instar 1.3.331 → 1.3.333

package/dist/core/LiveTailSource.d.ts

@@ -74,6 +74,21 @@ export interface LiveTailSourceDeps {
     failureBackoffBaseMs?: number;
     /** Backoff ceiling. Default 5 min. */
     failureBackoffMaxMs?: number;
+    /**
+     * Eternal Sentinel condition 4 ("No Unbounded Loops" / P19): the backoff
+     * keeps retrying a failing topic forever (correct — the standby copy should
+     * converge whenever the peer recovers), but a topic whose flushes have been
+     * failing past staleSignalAfterMs must SAY SO once per episode instead of
+     * going quietly stale. Wired to DegradationReporter in server.ts; omitted →
+     * silent (tests / channels without a reporter).
+     */
+    reportStaleStandby?: (info: {
+        topic: string;
+        failingForMs: number;
+        consecutiveFailures: number;
+    }) => void;
+    /** Sustained-failure threshold for the one-per-episode stale signal. Default 30 min. */
+    staleSignalAfterMs?: number;
     now?: () => number;
     logger?: (msg: string) => void;
 }
@@ -104,6 +119,10 @@ export declare class LiveTailSource {
     private failures;
     /** Per-topic earliest next attempt (ms epoch) while backing off. */
     private nextAttemptAt;
+    /** Per-topic failure-episode start (ms epoch; absent = healthy). */
+    private failingSince;
+    /** Episode-keyed one-shot latch for the stale-standby signal (value = failingSince it fired for). */
+    private staleSignaledFor;
     constructor(deps: LiveTailSourceDeps);
     private log;
     private now;

package/dist/core/LiveTailSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LiveTailSource.d.ts","sourceRoot":"","sources":["../../src/core/LiveTailSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,oEAAoE;IACpE,YAAY,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,EAAE;QACT,SAAS,EAAE,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACzF,CAAC;IACF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAqB;IACvC,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAA6B;IAC7C,wEAAwE;IACxE,OAAO,CAAC,GAAG,CAA6B;IACxC,iFAAiF;IACjF,OAAO,CAAC,eAAe,CAA6B;IACpD,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAA6B;IAC7C,oEAAoE;IACpE,OAAO,CAAC,aAAa,CAA6B;gBAEtC,IAAI,EAAE,kBAAkB;IAIpC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,GAAG;IAIX,0EAA0E;IAC1E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;IA+ExE,oFAAoF;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQzD,2FAA2F;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAIlD"}
+{"version":3,"file":"LiveTailSource.d.ts","sourceRoot":"","sources":["../../src/core/LiveTailSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,oEAAoE;IACpE,YAAY,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,oFAAoF;IACpF,SAAS,EAAE;QACT,SAAS,EAAE,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACzF,CAAC;IACF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC1G,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAOD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAqB;IACvC,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAA6B;IAC7C,wEAAwE;IACxE,OAAO,CAAC,GAAG,CAA6B;IACxC,iFAAiF;IACjF,OAAO,CAAC,eAAe,CAA6B;IACpD,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAA6B;IAC7C,oEAAoE;IACpE,OAAO,CAAC,aAAa,CAA6B;IAClD,oEAAoE;IACpE,OAAO,CAAC,YAAY,CAA6B;IACjD,qGAAqG;IACrG,OAAO,CAAC,gBAAgB,CAA6B;gBAEzC,IAAI,EAAE,kBAAkB;IAIpC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,GAAG;IAIX,0EAA0E;IAC1E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;IA+FxE,oFAAoF;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQzD,2FAA2F;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAIlD"}

