const claudeKeyHealth = new ClaudeKeyHealth({
                 stateFile: path.join(config.stateDir, 'state', 'claude-key-health.json'),
                 currentKey: () => (keyHealthOn() ? configuredClaudeOauthKey() : undefined),
@@ -20965,30 +21096,27 @@ export async function startServer(options) {
                     baseUrl: () => config.sessions.anthropicBaseUrl,
                 }),
                 // Fixed server text straight to the adapters: the model is what is down, and `notify` returns
-                // nothing, so it can't say whether anyone was told.
-                notifyOperator: async (text) => {
-                    let delivered = false;
+                // nothing, so it can't say whether anyone was told. Delivered means a person can read it:
+                // a Slack alert channel with none of the agent's people in it reaches nobody (2026-11-04
+                // drill), so then each of them gets a direct message.
+                notifyOperator: (text) => {
                     const hubTopicId = state.get('agent-attention-topic') ?? 0;
-                    if (telegram && hubTopicId) {
-                        try {
-                            await telegram.sendToTopic(hubTopicId, text);
-                            delivered = true;
-                        }
-                        catch (err) { /* @silent-fallback-ok: `delivered` stays false, which drives the retry and its capped report */
-                            console.warn(`[ClaudeKeyHealth] Telegram notice failed: ${err instanceof Error ? err.message : String(err)}`);
-                        }
-                    }
-                    const attentionChannel = state.get('slack-attention-channel');
-                    if (_slackAdapter && attentionChannel) {
-                        try {
-                            await _slackAdapter.sendToChannel(attentionChannel, text);
-                            delivered = true;
-                        }
-                        catch (err) { /* @silent-fallback-ok: `delivered` stays false, which drives the retry and its capped report */
-                            console.warn(`[ClaudeKeyHealth] Slack notice failed: ${err instanceof Error ? err.message : String(err)}`);
-                        }
-                    }
-                    return delivered;
+                    const slack = _slackAdapter;
+                    return deliverOperatorNotice({
+                        telegram: telegram && hubTopicId ? async (t) => { await telegram.sendToTopic(hubTopicId, t); } : undefined,
+                        slack: slack ? {
+                            attentionChannel: state.get('slack-attention-channel') ?? null,
+                            readersOf: async (channelId) => {
+                                const members = await slack.authorizedMembersOf(channelId);
+                                const operators = keyOperators(slack);
+                                return operators.length > 0 ? members.filter((id) => operators.includes(id)) : members;
+                            },
+                            post: async (channelId, t) => { await slack.sendToChannel(channelId, t); },
+                            people: () => keyOperators(slack),
+                            directMessage: async (userId, t) => { await slack.sendDirectMessage(userId, t); },
+                        } : undefined,
+                        warn: (m) => console.warn(`[ClaudeKeyHealth] ${m}`),
+                    }, text);
                 },
                 notifyPerson: async (sessionName, text) => {
                     const topicId = topicForSession(sessionName);
@@ -21008,6 +21136,25 @@ export async function startServer(options) {
                     const launched = sessionManager.sessionLaunchKey(tmuxSession);
                     return launched ? claudeKeyFingerprint(launched) : null;
                 },
+                recoveryPrompt: async (sessionName) => {
+                    const convo = await keyConversationLines(sessionName);
+                    if (!convo)
+                        return null;
+                    const held = heldMessages(convo.lines, keyNoticeTexts);
+                    return { prompt: buildKeyRecoveryPrompt(convo.channel, held), held: held.length };
+                },
+                answeredSince: async (sessionName, sinceMs) => {
+                    const convo = await keyConversationLines(sessionName);
+                    if (!convo)
+                        return null;
+                    if (answeredSince(convo.lines, sinceMs, keyNoticeTexts))
+                        return true;
+                    if (convo.channel.platform !== 'slack')
+                        return false;
+                    // The ring buffer can miss the agent's own post; Slack itself settles it.
