instar 1.3.409 → 1.3.411

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.409",
+  "version": "1.3.411",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T21:38:17.118Z",
-  "instarVersion": "1.3.409",
+  "generatedAt": "2026-06-07T22:07:36.622Z",
+  "instarVersion": "1.3.411",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "71db98cdd2a2ec55361f6a66447e40f0f97436817e2ae4b8f0496dc803248cbf",
+      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1570,7 +1570,7 @@
       "type": "subsystem",
       "domain": "communication",
       "sourcePath": "src/lifeline/TelegramLifeline.ts",
-      "contentHash": "66d80ca0ef55324cf73f3ec2a1a32791d5d104fe995cb2bb0f7135859770b6fa",
+      "contentHash": "692e4271e6605457b508a73a1178a72ca0992b8a806cd305ccd0c9d06af2b4ec",
       "since": "2025-01-01"
     },
     "subsystem:orphan-process-reaper": {

package/upgrades/1.3.411.md

@@ -0,0 +1,93 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The exactly-once message recovery re-ran an already-answered Telegram message every
+~10 minutes — tagged "from Unknown" — re-spawning a session each cycle and piling load
+onto an already-overloaded machine (the 2026-06-07 "server temporarily down on every
+message" incident, topic 21816). Three fixes, all "don't replay a handled message":
+
+1. **Reply-evidence guard** — before re-running a message stuck in `processing`,
+   stuck-recovery now checks the durable ledger for a reply committed on that topic
+   at/after the message arrived. If found, the entry is committed (it was effectively
+   handled — its own reply just failed to record during the server flap, or it was a
+   duplicate) instead of being re-injected. The no-loss path (re-running a genuinely
+   unanswered turn) is unchanged.
+2. **Sender preserved through replay** — the inbound sender is captured at ingress and
+   replayed, so a legitimate re-run no longer shows "from Unknown" (Know Your Principal).
+3. **Lifeline queue dedup** — `MessageQueue.enqueue` is idempotent on message id and
+   refuses to re-queue an id already delivered/dropped this run, killing the "stale
+   already-delivered copies kept getting retried" half.
+
+`SessionWatchdog` polled every 30s over every running session, running several
+`ps`/`pgrep` probes per session via synchronous `spawnSync` — each blocking the single
+Node event loop for its full duration. Under load (dozens of sessions on a busy box) the
+cumulative stall made the server miss its own `/health` window, so the supervisor
+declared it down and restarted it in a loop (2026-06-07 "server temporarily down on
+every message" incident, topic 21816). The watchdog's process scans are now async
+(`execFile`) and the poll yields the event loop between sessions, so health checks stay
+responsive while scans run. The watchdog's escalation/kill DECISIONS are unchanged —
+only the I/O mechanism of its read-only probes changed.
+
+## What to Tell Your User
+
+If they saw the same message echoed back repeatedly, or "server temporarily down" on
+nearly every message during an overload: that replay loop is fixed — an already-answered
+message is no longer re-run, and the queue won't re-deliver something it already sent.
+Nothing for them to do; their messages were never lost (they queued and delivered).
+