package/dist/core/LiveTailSource.js

@@ -45,6 +45,7 @@
 const DEFAULT_MAX_FLUSH_BYTES = 256 * 1024;
 const DEFAULT_BACKOFF_BASE_MS = 5_000;
 const DEFAULT_BACKOFF_MAX_MS = 300_000;
+const DEFAULT_STALE_SIGNAL_AFTER_MS = 30 * 60_000;
 export class LiveTailSource {
     d;
     /** Per-topic content already streamed (the prefix the standby has). */
@@ -57,6 +58,10 @@ export class LiveTailSource {
     failures = new Map();
     /** Per-topic earliest next attempt (ms epoch) while backing off. */
     nextAttemptAt = new Map();
+    /** Per-topic failure-episode start (ms epoch; absent = healthy). */
+    failingSince = new Map();
+    /** Episode-keyed one-shot latch for the stale-standby signal (value = failingSince it fired for). */
+    staleSignaledFor = new Map();
     constructor(deps) {
         this.d = deps;
     }
@@ -140,10 +145,26 @@ export class LiveTailSource {
             const backoff = Math.min(base * 2 ** (failures - 1), cap);
             this.nextAttemptAt.set(topic, this.now() + backoff);
             this.log(`flush of topic ${topic} seq ${nextSeq} not acknowledged — retry in ${Math.round(backoff / 1000)}s (failure #${failures})`);
+            // Eternal Sentinel condition 4: retrying forever is correct, but a topic
+            // whose standby copy has been stale past the threshold says so ONCE per
+            // episode (episode-keyed latch, same defensive shape as the supervisor's
+            // SlowRetrySentinelEscalation — a fresh episode re-arms automatically).
+            const episodeStart = this.failingSince.get(topic) ?? now;
+            if (!this.failingSince.has(topic))
+                this.failingSince.set(topic, episodeStart);
+            const failingForMs = this.now() - episodeStart;
+            if (failingForMs >= (this.d.staleSignalAfterMs ?? DEFAULT_STALE_SIGNAL_AFTER_MS)
+                && this.staleSignaledFor.get(topic) !== episodeStart) {
+                this.staleSignaledFor.set(topic, episodeStart);
+                this.log(`topic ${topic} standby copy STALE — flushes failing for ${Math.round(failingForMs / 60_000)}min (signaling once; retries continue)`);
+                this.d.reportStaleStandby?.({ topic, failingForMs, consecutiveFailures: failures });
+            }
             return { topic, seq: this.currentSeq(topic), flushed: false };
         }
         this.failures.delete(topic);
         this.nextAttemptAt.delete(topic);
+        this.failingSince.delete(topic);
+        this.staleSignaledFor.delete(topic);
         this.seq.set(topic, nextSeq);
         this.streamed.set(topic, full);
         if (version !== undefined)

package/dist/core/LiveTailSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"LiveTailSource.js","sourceRoot":"","sources":["../../src/core/LiveTailSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAmDH,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3C,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,OAAO,cAAc;IACR,CAAC,CAAqB;IACvC,uEAAuE;IAC/D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,wEAAwE;IAChE,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,iFAAiF;IACzE,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,qEAAqE;IAC7D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,oEAAoE;IAC5D,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YAAY,IAAwB;QAClC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAgB;QAC9C,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,sEAAsE;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC;YAE3D,sEAAsE;YACtE,2EAA2E;YAC3E,wEAAwE;YACxE,wBAAwB;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,OAAO,OAAO,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,kBAAkB,GAAG,GAAiB,EAAE;YAC5C,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,KAAa,CAAC;QAClB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,8DAA8D,CAAC,CAAC;YACvF,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,kBAAkB,KAAK,CAAC,MAAM,MAAM,QAAQ,+BAA+B,CAAC,CAAC;YACpG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,0EAA0E;YAC1E,4EAA4E;YAC5E,0EAA0E;YAC1E,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,sBAAsB,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CACN,kBAAkB,KAAK,QAAQ,OAAO,gCAAgC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,eAAe,QAAQ,GAAG,CAC3H,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,QAAQ,CAAC,IAAgB;QAC7B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,QAAQ,CAAC,IAAgB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;CACF"}
+{"version":3,"file":"LiveTailSource.js","sourceRoot":"","sources":["../../src/core/LiveTailSource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AA8DH,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3C,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,6BAA6B,GAAG,EAAE,GAAG,MAAM,CAAC;AAElD,MAAM,OAAO,cAAc;IACR,CAAC,CAAqB;IACvC,uEAAuE;IAC/D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,wEAAwE;IAChE,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,iFAAiF;IACzE,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,qEAAqE;IAC7D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,oEAAoE;IAC5D,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,oEAAoE;IAC5D,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,qGAAqG;IAC7F,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,YAAY,IAAwB;QAClC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAgB;QAC9C,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,sEAAsE;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC;YAE3D,sEAAsE;YACtE,2EAA2E;YAC3E,wEAAwE;YACxE,wBAAwB;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,OAAO,OAAO,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,kBAAkB,GAAG,GAAiB,EAAE;YAC5C,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,KAAa,CAAC;QAClB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,8DAA8D,CAAC,CAAC;YACvF,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,kBAAkB,KAAK,CAAC,MAAM,MAAM,QAAQ,+BAA+B,CAAC,CAAC;YACpG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,0EAA0E;YAC1E,4EAA4E;YAC5E,0EAA0E;YAC1E,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,sBAAsB,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CACN,kBAAkB,KAAK,QAAQ,OAAO,gCAAgC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,eAAe,QAAQ,GAAG,CAC3H,CAAC;YAEF,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;YAC/C,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;mBACzE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;gBACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,6CAA6C,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,wCAAwC,CAAC,CAAC;gBAC/I,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,QAAQ,CAAC,IAAgB;QAC7B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,QAAQ,CAAC,IAAgB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.331",
+  "version": "1.3.333",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T03:21:16.909Z",
-  "instarVersion": "1.3.331",
+  "generatedAt": "2026-06-06T03:35:43.361Z",
+  "instarVersion": "1.3.333",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.333.md

