instar 1.3.651 → 1.3.653

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi3ftE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgvgBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -23,6 +23,7 @@ import { handleProcessLevelError } from '../core/uncaughtExceptionPolicy.js';
 import { configureHostSpawnSemaphore } from '../core/hostSpawnSemaphore.js';
 import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstanceLock.js';
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
+import { shouldReleaseOnComplete, planClaimOnSpawn, ownershipNonce } from '../core/ownershipFollowsLiveWork.js';
 import { PrHandLease } from '../core/PrHandLease.js';
 import { parseProfileTrigger, platformMessageIdFrom } from '../core/topicProfileIngress.js';
 import { slugifyChannelName } from '../messaging/slack/sanitize.js';
@@ -32,7 +33,7 @@ import { paneIdleWithEmptyInput } from '../core/ModelSwapService.js';
 import { escalatedModelIds, normalizeTierEscalationConfig } from '../core/ModelTierEscalation.js';
 import { activeAutonomousJobs, autonomousRunRemainingForTopic, listAutonomousJobs } from '../core/AutonomousSessions.js';
 import { AGE_LIMIT_ACTIVE_RUN_REASON, COMMITMENT_ACTIVE_RUN_REASON } from '../core/WorkEvidence.js';
-import { gapBEligibleForTopic, recentUserMessageFromHistory, resolveGapBInjectionGate, decideGapBInjection } from '../core/gapBCommitmentEvidence.js';
+import { gapBEligibleForTopic, recentUserMessageFromHistory, recentUserMessageAtFromHistory, resolveGapBInjectionGate, decideGapBInjection } from '../core/gapBCommitmentEvidence.js';
 import { TopicProfileTransferCarrier, createTopicProfilePullHandler } from '../core/TopicProfileTransferCarrier.js';
 import { closeAllSqlite } from '../core/SqliteRegistry.js';
 import { SessionManager } from '../core/SessionManager.js';
@@ -7333,6 +7334,13 @@ export async function startServer(options) {
                                 }
                             }
                             catch { /* @silent-fallback-ok: best-effort midWork tag; a failure must never undo the successful respawn (the run is alive, which is the goal). */ }
+                            // Ownership Follows Live Work — Part B (claim-on-spawn, FD2): this
+                            // autonomous respawn bypasses route() (which is what normally claims),
+                            // so ownership would stay on whatever machine last held it. Issue the
+                            // fenced-epoch place→claim onto THIS machine. The helper is a strict
+                            // no-op when the flag is OFF / single-machine, and best-effort (a lost
+                            // CAS / owned-by-peer race withholds — never undoes the live spawn).
+                            _claimOwnershipForAutonomousSpawn?.(topicId);
                         },
                         claimInflight: (topicId) => {
                             if (livenessInflight.has(topicId))
@@ -8468,6 +8476,67 @@ export async function startServer(options) {
                     }
                     return { cleared: false, reason: 'timeout' };
                 },
+                // ── Part D: double-dispatch recovery gate (ownership-follows-live-work) ──
+                // Injected primitives so checkAndRecover consults per-topic ownership
+                // before re-running locally. All read the late-bound registry/pool deps
+                // (sessionOwnershipRegistry @ ~15976, _meshSelfId, machinePoolRegistry @
+                // ~15703) — these closures fire at runtime, after those are assigned.
+                // Strict no-op when the flag resolves OFF / single-machine.
+                ownershipFollowsLiveWork: () => resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config),
+                ownerOfTopic: (topicId) => {
+                    // ownReg.ownerOf — MAY THROW (the gate's fail-OPEN registry-unknown
+                    // branch). NO catch here: a throw must propagate so the gate takes its
+                    // labeled fail-open path (catching here would mask it).
