instar 1.3.557 → 1.3.559

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+zbtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA02btE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -22,7 +22,7 @@ import { TopicProfileOrchestrator, resolvedToApplied, } from '../core/TopicProfi
 import { CodexResumeMap } from '../core/CodexResumeMap.js';
 import { paneIdleWithEmptyInput } from '../core/ModelSwapService.js';
 import { escalatedModelIds, normalizeTierEscalationConfig } from '../core/ModelTierEscalation.js';
-import { activeAutonomousJobs } from '../core/AutonomousSessions.js';
+import { activeAutonomousJobs, autonomousRunRemainingForTopic } from '../core/AutonomousSessions.js';
 import { TopicProfileTransferCarrier, createTopicProfilePullHandler } from '../core/TopicProfileTransferCarrier.js';
 import { closeAllSqlite } from '../core/SqliteRegistry.js';
 import { SessionManager } from '../core/SessionManager.js';
@@ -5038,7 +5038,12 @@ export async function startServer(options) {
                 // best-effort (the refusal itself is the load-bearing safety).
                 const telegramForRoleGuard = telegram; // const-narrow for the closure
                 scheduler.setRoleGuard(() => ({
-                    enabled: config.multiMachine?.seamlessness?.ws43RoleGuard === true,
+                    // DEV-AGENT DARK GATE (operator directive 2026-06-13, topic 13481):
+                    // read ws43RoleGuard through resolveDevAgentGate so it resolves LIVE on
+                    // a dev agent / DARK on the fleet. The guard can only ever REFUSE a
+                    // spawn (never wrongly spawn — the safe direction); single-machine
+                    // agents always hold the lease, so it never fires there even live.
+                    enabled: resolveDevAgentGate(config.multiMachine?.seamlessness?.ws43RoleGuard, config),
                     holdsLease: coordinator.holdsLease(),
                 }), (slug, machineId) => {
                     void telegramForRoleGuard.createAttentionItem({
@@ -6044,6 +6049,24 @@ export async function startServer(options) {
             quietHoursEndAt: (now) => notificationBatcher.quietHoursEndAt(now),
             summaryReleaseAt: (now) => notificationBatcher.nextSummaryReleaseAt(now),
             resumeQueuedFor: (tmuxSession) => resumeQueuedForSession(tmuxSession),
+            // Honest-recycle (honest-session-recycle-spec): tell ReapNotifier whether
+            // this session's topic has an ACTIVE autonomous run (and how long is left),
+            // so an age-limit RECYCLE of a still-active run reads as a continuation
+            // instead of a "reached its maximum allowed runtime" death. Read here at
+            // the wiring layer (which has the autonomous state) — SessionManager's kill
+            // chokepoint is untouched. Returns null ⇒ legacy death copy (safe default).
+            autonomousRunActiveFor: (tmuxSession) => {
+                try {
+                    const t = telegram?.getTopicForSession(tmuxSession);
+                    if (t == null)
+                        return null;
+                    return autonomousRunRemainingForTopic(config.stateDir, t);
+                }
+                catch {
+                    // Fail toward the legacy death copy — never silence the notice.
+                    return null;
+                }
+            },
             reportDegradation: (reason, impact) => {
                 try {
                     DegradationReporter.getInstance().report({
@@ -9070,7 +9093,12 @@ export async function startServer(options) {
         const { SpeakerElection } = await import('../monitoring/SpeakerElection.js');
         const ws3Cfg = () => (config.multiMachine?.seamlessness ?? {});
         const speakerElection = new SpeakerElection({
-            enabled: () => ws3Cfg().ws3OneVoice === true,
+            // DEV-AGENT DARK GATE (operator directive 2026-06-13, topic 13481): read
+            // ws3OneVoice through resolveDevAgentGate so it resolves LIVE on a dev agent
+            // (config OMITS it → undefined → !!developmentAgent) and DARK on the fleet.
+            // An explicit config value still wins. Single-machine is a no-op regardless
+            // (the election never engages below 2 online machines).