@@ -0,0 +1,55 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Audit fix #3 under "No Unbounded Loops" (P19, Eternal Sentinel condition 4):
+the live-tail flusher's capped backoff (#867) correctly retries a failing topic
+forever, but a topic whose standby copy went stale never said so. Now a
+per-topic episode latch (the `SlowRetrySentinelEscalation` shape) fires once
+per outage when flushes have failed ≥30min: one log line + one
+`DegradationReporter` record (`LiveTail.standbyFreshness`, topic NAME included,
+housekeeping channel — the reporter's per-feature 1h cooldown bounds even an
+all-topics-stale storm to a single alert). Success clears the episode. The
+`reportStaleStandby` dep is optional — omitted, behavior is byte-identical.
+
+Made the three `telegram-reply.sh` test harnesses hermetic against a live
+agent session's environment: each script-spawn now blanks
+`INSTAR_AUTH_TOKEN` so the script exercises the config-file auth fallback
+the tests intend, instead of inheriting the runner's real session token
+(which the test servers' auth middleware correctly rejects, failing the
+tests only when run inside an agent session). Same hermeticity class as
+the #862 unit-suite fix, applied to the reply-script family.
+
+## What to Tell Your User
+
+Only relevant if I run on more than one machine: when the standby machine's
+copy of a conversation falls behind for over half an hour (because syncs to it
+keep failing), that fact is now recorded in my health/degradation log instead
+of being invisible. Nothing pings you — but if a machine takeover ever resumes
+a conversation from an older point, there's now a checkable record explaining
+exactly which conversation was behind and since when.
+
+## Summary of New Capabilities
+
+- Stale-standby visibility: one degradation record per conversation per outage
+  when cross-machine sync has been failing ≥30min (`LiveTail.standbyFreshness`
+  in the degradation log / Process Health surfaces); retries continue
+  unchanged. No configuration needed.
+
+## Evidence
+
+Gap noted by #867's own second-pass reviewer ("backoff but no breaker") and
+resolved per the ratified Eternal Sentinel clause: persistence kept, silence
+removed. Focused adversarial second-pass: CONCUR (episode timing, firing bound
+= threshold + one backoff window, recordNoNewContent edge traced safe,
+DegradationReporter flood analysis). Tests: 21 green in LiveTailSource.test.ts
+incl. the P19 sustained-failure bound (~100 failing windows → exactly 1
+signal) and the server.ts wiring pin; tsc clean.
+
+- Bisected: `tests/integration/telegram-reply-end-to-end.test.ts` fails
+  with `INSTAR_AUTH_TOKEN` exported, passes without; single-var culprit.
+- Post-fix: all 4 reply-script test files (32 tests) green BOTH under a
+  live agent env and a stripped env.

