instar 1.3.43 → 1.3.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.43",
+  "version": "1.3.44",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-28T01:24:38.781Z",
-  "instarVersion": "1.3.43",
+  "generatedAt": "2026-05-28T01:59:27.143Z",
+  "instarVersion": "1.3.44",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -409,7 +409,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -417,7 +417,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -425,7 +425,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -433,7 +433,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -441,7 +441,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -449,7 +449,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -457,7 +457,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -465,7 +465,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -473,7 +473,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -481,7 +481,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -489,7 +489,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -497,7 +497,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -505,7 +505,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -513,7 +513,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -521,7 +521,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -529,7 +529,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -537,7 +537,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -545,7 +545,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -553,7 +553,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -561,7 +561,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -569,7 +569,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -577,7 +577,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -585,7 +585,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -593,7 +593,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -601,7 +601,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -609,7 +609,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -617,7 +617,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -625,7 +625,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -633,7 +633,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -641,7 +641,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -649,7 +649,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -657,7 +657,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -665,7 +665,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -673,7 +673,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -681,7 +681,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -689,7 +689,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -697,7 +697,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -705,7 +705,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -713,7 +713,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -721,7 +721,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -729,7 +729,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -737,7 +737,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -745,7 +745,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -753,7 +753,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/machineRoutes.ts",
-      "contentHash": "5bd048aabb524e50a9f2808e4e0400ae728f5e36797e5850eff4ff7aae7921f9",
+      "contentHash": "b8a789fea855d5e45cffc3ffaea6fcf3c04d4cbb39b3097a1590ee76ccc5378b",
       "since": "2025-01-01"
     },
     "route-group:secret-drop": {
@@ -761,7 +761,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1457,7 +1457,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "d97b98638cccf4bd66b46d2d49615a5f5a416eebddf6bcae7ab3473800f02990",
+      "contentHash": "678de8d250b39e3b7bf4470d1e8b7d6290791d0595fea7686f4bd8347b2b92bd",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {
@@ -1545,7 +1545,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "48c59a44dc01c3f3e5f7e4579b623515f95b8751649e51b8f840eea5b45e1869",
+      "contentHash": "f0ad105ab4996bb6d14d2c836430fb6f7c8b7adab512c6a21c03bd5f029d8d3b",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.44.md

@@ -0,0 +1,72 @@
+# Instar Upgrade Guide — NEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Cross-machine seamlessness — full wiring landed (mostly dark).** The integration
+follow-on to PR #419. #419 shipped the seamlessness *components* (G1 fenced lease,
+G2 auto-sync, G3 ledger/outbox/live-tail/HandoffSentinel logic) unit-tested but
+not wired into the live path. PR #428 wires them in — the machine-to-machine
+"phone line", the handoff conductor, and the exactly-once message guarantee — and
+proves each end-to-end. Single-machine agents are completely unaffected: every new
+component is gated on a multi-machine mesh + lease holder + (where flagged) an
+explicit opt-in config flag.
+
+What's now LIVE on every install (not flag-gated, but no-op on a solo agent):
+
+- **Lease wire transport** — `HttpLeaseTransport` + `POST /api/lease` route, into
+  `LeaseCoordinator`. Single-machine no-op (no peers).
+- **Live-tail streaming** — holder pushes the encrypted conversation tail to the
+  standby on a cadence (`LiveTailSource` → `HttpLiveTailTransport` → receiver
+  `LiveTailBuffer`); redaction-before-encryption; only the lease holder streams.
+- **Handoff conductor** — `HandoffSentinel` (outgoing) + `HandoffReceiver`
+  (incoming) bolted into server boot; `POST /api/handoff/{begin,ack,yield}`
+  (signed) + `POST /handoff/initiate` (operator trigger). The lease is **never
+  yielded** unless the incoming machine's echo verifies AND validation passes —
+  proven over two real booted servers (caught-up → handed-off; divergent → aborts
+  and stays awake = no two-captains).
+
+What's DARK (behind `multiMachine.exactlyOnceIngress`, off by default until a live
+two-machine test-as-self confirms no false-drops on the most critical path):
+
+- **Exactly-once ingress ledger** — `MessageProcessingLedger` for inbound dedup +
+  outbound `FencedOutbox` for reply commit, plus `ReplyMarkerTransport` propagating
+  the `reply_committed` marker to standby peers so a post-handoff redelivery can't
+  re-send a reply the old holder already committed.
+
+Architecture documentation added: `site/src/content/docs/features/multi-machine.md`
+gains a "Seamlessness Architecture (Components)" section grouping the 14 new classes
+by role (coordination, planned handoff, live-tail streaming, exactly-once delivery,
+update coordination).
+
+## What to Tell Your User
+
+- The seamlessness wiring you've been hearing about is now landed — your laptop and a
+  second machine (when you have one) can take turns being the awake agent without
+  losing the conversation. On a solo setup nothing changes; this is groundwork.
+- The trickiest part — making sure a reply never goes out twice during a hand-off —
+  is wired but turned off by default until I've live-tested it on two real machines.
+- A new architecture doc page explains the components in plain English if you ever
+  want a tour: Multi-Machine → Seamlessness Architecture.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| `POST /api/lease` | Low-latency lease transport between mesh peers (server-to-server, signed). Solo agents see no traffic. |
+| `POST /api/handoff/{begin,ack,yield}` | Planned-handoff protocol endpoints (signed, machine-to-machine). |
+| `POST /handoff/initiate` | Operator trigger: gracefully hand the awake role to a specific peer. |
+| `multiMachine.exactlyOnceIngress` (config flag, default off) | Enables the inbound-dedup + reply-commit guarantee. Flip on only after a two-machine live test confirms no false-drops. |
+| Multi-Machine doc: Seamlessness Architecture | New section in `site/src/content/docs/features/multi-machine.md` — names each component, groups by role. |
+
+## Evidence
+
+**Integration follow-on, mostly wiring + boot glue.** All component logic was
+unit-tested in #419; this PR adds the live-path wiring with paired wiring-integrity
+tests for each bolt-in. Two real booted servers exercised the handoff protocol
+(caught-up → handed-off; divergent → aborts and stays awake). Single-conflict merge
+of main into the branch (only `src/commands/server.ts`, in the AgentServer
+constructor call — both sides added new components; resolution kept all and merged
+the field list). `tsc --noEmit` clean post-merge. Docs-coverage class floor cleared
+(54% → 56%, > 55% floor).