+                    const reg = sessionOwnershipRegistry;
+                    if (!reg)
+                        return null; // pool dark / single-machine → no peer can own it
+                    return reg.ownerOf(String(topicId));
+                },
+                selfMachineId: () => _meshSelfId,
+                // Owner-reachability — the SAME shared helper the third Part-D site
+                // (recoverStuckMessages) uses, so the two gates can never diverge. MAY
+                // THROW: the gate treats a throw as the unreachable-peer branch (the
+                // record names a peer). NO catch here (propagate to the gate's handler).
+                isOwnerReachable: (owner) => isOwnerReachableShared(owner),
+                forwardPendingInboundViaRoute: async (topicId) => {
+                    // Forward the topic's ALREADY-DURABLE pending inbound through the
+                    // existing durable-inbound-queue drain (which routes via route() +
+                    // applies isRemotelyHandled at dispatch). When the durable queue is not
+                    // wired (the common case today), there is no durable pending inbound to
+                    // forward → nonePending:true (the gate withholds the local respawn; the
+                    // leftover idle session is converged by the existing reaper/reconciler).
+                    const q = _inboundQueue;
+                    if (!q)
+                        return { forwarded: 0, nonePending: true };
+                    const sk = String(topicId);
+                    let hasPending = false;
+                    try {
+                        hasPending = q.hasQueued(sk);
+                    }
+                    catch {
+                        hasPending = false;
+                    }
+                    if (!hasPending)
+                        return { forwarded: 0, nonePending: true };
+                    try {
+                        const summary = await q.onOwnershipTransition(sk);
+                        return { forwarded: summary?.dispatched ?? 0, nonePending: false };
+                    }
+                    catch {
+                        // @silent-fallback-ok — the drain is best-effort; route()'s own ledger
+                        // owns delivery + exactly-once. There WAS pending, so nonePending:false.
+                        return { forwarded: 0, nonePending: false };
+                    }
+                },
+                emitRecoveryGateTelemetry: (row) => {
+                    // ONE neutral observational row to the machine-local sentinel audit so
+                    // the fail-OPEN tradeoff is MEASURED (the fleet-promotion gate reads it).
+                    try {
+                        const auditPath = path.join(config.stateDir, 'logs', 'sentinel-events.jsonl');
+                        fs.appendFileSync(auditPath, JSON.stringify({ ts: new Date().toISOString(), ...row }) + '\n');
+                    }
+                    catch { /* @silent-fallback-ok — telemetry is observability; never affects the recovery decision */ }
+                },
             });
             // Track context exhaustion kills to prevent beforeSessionKill from re-saving
             // resume UUIDs (which would cause an infinite death loop)
@@ -14087,6 +14156,96 @@ export async function startServer(options) {
                 config: { residueDenylist: ysCfg.residueDenylist, cacheTtlMs: ysCfg.dirtyCheckCacheTtlMs },
             });
         }
+        // ── Post-transfer closeout correctness (F1) ───────────────────────────────
+        // closeoutLivenessGate: when on, the post-transfer closeout no longer
+        // terminates the live local session on a stale/unverified ownership record —
+        // it verifies the owning machine ACTUALLY has a live session for the topic via
+        // a machine-local liveness snapshot before shedding the leftover. Ships dark
+        // fleet-wide, LIVE on a dev agent via resolveDevAgentGate. When OFF the snapshot
+        // is never built and the new deps are left absent (closeout byte-identical).
+        // Spec: docs/specs/post-transfer-closeout-correctness.md.
+        const _closeoutLivenessGate = resolveDevAgentGate(config.monitoring?.sessionReaper?.closeoutLivenessGate, config);
+        let _closeoutSnapshot;
+        // The combined ATOMIC owner read the gated closeout consumes — ONE registry
+        // read returning the STABLE machineId (liveness key) AND the display label
+        // (audit text), guaranteeing they describe the same owner from one instant.