+If they saw "server temporarily down" on nearly every message during a busy period,
+with the server restarting repeatedly: a big contributor was the watchdog freezing the
+event loop while scanning processes. It no longer does. Nothing for them to do.
+
+## Summary of New Capabilities
+
+- `MessageProcessingLedger.hasReplyCommittedForTopicSince(topic, sinceISO)` — durable
+  reply-evidence query used to recognize an already-answered topic.
+- `MessageProcessingLedger` stores the inbound sender envelope (additive, nullable
+  column; idempotent in-place schema upgrade — no migrator step).
+- `recoverStuckMessages` reply-evidence guard + `alreadyHandled` result counter;
+  re-injection preserves the real sender.
+- `MessageQueue.enqueue` is id-idempotent (returns boolean); `MessageQueue.markDelivered`
+  records delivered/dropped ids so a redelivery can't re-queue them.
+
+- `SessionWatchdog` process scans (`getFrameworkPid`/`getClaudePid`/`getChildProcesses`/
+  `hasActivePipelineSibling`/`checkCompactionIdle`) are async (`execFile`) instead of
+  blocking `spawnSync`.
+- `poll()` yields the event loop (`setImmediate`) between sessions so a scan over many
+  sessions can't monopolize the loop and starve `/health`.
+
+## Evidence
+
+`tests/unit/stuck-message-recovery.test.ts`, `MessageProcessingLedger.test.ts`,
+`lifeline/MessageQueue-durability.test.ts`, `lifeline/version-skew-recovery.test.ts`:
+reply-evidence guard commits-not-reruns an answered topic; a genuinely-unanswered entry
+still re-runs; sender round-trips through a recovered replay; the queue refuses to
+re-enqueue an already-delivered id; wiring guards assert routes.ts captures the sender
+and reinjectStuck forwards it. causalAutopsy: latent (the stuck==unanswered assumption
+surfaced under sustained CPU starvation that made replies fail to commit).
+
+`tests/unit/SessionWatchdog-nonblocking.test.ts`: scanning helpers return Promises; a
+0ms timer fires during an in-flight probe (loop stays live); source guards assert no
+`spawnSync(` call, `execFileAsync` present, the three helpers async, and `poll()` yields
+via `setImmediate`. Existing compaction/pipeline/mcp/rate-limit watchdog suites updated
+to `await` and pass. 72 watchdog unit tests green; `tsc --noEmit` clean. causalAutopsy:
+latent — synchronous process scans were always event-loop-blocking, but only surfaced as
+a health-miss restart loop once session count × machine load grew large enough.
+
+## Scope (honest)
+
+Contained Tier-1 fix to the existing exactly-once ingress + lifeline replay subsystems.
+No new HTTP route, config default, or migration step. The reply-evidence false-negative
+case (two distinct rapid questions, the second crashes before the first's reply commits)
+is bounded — that message was already routed once, so it isn't lost, only a redundant
+re-run is skipped. 603 messaging/lifeline unit tests green; `tsc --noEmit` clean.
+
+Contained Tier-1 refactor of one monitor (`src/monitoring/SessionWatchdog.ts`) + its
+tests. Behavior-equivalent (same commands, parsing, thresholds, LLM gate); only the
+sync→async I/O mechanism changed. The watchdog stays opt-in. The same blocking-scan
+pattern exists in OrphanProcessReaper / mcpProcessReaper (lower cadence — memory-pressure
+and 30-min triggers); those are a candidate follow-up, not in this PR.