+            enabled: () => resolveDevAgentGate(ws3Cfg().ws3OneVoice, config),
             currentMachineId: (() => {
                 // @silent-fallback-ok — no machine identity = the election's legacy-no-machine-id
                 // verdict (always speak): the designed single-machine degradation, not a loss.
@@ -13025,8 +13053,18 @@ export async function startServer(options) {
                     });
                     const registryForCutover = machinePoolRegistry;
                     scheduler.setJournalLeaseCutover(leaseStore, () => ({
-                        enabled: config.multiMachine?.seamlessness?.ws43JournalLease === true,
-                        dryRun: config.multiMachine?.seamlessness?.ws43JournalLeaseDryRun !== false,
+                        // DEV-AGENT DARK GATE (operator directive 2026-06-13, topic 13481):
+                        // read ws43JournalLease through resolveDevAgentGate → LIVE on a dev
+                        // agent / DARK on the fleet (config OMITS both flags). ws43JournalLease
+                        // DryRun resolves COHERENTLY: on a dev agent the cutover goes genuinely
+                        // live (dryRun → false) so the journal-lease path is actually exercised,
+                        // not just logged; on the fleet it resolves to the safe dry-run default
+                        // (true). An explicit config value still wins on either flag. A genuine
+                        // live cutover only engages when the flag resolves live AND the pool is
+                        // flag-coherent (≥2 machines all advertising not-dry-run), so a
+                        // single-machine dev agent never half-migrates.
+                        enabled: resolveDevAgentGate(config.multiMachine?.seamlessness?.ws43JournalLease, config),
+                        dryRun: config.multiMachine?.seamlessness?.ws43JournalLeaseDryRun ?? !resolveDevAgentGate(undefined, config),
                         epoch: coordinator.getLeaseEpoch(),
                         peers: registryForCutover
                             .getCapacities()
@@ -13126,7 +13164,7 @@ export async function startServer(options) {
                                 // WS1.1 capability advertisement (spec invariant 5): a bounded
                                 // fixed-size summary, never an inventory. Reported live each
                                 // heartbeat so a queue going dark withdraws the capability.
-                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue, ws12DrainReceive: !!_drainRunner, ws44PoolLinks: !!_poolLink, ws44PoolCache: !!_poolPollCache, ws43JournalLease: config.multiMachine?.seamlessness?.ws43JournalLease === true && config.multiMachine?.seamlessness?.ws43JournalLeaseDryRun !== true, stateSyncReceive: selfStateSyncReceive() },
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue, ws12DrainReceive: !!_drainRunner, ws44PoolLinks: !!_poolLink, ws44PoolCache: !!_poolPollCache, ws43JournalLease: resolveDevAgentGate(config.multiMachine?.seamlessness?.ws43JournalLease, config) && (config.multiMachine?.seamlessness?.ws43JournalLeaseDryRun ?? !resolveDevAgentGate(undefined, config)) !== true, stateSyncReceive: selfStateSyncReceive() },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -13427,7 +13465,14 @@ export async function startServer(options) {
                     const ws13Cfg = () => (config.multiMachine?.seamlessness ?? {});
                     const { OwnershipReconciler } = await import('../core/OwnershipReconciler.js');
                     const reconciler = new OwnershipReconciler({
-                        enabled: () => ws13Cfg().ws13Reconcile === true,
+                        // DEV-AGENT DARK GATE (operator directive 2026-06-13, topic 13481):
+                        // read ws13Reconcile through resolveDevAgentGate so the reconcile loop
+                        // resolves LIVE on a dev agent / DARK on the fleet. ws13DryRun STAYS a
+                        // plain config read (the in-component "log intended CAS without
+                        // performing it" rung — NOT the dev-gate); so on a dev agent the loop
+                        // runs live but in dry-run (no destructive CAS), exactly as the rollout
+                        // ladder intends. Strict single-machine no-op inside the module.
+                        enabled: () => resolveDevAgentGate(ws13Cfg().ws13Reconcile, config),
                         dryRun: () => ws13Cfg().ws13DryRun !== false,
                         selfMachineId: _meshSelfId,
                         pinStore: _topicPinStore,