+        const _topicOwnerElsewhereInfo = (topicId) => {
+            try {
+                const reg = sessionOwnershipRegistry;
+                const self = _meshSelfId;
+                if (!reg || !self)
+                    return null;
+                const machineId = reg.ownerOf(String(topicId));
+                if (!machineId || machineId === self)
+                    return null;
+                const displayName = machinePoolRegistry?.getCapacity(machineId)?.nickname ?? machineId;
+                return { machineId, displayName };
+            }
+            catch {
+                return null; /* @silent-fallback-ok — pool not wired yet → rule inert (withhold) */
+            }
+        };
+        if (_closeoutLivenessGate) {
+            const { CloseoutLivenessSnapshot } = await import('../monitoring/closeoutLivenessSnapshot.js');
+            const _reaperTick = config.monitoring?.sessionReaper?.tickIntervalSec ?? 120;
+            _closeoutSnapshot = new CloseoutLivenessSnapshot({
+                resolvePeerUrls: () => _resolvePeerUrls?.() ?? [],
+                // Reuse the proven per-peer GET /sessions fetch primitive (5s timeout,
+                // same shape as the pool route's fan-out). Rejects on any failure so the
+                // entry ages to stale → 'unknown' (fail-closed).
+                fetchPeerSessions: async (peer) => {
+                    const r = await fetch(`${peer.url}/sessions`, {
+                        headers: { Authorization: `Bearer ${config.authToken}` },
+                        signal: AbortSignal.timeout(5000),
+                    });
+                    if (!r.ok)
+                        throw new Error(`HTTP ${r.status}`);
+                    return (await r.json());
+                },
+                // Owner set = distinct machineId of every owned-elsewhere topic that has
+                // a live LOCAL leftover here (the exact set the closeout could act on).
+                ownerSet: () => {
+                    const owners = new Set();
+                    try {
+                        for (const s of sessionManager.listRunningSessions()) {
+                            const t = _resolveTopic(s.tmuxSession);
+                            if (t == null)
+                                continue;
+                            const info = _topicOwnerElsewhereInfo(t);
+                            if (info)
+                                owners.add(info.machineId);
+                        }
+                    }
+                    catch { /* @silent-fallback-ok — degrade to whatever was already pending */ }
+                    return [...owners];
+                },
+                now: () => Date.now(),
+                raiseAttention: (item) => {
+                    try {
+                        if (!telegram)
+                            return;
+                        void telegram.createAttentionItem({
+                            id: item.id, title: item.title, summary: item.summary, description: item.description,
+                            category: 'sessions', priority: 'NORMAL',
+                            sourceContext: 'session-reaper:closeout-snapshot-breaker',
+                        }).catch(() => { });
+                    }
+                    catch { /* @silent-fallback-ok — telegram not wired (TDZ) → audit-only */ }
+                },
+                audit: reaperAuditSink(config.stateDir),
+            }, { tickIntervalSec: _reaperTick });
+            // Level-triggered on the reaper cadence with ±10% jitter (anti-herd). Async
+            // refresh; the closeout always reads the PREVIOUS snapshot, never a fetch it
+            // triggers this tick. A thrown pass is swallowed (previous snapshot ages to
+            // stale → 'unknown'); the loop is never wedged.
+            const _jitter = 1 + (Math.random() * 0.2 - 0.1);
+            const _snapshotTimer = setInterval(() => {
+                void _closeoutSnapshot.refresh().catch(() => { });
+            }, Math.round(_reaperTick * 1000 * _jitter));
+            if (typeof _snapshotTimer.unref === 'function')
+                _snapshotTimer.unref();
+            console.log(pc.green('  SessionReaper closeoutLivenessGate ON (post-transfer closeout liveness-gated — live)'));
+        }
         const sessionReaper = new SessionReaper({
             ...reapGuardDeps,
             dirtyCheck: _yieldSafetyDirtyCheck,
@@ -14133,6 +14292,8 @@ export async function startServer(options) {
             },
             terminate: (id, reason, opts) => sessionManager.terminateSession(id, reason, {
                 bypassActiveProcessKeep: opts?.bypassActiveProcessKeep,
+                bypassRecentUserMessageForConfirmedMove: opts?.bypassRecentUserMessageForConfirmedMove,
+                workEvidence: opts?.workEvidence,
             }),
             markReaping: (id) => sessionManager.markReaping(id),
             clearReaping: (id) => sessionManager.clearReaping(id),
@@ -14161,6 +14322,28 @@ export async function startServer(options) {
                     return null; /* @silent-fallback-ok — pool not wired yet → rule inert */
                 }
             },
+            // Post-transfer closeout correctness (F1): the ATOMIC combined owner read
+            // the gated closeout uses (stable machineId + display label from ONE
+            // registry read). Always constructed (a pure read helper); the closeout
+            // only consults it on the gated path. Returns null when the pool is dark.
