instar 1.3.651 → 1.3.653

package/dist/monitoring/closeoutLivenessSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"closeoutLivenessSnapshot.d.ts","sourceRoot":"","sources":["../../src/monitoring/closeoutLivenessSnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B;wFACoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;8EAC8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB;qFACiF;IACjF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;oBAGoB;AACpB,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,eAAe,EAAE,MAAM,CAAC;IACxB;kFAC8E;IAC9E,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,eAAO,MAAM,uBAAuB,EAAE,cAGrC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B;;8EAE0E;IAC1E,eAAe,EAAE,MAAM,OAAO,EAAE,CAAC;IACjC;;;wDAGoD;IACpD,iBAAiB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjE;;;sBAGkB;IAClB,QAAQ,EAAE,MAAM,MAAM,EAAE,CAAC;IACzB,2BAA2B;IAC3B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,uEAAuE;IACvE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACtG,2CAA2C;IAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAMpE;AAWD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAEjE;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;yFACqF;IACrF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE;oDACgD;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,0EAA0E;IAC1E,OAAO,CAAC,oBAAoB,CAAK;IACjC,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAAS;gBAElB,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAK7D,wDAAwD;IACxD,OAAO,KAAK,gBAAgB,GAE3B;IAED;;;;;OAKG;IACH,yBAAyB,GAAI,SAAS,MAAM,EAAE,gBAAgB,MAAM,KAAG,cAAc,CAmBnF;IAEF;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyE9B,2EAA2E;IAC3E,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAItD,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAE1B;CACF"}