package/upgrades/side-effects/livetail-stale-signal.md

@@ -0,0 +1,43 @@
+# Side-Effects Review — Live-Tail Stale-Standby Signal
+
+**Version / slug:** `livetail-stale-signal`
+**Date:** `2026-06-06`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `focused adversarial reviewer subagent — CONCUR (all four novel-integration probes clean; the episode-latch pattern itself carries two same-night CONCUR reviews)`
+
+## Summary of the change
+
+`LiveTailSource` gains the Eternal Sentinel's condition-4 observability for its capped-backoff retry loop: per-topic `failingSince` episode stamp + episode-keyed one-shot latch; the first attempt at/after `staleSignalAfterMs` (default 30min) logs once and calls the optional `reportStaleStandby` dep once per episode; success clears both. `server.ts` wires the dep to `DegradationReporter` (`LiveTail.standbyFreshness`, topic name resolved). Files: `LiveTailSource.ts`, one wiring block in `server.ts`, tests.
+
+## Decision-point inventory
+
+- `LiveTailSource` failure branch — **modify (additive)** — adds episode accounting + one-shot signal; backoff, retry, delta, and seq semantics untouched.
+- `server.ts` LiveTailSource construction — **modify** — wires the reporter dep.
+
+## 1. Over-block / 2. Under-block
+
+Nothing blocked — pure signal. Detection bound: threshold + one backoff window (≤5min at cap; reviewer-confirmed attempts always resume when the window opens). Known pre-existing edge (traced by reviewer, probe 3): content reverted to exactly-streamed state while failures>0 keeps rebuilding content per tick (version gate stays bypassed) — a #867-era micro-inefficiency in a bizarre edge, unchanged here; `failingSince` persisting there is correct (success remains the only exit). Remaining audit targets <!-- tracked: CMT-1109 -->.
+
+## 3. Level-of-abstraction fit / 4. Signal vs authority
+
+The latch lives in the loop it observes (third use of the established suppressor shape tonight); delivery rides the standard degradation channel — deliberately NOT the attention queue or Telegram (a stale standby copy is operator-relevant housekeeping, not a user decision). **Signal-only** per `docs/signal-vs-authority.md`: the dep can only record; removing it restores byte-identical behavior (test-pinned).
+
+## 5. Interactions
+
+- **Concurrency:** flushAll is sequential; all map mutations are post-await synchronous code — no double-stamp path (reviewer probe 1).
+- **Flood:** all topics share ONE reporter feature key with a 1h alert cooldown — N simultaneously-stale topics ⇒ at most one user-facing alert; per-topic records remain for inspection (reviewer probe 4). Bounded Notification Surface: no topic creation, no per-element pings.
+- **Handoff force path:** shares failure accounting — a forced attempt's failure correctly extends the episode.
+
+## 6. External surfaces / 7. Rollback
+
+Logs + degradation records only; no API/schema/config/persistent state (defaults in code; dep optional). Rollback = revert; only the silence returns.
+
+## Conclusion
+
+Third and final observability fix in tonight's P19 series: the reaper loop got its back-off (#863), the supervisor healer got its voice (#871), the lease wire got its brakes (#874), and now the live-tail's sanctioned forever-retry can no longer go quietly stale. Persistence everywhere, silence nowhere.
+
+---
+
+## Phase 5 — Second-pass review (cross-machine continuity → performed)
+
+The episode-keyed one-shot latch pattern carries two same-night line-level CONCUR reviews (supervisor escalation; mesh brakes). A focused adversarial pass probed only this PR's novel integration points: (1) episode-stamp timing across the awaited broadcast + same-topic concurrency — no double-stamp (sequential flushAll, single-threaded post-await mutations); (2) firing bound under backoff gating — threshold + ≤1 backoff window, and no stuck-in-backoff-without-attempts path exists; (3) the `recordNoNewContent`-while-failing edge — traced: cannot fire spuriously, cannot wedge, success is the only episode exit; (4) DegradationReporter flood analysis — per-feature 1h cooldown caps user-facing volume at one alert regardless of topic count. Ran the 21-test suite + tsc — green/clean. **Verdict: CONCUR.**