package/upgrades/side-effects/cross-machine-seamlessness-consent-acquire.md

@@ -0,0 +1,52 @@
+# Side-Effects Review — Cross-Machine Seamlessness: consented lease acquire (planned handoff)
+
+**Spec:** docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §8 G3e (converged, approved)
+
+The lease primitive a PLANNED handoff needs: the incoming machine takes the lease
+while the outgoing is still alive, which the liveness-gated `acquireIfEligible()`
+correctly refuses. Added as an ADDITIVE consent path — the split-brain-critical
+`canAcquire()` gate (hardware-verified for G1) is deliberately left untouched.
+
+## What changed
+- `src/core/LeaseCoordinator.ts` — NEW `acquireOnConsent(yieldFromMachineId)`.
+  Bypasses the liveness `canAcquire()` gate (because the holder explicitly consented
+  via a verified yield), CAS-advances to epoch+1, broadcasts, emits the new epoch.
+  **Security guard:** if there is a current holder and it is NOT the yielding machine,
+  the acquire is REFUSED — a yield from any non-holder cannot trigger a takeover.
+  Already-ours → true (idempotent); empty lease → acquire.
+- `src/core/MultiMachineCoordinator.ts` — NEW `acquireLeaseOnConsent(yieldFromMachineId)`:
+  the onYield entry point — delegates to the guarded consent path, then reconciles
+  role → awake on success.
+
+## Over-block / under-block
+- The guard is the security boundary: only the CURRENT holder's yield grants the
+  takeover. Combined with the route's machineAuth (the yield came from an
+  authenticated machine), a forged or misdirected yield is doubly defeated.
+- If the CAS is lost (someone already advanced), the consent acquire adopts the
+  observed epoch and stands down — no double-advance, no split-brain.
+- The existing `acquireIfEligible()` / `canAcquire()` / `renew()` paths are byte-for-byte
+  UNCHANGED, so the hardware-verified G1 split-brain guarantee is preserved exactly. This
+  is purely additive surface reachable only from the handoff yield handler.
+
+## Signal vs authority
+- This IS an authority mutation (it advances the lease epoch) — and it is correctly
+  gated: reachable only from the authenticated /api/handoff/yield handler, and only
+  when the yielding machine is the observed holder. The decision to yield (verified
+  ack + validation) lives upstream in HandoffSentinel.
+
+## Interactions
+- Consumed (next integrating commit) by the /api/handoff/yield route's onYield handler:
+  `coordinator.acquireLeaseOnConsent(fromMachineId)`. The outgoing machine's HandoffSentinel
+  sends the yield only after a verified ack + passing validation, so by the time consent
+  reaches the incoming, the outgoing has committed to standing down.
+- Mirrors the success path of acquireIfEligible (effectiveView → buildAcquisition → casWrite
+  → broadcast → emitEpoch), so behavior is consistent with the proven acquisition flow.
+
+## Rollback cost
+- Minimal — two additive methods, no change to existing paths. Reverting removes them.
+
+## Tests
+- `tests/unit/LeaseCoordinator.test.ts` (+4, 12 total): consent takes a LIVE peer-held
+  lease (the bypass) while the normal path refuses it; **SECURITY — a yield from a
+  non-holder is refused (no takeover)**; idempotent when already held; acquires from empty.
+  tsc clean.