+                    const fresh = await keyConversationLines(sessionName, true);
+                    return fresh ? answeredSince(fresh.lines, sinceMs, keyNoticeTexts) : null;
+                },
                 refresh: async (sessionName, prompt) => {
                     if (!_sessionRefresh)
                         return { ok: false, reason: 'session refresh not available' };
@@ -25876,7 +26023,7 @@ export async function startServer(options) {
                         terminateSession: async (sk, reason, opts) => {
                             const topicNum = Number(sk);
                             const tmux = Number.isFinite(topicNum) ? telegram?.getSessionForTopic(topicNum) : null;
-                            const rec = tmux ? state.listSessions().find((s) => s.tmuxSession === tmux) : undefined;
+                            const rec = tmux ? state.findSessionByTmux(tmux) : undefined;
                             if (!rec)
                                 return { terminated: false, skipped: 'no-local-session' };
                             return terminateWithAuthority(rec.id, reason, {
@@ -26083,6 +26230,14 @@ export async function startServer(options) {
                                 counters: fwd.counters,
                             });
                         },
+                        // a2a-required-acknowledgment D4: the holder sends a standby's kinded ack.
+                        // The handler is the gate; it refuses when the feature is off here.
+                        'a2a-relay-forward-ack': async (cmd) => {
+                            if (!_requiredAckService)
+                                return { outcome: 'refused', reason: 'required-ack-not-wired' };
+                            const route = _requiredAckRelayRoute?.();
+                            return _requiredAckService.handleForwardedAck(cmd, { relay: route?.kind === 'relay' ? route : null });
+                        },
                         // §5 — type a reply into THIS machine's own live session for the
                         // topic (the confirmed paste). Never spawns, never moves the topic.
                         'a2a-topic-reply-inject': async (cmd) => {
@@ -26653,6 +26808,15 @@ export async function startServer(options) {
                             send: (peer, command, timeoutMs) => meshClient.send({ machineId: peer.machineId, url: peer.url }, command, 0, { timeoutMs }),
                         });
                         _a2aRelayForwardCtx.forward = (command) => relayForwarder.forward(command);
+                        // a2a-required-acknowledgment D4: a kinded ack through my relay-holding
+                        // machine. A holder that lacks the verb refuses it; the row stays pending.
+                        _a2aRelayForwardCtx.forwardAck = async (payload) => {
+                            const peer = await holderFinder.find();
+                            if (!peer)
+                                return 'refused';
+                            const res = await meshClient.send({ machineId: peer.machineId, url: peer.url }, { type: 'a2a-relay-forward-ack', ...payload }, 0, { timeoutMs: 15_000 });
+                            return res.ok && res.result?.outcome === 'sent' ? 'sent' : 'refused';
+                        };
                         _a2aAskTopicOwner = (machineId, payload, timeoutMs) => fwdMod.askTopicOwner(async (id, command, t) => {
                             const url = peerUrl(id);
                             if (!url)
@@ -29148,7 +29312,7 @@ export async function startServer(options) {
                                 if (hasUsableBotToken && meshSelfId) {
                                     // §4.1/§4.2 — settle, forward to the holder, ladder, then hold durably.