+            topicOwnerElsewhereInfo: _topicOwnerElsewhereInfo,
+            // Post-transfer closeout correctness (F1): the liveness verdict, read from
+            // the machine-local snapshot (NOT a live per-tick fetch). Injected ONLY
+            // when the gate resolved on (the snapshot exists); absent ⇒ gate inert.
+            remoteOwnerHasLiveSession: _closeoutSnapshot?.remoteOwnerHasLiveSession,
+            // Post-transfer closeout correctness (F1, Part E): the LOCAL-receipt ts of
+            // the bound topic's newest user message — same history source the
+            // recent-user-message KEEP-guard reads. Backs the freshest-interaction veto.
+            recentUserMessageAt: (topicId) => {
+                try {
+                    if (!telegram)
+                        return null;
+                    return recentUserMessageAtFromHistory(telegram.getTopicHistory(topicId, 50));
+                }
+                catch {
+                    return null; /* @silent-fallback-ok — no history → withhold the bypass (safe) */
+                }
+            },
             // WS1.3: pin-conflict do-not-act — a pin naming THIS machine while the
             // owner is elsewhere means the reconciler is bringing the topic back;
             // the closeout holds instead of attacking the session the pin wants here.
@@ -14210,6 +14393,11 @@ export async function startServer(options) {
                 // Observe-only busy-orphan detection rides the same dev-gate (dark fleet,
                 // live on dev agents). Zero risk — it never changes a keep/kill verdict.
                 busyOrphanDetection: resolveDevAgentGate(rcfg.busyOrphanDetection, config),
+                // Post-transfer closeout correctness (F1): the liveness gate rides the
+                // SAME dev-gate (dark fleet, live on dev agents). Resolved once here so
+                // the reaper's gated/legacy branch matches the snapshot construction
+                // above (both read resolveDevAgentGate(...closeoutLivenessGate)).
+                closeoutLivenessGate: _closeoutLivenessGate,
             };
         })());
         sessionReaper.start();
@@ -14711,6 +14899,21 @@ export async function startServer(options) {
         // Self-attests hardware + records a self-heartbeat so GET /pool + the Machines tab show
         // this machine online with its specs; peer liveness is fed from MachineHeartbeat.
         let machinePoolRegistry;
+        // Ownership Follows Live Work — Part D shared owner-reachability helper (FD/
+        // decision-completeness #4 unification). "reachable peer" = the SAME signal the
+        // router uses (`machinePoolRegistry.getCapacity(owner)?.online === true`, the
+        // isMachineAlive seam). Used by BOTH Part-D gates — the SessionRecovery deps
+        // (checkAndRecover) and the recoverStuckMessages site — so the two can NEVER
+        // make divergent reachability calls. A function declaration (hoisted) so both
+        // callsites — one textually before this line — resolve it; it reads
+        // machinePoolRegistry by closure at call time. THROWS-by-propagation are the
+        // caller's unreachable-peer branch; here we only return the boolean (an absent
+        // registry / unknown machine → false = treat as unreachable, the safe side).