package/upgrades/side-effects/test-env-hermetic-reply-scripts.md

@@ -0,0 +1,67 @@
+# Side-Effects Review — Hermetic env for telegram-reply script tests
+
+**Version / slug:** `test-env-hermetic-reply-scripts`
+**Date:** `2026-06-05`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (test-only change, no runtime surface)`
+
+## Summary of the change
+
+Three tests that spawn `telegram-reply.sh` (`tests/integration/telegram-reply-end-to-end.test.ts`, `tests/unit/telegram-reply-recoverable-classification.test.ts`, `tests/unit/reply-scripts.test.ts`) inherited the full process env via `{ ...process.env }`. Inside a live agent session, `INSTAR_AUTH_TOKEN` is exported (SessionManager injects it), the script's documented env-first auth resolution picks it up, and the test server's auth middleware rejects the mismatched Bearer before the route handler records the hit — failing the test only when run inside an agent session. Each spawn site now sets `INSTAR_AUTH_TOKEN: ''` so the script exercises the config-file fallback the tests intend. No runtime files changed.
+
+## Decision-point inventory
+
+No decision-point surface — test-only. The script's env-first auth precedence is intentionally UNCHANGED (it is documented, load-bearing behavior); only the tests' spawn environments changed.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — not applicable.
+
+## 2. Under-block
+
+No block/allow surface — not applicable.
+
+## 3. Level-of-abstraction fit
+
+Right layer: the fix is at the test spawn sites, not the script. Weakening the script's env-first precedence to make tests pass would invert the actual contract. The sibling `telegram-reply-port-resolution.test.ts` already constructs a minimal env (`{ PATH }`) — the targeted blank keeps each test's existing env needs intact while removing the one leaking variable.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+## 5. Interactions
+
+- Shadowing/double-fire/races/feedback loops: none — test-only env construction.
+- Verified the three tests + the already-hermetic sibling all pass together under a live agent env AND under a stripped env (both run locally).
+
+## 6. External surfaces
+
+None. No runtime change; CI behavior identical (CI never had the variable set — that's why CI was green while local was red).
+
+## 7. Rollback cost
+
+Trivial revert of three test lines. No persistent state.
+
+---
+
+## Conclusion
+
+Closes a hermeticity gap in the reply-script test family (the same class PR #862 closed for the unit suite's config leakage): tests must not change verdict based on the runner's live agent environment. Found via Zero-Failure triage of a local full-suite run. Clear to ship.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** not required
+**Independent read of the artifact:** not required — test-only.
+
+---
+
+## Evidence pointers
+
+- Repro: `npx vitest run tests/integration/telegram-reply-end-to-end.test.ts` fails with `INSTAR_AUTH_TOKEN` exported, passes with it unset (bisected: that single var).
+- Post-fix: all 4 reply-script test files green under the live agent env (32 tests).

package/upgrades/test-env-hermetic-reply-scripts.eli16.md

@@ -0,0 +1,9 @@
+# Tests stop failing just because a real agent is running them
+
+Three of our tests check the little script that delivers my chat replies. Each test builds a fake miniature server, points the script at it, and watches what the script does. The problem: when those tests run inside a LIVE agent work session (instead of a clean CI machine), the session environment carries the agent's REAL access token in an environment variable — and the script is designed to prefer that variable when it exists. So the script walks up to the fake test server holding the real token, the fake server's door check rejects it (wrong token), and the test fails with a confusing "the script never called the server" error — even though nothing is actually broken.
+
+This bit us tonight: the full test suite went red on my machine for exactly this reason, while the same tests pass everywhere else. The "fix" each time would have been to shrug and re-run on CI — which trains everyone to distrust local test runs, the opposite of what a test suite is for.
+
+The change is three one-line edits: each test now explicitly blanks that environment variable when launching the script, so the script falls back to reading the token from the test's own config file — the path the tests were always meant to exercise. A fourth sibling test already did this correctly (it builds a minimal clean environment from scratch), which is how we knew the pattern. Comments at each site explain why, so the next person who writes a test like this copies the safe pattern.
+
+Nothing about the real script changes. Production behavior is untouched — this only makes the tests honest about what environment they run in. Tests now pass identically on a clean CI box and inside a live agent session.