package/upgrades/side-effects/cross-machine-seamlessness-exactly-once-ingress.md

@@ -0,0 +1,73 @@
+# Side-Effects Review — Cross-Machine Seamlessness: exactly-once ingress gate (D, no-duplicate half)
+
+**Spec:** docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §8 G3a (converged, approved)
+
+Wires the MessageProcessingLedger into the live Telegram message path so a redelivered /
+handoff-window-replayed inbound event is recognized and NOT answered twice. This is the
+no-DUPLICATE-reply half of G3a. It ships DARK behind `multiMachine.exactlyOnceIngress`
+(default false): when off, the message path is byte-for-byte unchanged.
+
+## What changed
+- `src/messaging/ingressDedup.ts` — NEW. `decideIngress(ledger, dedupeKey, opts)` → process | drop
+  (records received → claims processing under the lease epoch; drops already-replied or
+  in-flight-not-stuck; re-claims a fenced-holder's stuck entry). `commitInboundReply(...)` →
+  reply_committed + cursor_advanced with the deterministic idempotency key. `dedupeKeyFor(...)`.
+- `src/server/routes.ts` — INBOUND gate in `/internal/telegram-forward`, placed AFTER the
+  sentinel intercept (emergency-stop/pause must never be deduped) and BEFORE routing: on a
+  drop, returns `{ok:true,deduped:true}` without routing. OUTBOUND commit in
+  `/telegram/reply/:topicId` after a successful `sendToTopic`: commits the topic's current
+  inbound dedupeKey (skipped for proxy/system sends). Both FAIL-OPEN. Added `messageLedger` +
+  `currentInboundByTopic` to RouteContext.
+- `src/server/AgentServer.ts` — `messageLedger?` + `currentInboundByTopic?` options → routeCtx.
+- `src/commands/server.ts` — constructs the ledger + per-topic map ONLY when
+  `seamlessness.exactlyOnceIngress` (fail-open if open() throws → gate stays dark).
+- `src/core/seamlessnessConfig.ts` + `src/core/types.ts` — `exactlyOnceIngress` flag (default false).
+- `src/core/MultiMachineCoordinator.ts` — `getLeaseEpoch()` accessor (the ledger's fencing token).
+
+## Over-block / under-block
+- UNDER-block (the dangerous direction = a real message silently dropped): mitigated three ways.
+  (1) The gate ONLY drops when the ledger shows the SAME dedupeKey already reply_committed/
+  cursor_advanced, or processing-and-not-stuck — never a first-seen event. Proven both sides in
+  ingress-dedup.test.ts + the integration test. (2) FAIL-OPEN: any ledger throw routes normally
+  (tested). (3) Ships DARK (flag default false) — zero behavior change until a live test-as-self
+  flips it on.
+- OVER-block: a genuine NEW message is always `first-seen` → process. The dedupeKey is
+  `telegram:<topic>:<messageId>`, unique per user message, so two distinct messages never collide.
+- dedupeKey uses Telegram `message_id` (already on the forward, stable across redeliveries and
+  across machines). The spec names `update_id`; message_id is the functional v1 key (gate falls
+  back to it). update_id threading is a tracked refinement. <!-- tracked: topic-13481 -->
+
+## Signal vs authority
+- decideIngress returns a decision; the route is the single authority that drops/routes. The
+  ledger is durable record + fencing, not a gate of its own.
+
+## Interactions
+- Placed after the sentinel intercept so "stop everything" is never deduped (wiring-integrity
+  test asserts gate index is between classify and onTopicMessage).
+- Outbound commit skipped for `isProxy` sends (PresenceProxy etc. are not replies to a user
+  inbound) so it never falsely commits an unrelated topic.
+- `currentInboundByTopic` is best-effort association (last claimed inbound per topic). Concurrent
+  inbounds for one topic before the first reply → the earlier one stays processing (eventually
+  reclaimable / replayed). Acceptable for v1, behind the flag.
+
+## NOT in this increment (tracked, topic-13481)
+- **No-LOSS-on-crash replay** (re-inject un-committed entries on restart) — the other G3a half.
+  Without it, this increment is a strict IMPROVEMENT (adds dedup, no regression: a crash after
+  inject-before-reply loses the reply exactly as today). Next increment.
+- Cross-machine `applyRemoteReplyMarker` propagation (tunnel+git) — the lease already ensures one
+  forwarder, so cross-machine double-handle is already prevented; this hardens the failover window.
+- CONTINUATION resume verification (D3); update_id dedupeKey (vs message_id).
+
+## Rollback cost
+- Low. Flag default-off ⇒ inert in production. Revert = drop the gate block + commit block + the
+  ledger construction; no migration, no persisted schema beyond the opt-in SQLite file. The route
+  returns to identical behavior when `messageLedger` is null.
+
+## Tests
+- `tests/unit/ingress-dedup.test.ts` (8) — decision both sides: first-seen, in-flight drop,
+  already-replied drop, stuck re-claim, within-window no-reclaim; commit idempotent + deterministic key.
+- `tests/integration/exactly-once-ingress.test.ts` (5) — gate through the REAL route + REAL ledger:
+  dark routes both, first routes + claims, in-flight dup dropped, already-replied dup dropped,
+  fail-open; + wiring-integrity (gate between sentinel and routing).
+- `tests/e2e/exactly-once-ingress-e2e.test.ts` (1) — gate ALIVE in a real booted AgentServer:
+  already-replied redelivery → 200 + deduped over real HTTP, not routed.