+        function isOwnerReachableShared(owner) {
+            const cap = machinePoolRegistry?.getCapacity(owner);
+            return cap?.online === true;
+        }
+        void isOwnerReachableShared; // referenced from the late deps closures (hoisted)
         try {
             const poolMod = await import('../core/MachinePoolRegistry.js');
             const osMod = await import('node:os');
@@ -14993,6 +15196,18 @@ export async function startServer(options) {
         // git-backed store swaps in for the Track-H proof (the registry is store-agnostic).
         let meshRpcDispatcher;
         let sessionOwnershipRegistry;
+        /**
+         * Ownership Follows Live Work — Part B (claim-on-spawn). Assigned inside the
+         * durable-ownership wiring block (where `ownReg`/`emitPlacement`/`_meshSelfId`
+         * are in lexical scope) and CALLED from the AutonomousLivenessReconciler
+         * `respawn` closure (defined ~7900, invoked at runtime AFTER this is wired).
+         * Null until wired and a strict no-op when the flag resolves OFF or
+         * `_meshSelfId` is null (single-machine). The closure issues a fenced-epoch
+         * `place → claim` so ownership follows the live autonomous session onto THIS
+         * machine; it NEVER force-claims a peer-owned topic (FD3) and a lost CAS is a
+         * no-op (the spawn still runs; the reconciler/applier converge — FD11).
+         */
+        let _claimOwnershipForAutonomousSpawn = null;
         try {
             const meshMod = await import('../core/MeshRpc.js');
             const idMod = await import('../core/MachineIdentity.js');
@@ -15372,6 +15587,167 @@ export async function startServer(options) {
                     }
                     catch { /* observability never endangers the observed */ }
                 };
+                // ── Ownership Follows Live Work (docs/specs/ownership-follows-live-work.md) ──
+                // Parts A + B wire HERE, inside the durable-ownership block, because this is
+                // the only scope where `ownReg`, `emitPlacement`, and `_meshSelfId` are all in
+                // lexical view. The spec's anchor (server.ts:13247, "alongside the existing
+                // sessionComplete handler") assumed `ownReg`/`_meshSelfId` were in scope there
+                // — they are NOT (they are declared in this nested try-block, textually after).
+                // Registering Part A's `sessionComplete` listener here (a session listener may
+                // be added at any point during init) keeps the release logic where its deps
+                // live; Part B is exposed via the hoisted `_claimOwnershipForAutonomousSpawn`
+                // so the reconciler `respawn` closure (defined ~7900, before this block) can
+                // reach it. (Anchor correction recorded in the implementation summary.)
+                {
+                    const ownershipFollowsLiveWork = resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config);
+                    // ── Part A: release-on-complete ──────────────────────────────────────
+                    // On the SessionManager 'sessionComplete' event, if THIS machine is the
+                    // topic's `active` owner AND no DIFFERENT live session is bound to the
+                    // topic, issue a `release` CAS so the record advances to `released` instead
+                    // of being stuck `active` (the stale label PR #1258's closeout defends
+                    // against). Fail-closed/withhold on EVERY uncertainty. The flag gate is
+                    // re-read here so a session listener registered once at boot is inert when
+                    // the feature resolves OFF (byte-identical legacy behavior).
+                    sessionManager.on('sessionComplete', (session) => {
+                        try {
+                            if (!ownershipFollowsLiveWork || !_meshSelfId)
+                                return; // single-machine / dark = strict no-op
+                            const tmux = session.tmuxSession || session.name;
+                            if (!tmux)
+                                return;
+                            // Resolve the topicId from the completing session's tmux name. A throw
+                            // or empty result → SKIP (fail-closed toward NOT releasing): a topicId
+                            // we cannot resolve is a record we cannot prove is ours (adversarial X2).
+                            let topicId = null;
+                            try {
+                                const t = telegram?.getTopicForSession(tmux);
+                                if (t != null) {
+                                    const n = typeof t === 'number' ? t : Number(t);
+                                    topicId = Number.isFinite(n) ? n : null;
+                                }
+                            }
+                            catch {
+                                topicId = null; /* @silent-fallback-ok — unresolvable topic → unbound → skip (no release), the deliberate fail-closed direction (adversarial X2) */
+                            }
+                            if (topicId == null)
+                                return; // no topic binding → not topic-owned → skip
+                            const sk = String(topicId);
+                            // Resolve the CURRENT live session's stable instance key for the
+                            // session-identity guard (FD9). `telegram.getSessionForTopic` returns
+                            // the live session NAME (an anchor correction vs the spec's pseudocode,
+                            // which assumed it returned a Session); resolve that name to the
+                            // running Session and read its `startedAt` (the stable per-instance
+                            // key — tmux NAMES are reused across respawn). `undefined` means
+                            // "couldn't enumerate / no live session" → handled fail-closed below.