package/upgrades/side-effects/stuck-recovery-replay-dedupe.md

@@ -0,0 +1,88 @@
+# Side-Effects Review — Stuck-recovery / replay dedupe + sender preservation
+
+**Version / slug:** `stuck-recovery-replay-dedupe`
+**Date:** `2026-06-07`
+**Author:** `Echo`
+**Tier:** 1 (contained fix to an existing dark feature; no API/route/config/migration surface)
+**Second-pass reviewer:** `Echo (self) — Tier-1; the over/under-block analysis below is the load-bearing part`
+
+## Summary of the change
+
+The exactly-once ingress subsystem (spec §8 G3a) re-ran an already-answered Telegram
+message every ~10 min, tagged "from Unknown", re-spawning a session each cycle —
+during the very load incident it stemmed from (topic 21816). Three changes, all
+"don't replay an already-handled message":
+
+1. **`stuckMessageRecovery.recoverStuckMessages`** — before re-injecting a stuck
+   `processing` entry, a reply-evidence guard checks whether the topic was already
+   answered (a reply committed at/after the entry arrived). If so the entry is
+   committed (`commitReply`+`advanceCursor`), NOT re-injected. Default backing is the
+   ledger query `hasReplyCommittedForTopicSince`; injectable for tests.
+2. **`MessageProcessingLedger`** — stores the inbound sender envelope (idempotent
+   `ALTER TABLE … ADD COLUMN sender_envelope`, no PostUpdateMigrator step per the
+   SQLite-self-init contract) and exposes `hasReplyCommittedForTopicSince`.
+   `ingressDedup.decideIngress` + `routes.ts` thread the sender from the inbound;
+   `server.ts reinjectStuck` replays with the real sender so the prefix is correct.
+3. **`lifeline/MessageQueue`** — `enqueue` is idempotent on `id` and skips ids already
+   delivered/dropped this process; the replay loop feeds the guard via
+   `markDelivered()` (remove + remember). Kills the "stale already-delivered copies
+   kept getting retried" half.
+
+## Decision-point inventory
+
+- `recoverStuckMessages` (per stuck entry) — modify — re-run vs commit-as-handled.
+  The new branch only ADDS a "commit, don't re-run" path; it never causes a re-run
+  that wasn't already going to happen.
+- `MessageQueue.enqueue` — modify — add vs skip a queue entry. Now returns boolean.
+- No message block/allow surface. No kill/terminate surface. No new HTTP route, no
+  config default, no CLAUDE.md/template change.
+
+## 1. Over-block (suppressing a re-run that SHOULD happen)
+
+The reply-evidence guard could, in principle, skip re-running a genuinely-unanswered
+message. Bound: the guard fires only when a reply was committed on the SAME topic at
+or after the entry's `receivedAt`. The false-negative case is "two distinct questions
+arrive close together, the first is answered, the second crashed mid-turn and arrived
+before that answer committed." Cost is bounded and small: the second message was
+already ROUTED to the session once (recovery only re-runs crash-mid-turn turns, not
+lost deliveries), so it is not lost from the conversation — only a redundant re-run is
+skipped. The far larger, observed harm (re-running an already-answered message every
+10 min, forever-bounded only by the 3-attempt cap, each re-run spawning a session
+under load) is eliminated. Net strictly safer. The attempts-cap backstop remains.
+
+## 2. Under-block (still re-running when we shouldn't)
+
+A genuinely lost turn (claimed, never answered, no reply on the topic since) still
+re-runs exactly as before — verified by the "still re-runs a genuinely unanswered
+stuck entry" test. The change does not weaken the no-LOSS guarantee.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. The reply-evidence signal is an objective, durable ledger read
+(indexed on `topic, reply_committed_at`), not an LLM call. The sender envelope is
+captured at the same ingress point that already logs sender for the message log. The
+queue dedup is a pure in-memory id check. No new external dependency.
+
+## 4. Blast radius
+
+The exactly-once ledger + stuck-recovery is gated behind `multiMachine` wiring
+(`ctx.messageLedger`); agents without it are unaffected (the code paths no-op when the
+ledger is null). The sender-envelope column is additive and nullable — old rows read
+back `senderEnvelope: null` (→ replay falls back to "unknown", i.e. today's behavior,
+never worse). `MessageQueue.enqueue`'s new boolean return is ignored by existing
+call sites (statement context). `markDelivered` is a strict superset of the prior
+`remove` on the replay path.
+
+## 5. Rollback
+
+Pure code revert — no data migration to undo. The `sender_envelope` column is left in
+place harmlessly on rollback (unused). No state-file format change beyond the additive
+nullable column. No config flag introduced or flipped.
+
+## 6. Tests
+
+Unit: reply-evidence guard (both branches + ledger-default), sender round-trip,
+ledger `hasReplyCommittedForTopicSince` (topic+time scoping), `MessageQueue` id-dedup
++ delivered-guard, and source-level wiring guards (routes.ts captures the sender;
+`reinjectStuck` forwards it; replay loop uses `markDelivered`). 603 messaging/lifeline
+unit tests green; `tsc --noEmit` clean.