                                     const runtime = telegramOriginBoot.runtime;
-                                    const outcome = await originForwardMod.forwardReplyToHolder(forwardDeps(runtime), { topicId, chatId: tg.chatId, text, silent: opts?.silent, formatMode: tg.formatMode, kindMetadata: opts?.kindMetadata });
+                                    const outcome = await originForwardMod.forwardReplyToHolder(forwardDeps(runtime), { topicId, chatId: tg.chatId, text, silent: opts?.silent, formatMode: opts?.formatMode ?? tg.formatMode, kindMetadata: opts?.kindMetadata });
                                     if (outcome.kind === 'local')
                                         throw new OriginForwardSettledLocallyError();
                                     if (outcome.kind === 'sent')
@@ -29163,7 +29327,7 @@ export async function startServer(options) {
                                     throw new TelegramOriginHoldError('origin-credential-owner-unavailable');
                                 const { relayOriginBot } = await import('../messaging/telegram-origin/OriginMeshRelay.js');
                                 return relayOriginBot({ runtime: telegramOriginBoot.runtime, topicId, text, chatId: tg.chatId,
-                                    silent: opts?.silent, formatMode: tg.formatMode, kindMetadata: opts?.kindMetadata,
+                                    silent: opts?.silent, formatMode: opts?.formatMode ?? tg.formatMode, kindMetadata: opts?.kindMetadata,
                                     send: command => meshClient.send({ machineId: holder, url }, command, 0, { timeoutMs: relayTimeoutMs }) });
                             }
                             const r = await relayOutbound(topicId, text, opts, {
@@ -30507,7 +30671,7 @@ export async function startServer(options) {
         const server = new AgentServer({ config, ecosystemLedger: _ecosystemLedger ?? undefined, recommendedServicesLedger: _recommendedServicesLedger ?? undefined, singleInstanceLock, agentIdentity: _agentIdentityDeps, terminateSessionAuthority: terminateWithAuthority, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, telegramOrigin: telegramOriginBoot?.runtime, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, jobAnomalySendAutomationReply: sendAutomationReply, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographerRoots: cartographerRoots ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, verifiedEntityName(m.machineId, m.nickname) ?? ''])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? '', url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: verifiedEntityName(m.machineId, m.nickname) ?? '', url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, usageWallRescue: _usageWallRescue ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, memoryPrivacy: _memoryPrivacyWired ?? undefined, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx });
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, usageWallRescue: _usageWallRescue ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, localVerify: localVerifyService ?? undefined, localVerifyStatus: localVerifyStatus ?? undefined, guardLatchStore: guardLatchStore ?? undefined, agentStopSurfacer: agentStopSurfacer ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, appConversations: _appConversationService ?? undefined, slackInboundDispatch: () => _slackInboundDispatch, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, peerHomebaseRelay, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, pairingInvites: threadlinePairingInvites, getLastRelayEvent: threadlineGetLastRelayEvent, a2aRelayForward: _a2aRelayForwardCtx ?? undefined, threadlineReplyWaiters, threadlineMcpHttp, memoryPrivacy: _memoryPrivacyWired ?? undefined, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, requiredAck: _requiredAckService ?? undefined, relayVerdictCounters: threadlineRelayClient ? (() => ({ ...threadlineRelayClient.relayVerdictCounters, expiredMismatchIgnored: a2aDeliveryTracker?.expiredMismatchIgnored ?? 0 })) : undefined, inboundIdLedger: _inboundIdLedger ?? undefined, inboundIdLedgerDaemonDeferred: () => _inboundIdLedgerDaemonDeferred, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, replicatedStoreReconciler, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, jevMemoryPicker, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, claimTopicOwnershipOnSpawn: (topicId) => _claimOwnershipForAutonomousSpawn ? _claimOwnershipForAutonomousSpawn(topicId) : 'unwired', topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, recordRopeResult: _recordRopeResult ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, passkeyRevokeOutbox: _passkeyRevokeOutbox ? () => _passkeyRevokeOutbox : undefined, passkeyPeerOnline: _passkeyPeerOnline, passkeyPoolReader: _passkeyPoolReader ? () => _passkeyPoolReader : undefined, passkeyProofBrowser: async (profileDir) => { const { ChromeCdpReloginBrowser } = await import('../core/ChromeCdpReloginBrowser.js'); return new ChromeCdpReloginBrowser({ userDataDir: profileDir, passkeyMode: true, headless: true, launchTimeoutMs: 30_000, operationTimeoutMs: 20_000 }); }, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, codexArmSessionSweeper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx });
         if (_pendingCompactionEvidence)
             featureEvidence.record('multiMachine.coherenceJournal.replication.compaction', _pendingCompactionEvidence); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         const readIdentityProjectionPeerRows = async () => {
@@ -32040,6 +32204,7 @@ export async function startServer(options) {
             } // Warm-Session A2A reap tick
             a2aSweep?.stop();
             a2aSweep = null; // honest-delivery silence sweep
+            _requiredAckService?.stop(); // a2a-required-acknowledgment 30-second timer
             try {
                 _topicProfileOrchestrator?.dispose();
             }