+                            let liveStartedAt = null; // null = no live session bound
+                            try {
+                                const liveName = telegram?.getSessionForTopic?.(topicId) ?? null;
+                                if (liveName) {
+                                    const liveSess = sessionManager
+                                        .listRunningSessions()
+                                        .find((s) => s.tmuxSession === liveName || s.name === liveName);
+                                    // A bound name with no running Session (already gone) → no DIFFERENT
+                                    // live session (null). A running Session → its startedAt (may be
+                                    // missing on a legacy record → unprovable → withhold via the helper).
+                                    liveStartedAt = liveSess ? (liveSess.startedAt ?? '') : null;
+                                }
+                            }
+                            catch {
+                                // @silent-fallback-ok — cannot enumerate live sessions for the
+                                // identity guard → FAIL-CLOSED. Pass an empty-string key so the
+                                // helper's unprovable-identity branch withholds the release.
+                                liveStartedAt = '';
+                            }
+                            // (a) owner === self AND (b) status === active AND (c) the session-
+                            // identity guard — all resolved by the single-sourced pure helper.
+                            const rec = (() => { try {
+                                return ownReg.read(sk);
+                            }
+                            catch {
+                                return undefined; /* @silent-fallback-ok — registry unreadable → caller withholds the release (fail-closed); a read error must never break the completion path */
+                            } })();
+                            if (rec === undefined)
+                                return; // registry unreadable → withhold (fail-closed)
+                            if (!shouldReleaseOnComplete({
+                                enabled: ownershipFollowsLiveWork,
+                                selfMachineId: _meshSelfId,
+                                record: rec,
+                                completingStartedAt: session.startedAt,
+                                liveStartedAt,
+                            }))
+                                return;
+                            const prevOwner = rec.ownerMachineId;
+                            const r = ownReg.cas({ type: 'release', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'rel-complete', sk) });
+                            // MANDATORY pairing — scripts/lint-cas-emit-placement.js fails CI on an
+                            // unpaired cas(). Records 'released' into the coherence journal so the
+                            // release replicates exactly like the user-move release does. A lost CAS
+                            // (peer advanced the epoch first) is a no-op here — we never retry/force.
+                            emitPlacement(sk, r, 'released', prevOwner);
+                        }
+                        catch {
+                            // @silent-fallback-ok — release-on-complete is best-effort housekeeping
+                            // (FD1); a throw must never break the completion path. The existing
+                            // reconciler/applier + PR #1258 closeout still handle a missed release.
+                        }
+                    });
+                    // ── Part B: claim-on-spawn (assign the hoisted helper) ───────────────
+                    // After an autonomous respawn (the path that genuinely bypasses route()),
+                    // issue a fenced-epoch `place → claim` so ownership follows the live session
+                    // onto THIS machine. Owned-by-peer is NOT force-claimed (FD3): the
+                    // reconciler already gates respawn on topicOwnerElsewhere, so the
+                    // owned-by-peer case should not reach here; if a post-gate race does, the
+                    // claim is withheld and ONE neutral audit row records the divergence.
+                    _claimOwnershipForAutonomousSpawn = (topicId) => {
+                        try {
+                            if (!ownershipFollowsLiveWork || !_meshSelfId)
+                                return; // single-machine / dark = no-op
+                            const sk = String(topicId);
+                            let cur;
+                            try {
+                                cur = ownReg.read(sk);
+                            }
+                            catch {
+                                return; /* registry unreadable → withhold (fail-closed) */
+                            }
+                            const plan = planClaimOnSpawn({ enabled: ownershipFollowsLiveWork, selfMachineId: _meshSelfId, record: cur });
+                            if (plan.action === 'noop')
+                                return; // already ours / dark → nothing to do
+                            if (plan.action === 'place-then-claim') {
+                                // never-seen / released → place then claim onto self.
+                                const prev0 = cur?.ownerMachineId;
+                                const rp = ownReg.cas({ type: 'place', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'auto-place', sk) });
+                                emitPlacement(sk, rp, 'placed', prev0);
+                                if (rp.ok) {
+                                    const rc = ownReg.cas({ type: 'claim', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'auto-claim', sk) });
+                                    emitPlacement(sk, rc, 'placed', _meshSelfId);
+                                }
+                                // place lost (a peer advanced first) → claim NOT attempted; the
+                                // session still runs locally and the reconciler/applier converge (FD11).
+                                return;
+                            }
+                            // plan.action === 'audit-owned-elsewhere': owned by a PEER → do NOT
+                            // force-claim (FD3, fail-closed). This should not occur on the
+                            // reconciler path (its topicOwnerElsewhere gate already filters it); a
+                            // post-gate race lands ONE neutral, non-directional audit row to the
+                            // machine-local liveness log.
+                            try {
+                                const auditPath = path.join(config.stateDir, 'logs', 'autonomous-liveness.jsonl');
+                                fs.appendFileSync(auditPath, JSON.stringify({
+                                    ts: new Date().toISOString(),
+                                    kind: 'auto-spawn-owned-elsewhere',
+                                    topicId,
+                                    owner: plan.owner,
+                                    status: plan.status,
+                                }) + '\n');
+                            }
+                            catch { /* @silent-fallback-ok — observational audit; never break the spawn */ }
+                        }
+                        catch {
+                            // @silent-fallback-ok — claim-on-spawn is best-effort (FD1/FD11); a throw
+                            // must never undo the successful spawn (the run is alive, which is the goal).
+                        }
+                    };
+                }
                 // The §L3 ownership commands, routed from MeshRpc to the registry CAS.
                 const ownAction = (cmd, sender, env) => {
                     if (cmd.type === 'place') {
@@ -17905,6 +18281,32 @@ export async function startServer(options) {
                         epoch: coordinator.getLeaseEpoch(),
                         maxProcessingMs: seamlessness.maxProcessingMs,
                         reinject: reinjectStuck,
+                        // Part D, third site (ownership-follows-live-work): per-topic owner check
+                        // ON TOP of the existing machine-level holdsLease() gate. SKIP a topic
+                        // owned by a REACHABLE peer (leave its stuck messages in the ledger for
+                        // the owner to drain). Flag-gated; every uncertainty resolves to the SAFE
+                        // side (not-owned-elsewhere → re-feed as today). Uses the SAME shared
+                        // reachability helper as the checkAndRecover Part-D gate.
+                        ownerElsewhereReachable: (topic) => {
+                            try {
+                                const on = resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config);
+                                if (!on)
+                                    return false; // dark / legacy → no ownership check
+                                const reg = sessionOwnershipRegistry;
+                                const self = _meshSelfId;
+                                if (!reg || !self)
+                                    return false; // single-machine → no peer can own it
+                                const owner = reg.ownerOf(String(topic));
+                                if (!owner || owner === self)
+                                    return false; // unowned / ours → re-feed as today
+                                return isOwnerReachableShared(owner); // peer + reachable → skip (owner drains it)
+                            }
+                            catch {
+                                // @silent-fallback-ok — any uncertainty → SAFE side (re-feed as
+                                // today). Never WITHHOLD a re-feed on a registry/pool blip.
+                                return false;
+                            }
+                        },
                         logger: (m) => console.log(pc.dim(`  ${m}`)),
                     });
                     // Gap #2 (wedge-recovery-drops-messages): an entry whose re-run budget is