package/dist/monitoring/closeoutLivenessSnapshot.js

@@ -0,0 +1,207 @@
+/**
+ * closeoutLivenessSnapshot.ts — the machine-local liveness snapshot that backs
+ * the post-transfer closeout's liveness gate (Part C of
+ * docs/specs/post-transfer-closeout-correctness.md).
+ *
+ * THE problem it solves: SessionReaper's post-transfer closeout could terminate
+ * the LIVE local session for a topic when the local ownership record was STALE —
+ * because nothing verified the remote owner ACTUALLY has a live session for the
+ * topic. This module is the verification: a periodically-refreshed local snapshot
+ * of "which topics have a live session on each peer", built FROM the SAME per-peer
+ * `GET /sessions` fan-out the pool route already performs (no new endpoint), fed
+ * to the reaper as a synchronous `remoteOwnerHasLiveSession(topicId, machineId)`
+ * dep that returns `true | false | 'unknown'`.
+ *
+ * Fail-closed everywhere: a missing/stale snapshot, an unreachable peer, or any
+ * error → `'unknown'` → the reaper WITHHOLDS the closeout (never kills the live
+ * worker). An EMPTY topics-set on a FRESH, successfully-reached peer is a
+ * definitive `false` (the stale-owner signal), NOT `'unknown'` — freshness means
+ * "reached at reachableAt ≤ bound", never "non-empty".
+ *
+ * Machine-local by design: every machine runs its OWN closeout against its OWN
+ * locally-built snapshot. It is NOT replicated and NOT proxied (the closeout
+ * decision is inherently local: "should *I* shed *my* leftover?").
+ *
+ * No Unbounded Loops: the refresher is LEVEL-triggered on a fixed (jittered)
+ * cadence with a per-attempt 5s timeout, per-pass eviction of departed peers, and
+ * an OBSERVABILITY breaker (a consecutive-all-failed counter that SURFACES the
+ * degraded condition rather than STOPPING the loop — stopping would freeze the
+ * snapshot at `'unknown'` forever, the wrong direction for a safe-failure loop).
+ */
+export const DEFAULT_SNAPSHOT_CONFIG = {
+    tickIntervalSec: 120,
+    snapshotBreakerThreshold: 5,
+};
+/**
+ * Extract the bound topic id from a peer session object, or null. Mirrors the
+ * pool `/sessions` route: a telegram-bound session carries `platform:'telegram'`
+ * + `platformId:<topic>`.
+ */
+export function topicOfPeerSession(s) {
+    if (s.platform !== 'telegram')
+        return null;
+    const raw = s.platformId;
+    if (typeof raw === 'number' && Number.isFinite(raw))
+        return raw;
+    if (typeof raw === 'string' && /^\d+$/.test(raw))
+        return Number(raw);
+    return null;
+}
+/**
+ * THE ONE NORMATIVE liveness predicate (spec "Peer `/sessions` liveness
+ * contract"): a topic counts as live-on-a-peer when that peer's `/sessions` lists
+ * a session bound to the topic that is NOT explicitly terminal/shutting-down. An
+ * entry whose state cannot be classified counts as LISTED (opaque is NOT dead) —
+ * so we EXCLUDE only the clearly-terminal states.
+ */
+const TERMINAL_STATUSES = new Set(['completed', 'failed', 'killed']);
+export function isTerminalPeerSession(s) {
+    return typeof s.status === 'string' && TERMINAL_STATUSES.has(s.status);
+}
+/**
+ * The machine-local liveness snapshot + its bounded refresher.
+ *
+ * Construct/start ONLY when `closeoutLivenessGate` resolves true — when the gate
+ * is off this is never built and the reaper's `remoteOwnerHasLiveSession` dep is
+ * left absent (the closeout keeps today's behavior).
+ */
+export class CloseoutLivenessSnapshot {
+    cfg;
+    deps;
+    /** machineId → { topics, reachableAt }. Bounded O(pool machines): evicted of
+     *  departed peers each pass; the topics set is bounded by a peer's session count. */
+    snapshot = new Map();
+    /** Owners discovered mid-tick (closeout saw an owner not yet covered) — fed to
+     *  the NEXT refresh, never the current read. */
+    pendingOwners = new Set();
+    /** Consecutive refresh passes where EVERY attempted peer fetch failed. */
+    consecutiveAllFailed = 0;
+    /** Whether the breaker attention item has already been raised this episode. */
+    breakerRaised = false;
+    constructor(deps, cfg) {
+        this.deps = deps;
+        this.cfg = { ...DEFAULT_SNAPSHOT_CONFIG, ...(cfg ?? {}) };
+    }
+    /** The staleness bound: 2× the refresh cadence (ms). */
+    get stalenessBoundMs() {
+        return 2 * this.cfg.tickIntervalSec * 1000;
+    }
+    /**
+     * The reaper's synchronous liveness dep. Reads ONLY the already-populated
+     * snapshot (never a fetch it triggers). On the FIRST tick a topic's owner is
+     * not yet covered, this returns `'unknown'` (→ WITHHOLD) AND enqueues the owner
+     * for the next refresh pass.
+     */
+    remoteOwnerHasLiveSession = (topicId, ownerMachineId) => {
+        try {
+            const entry = this.snapshot.get(ownerMachineId);
+            if (!entry) {
+                // Owner not yet covered — discover it for the NEXT pass, withhold now.
+                this.pendingOwners.add(ownerMachineId);
+                return { state: 'unknown' };
+            }
+            const age = this.deps.now() - entry.reachableAt;
+            if (!(age <= this.stalenessBoundMs)) {
+                // Stale — the peer was unreachable / timed out at the last refresh.
+                return { state: 'unknown' };
+            }
+            // FRESH: an empty topics set is a definitive `false` (reached, zero
+            // sessions = the stale-owner signal), never 'unknown'.
+            return { state: entry.topics.has(topicId), reachableAt: entry.reachableAt };
+        }
+        catch {
+            return { state: 'unknown' };
+        }
+    };
+    /**
+     * One refresh pass — owner-scoped, bounded fan-out. Called on the reaper
+     * cadence. Returns the count of peers fetched (for observability/tests).
+     */
+    async refresh() {
+        let owners;
+        try {
+            owners = new Set([...this.deps.ownerSet(), ...this.pendingOwners]);
+        }
+        catch {
+            owners = new Set(this.pendingOwners);
+        }
+        this.pendingOwners.clear();
+        // Intersect with registered online peers (only fetch owners we can reach),
+        // and evict snapshot entries for peers no longer in the pool.
+        let registered = [];
+        try {
+            registered = this.deps.resolvePeerUrls();
+        }
+        catch {
+            registered = [];
+        }
+        const registeredById = new Map(registered.map(p => [p.machineId, p]));
+        // Eviction (bounded map growth): drop entries for departed peers.
+        for (const mid of [...this.snapshot.keys()]) {
+            if (!registeredById.has(mid))
+                this.snapshot.delete(mid);
+        }
+        const toFetch = [];
+        for (const mid of owners) {
+            const peer = registeredById.get(mid);
+            if (peer)
+                toFetch.push(peer);
+        }
+        if (toFetch.length === 0) {
+            // No owned-elsewhere leftovers reachable this pass → no HTTP, no breaker move.
+            return;
+        }
+        let anyOk = false;
+        await Promise.all(toFetch.map(async (peer) => {
+            try {
+                const list = await this.deps.fetchPeerSessions(peer);
+                const topics = new Set();
+                for (const s of list) {
+                    if (isTerminalPeerSession(s))
+                        continue; // exclude only clearly-terminal
+                    const t = topicOfPeerSession(s);
+                    if (t != null)
+                        topics.add(t);
+                }
+                // A FRESH reached peer with an EMPTY set is recorded (empty ≠ unknown).
+                this.snapshot.set(peer.machineId, { topics, reachableAt: this.deps.now() });
+                anyOk = true;
+            }
+            catch {
+                // Failed fetch: do NOT update reachableAt — the entry ages into stale →
+                // 'unknown' → WITHHOLD (the safe direction). @silent-fallback-ok
+            }
+        }));
+        // Observability breaker — SURFACE the degraded condition, never STOP the loop.
+        if (anyOk) {
+            this.consecutiveAllFailed = 0;
+            this.breakerRaised = false;
+        }
+        else {
+            this.consecutiveAllFailed += 1;
+            if (this.consecutiveAllFailed >= this.cfg.snapshotBreakerThreshold && !this.breakerRaised) {
+                this.breakerRaised = true;
+                this.deps.audit?.({
+                    kind: 'session-reaper',
+                    event: 'closeout-snapshot-breaker',
+                    consecutiveFailures: this.consecutiveAllFailed,
+                });
+                this.deps.raiseAttention?.({
+                    id: 'closeout-snapshot-breaker',
+                    title: 'Post-transfer liveness snapshot cannot reach any peer',
+                    summary: `The liveness snapshot has failed to reach any peer for ${this.consecutiveAllFailed} passes — closeout is safely withholding all leftovers.`,
+                    description: `The post-transfer closeout liveness snapshot could not reach ANY peer for ${this.consecutiveAllFailed} consecutive refresh passes. Closeout is safely WITHHOLDING every owned-elsewhere leftover (the fail-closed direction — no live worker is killed), but stale duplicate sessions will not be reclaimed until mesh connectivity recovers. Check mesh/peer connectivity.`,
+                });
+            }
+        }
+    }
+    /** Test/observability accessor — the current snapshot entry for a peer. */
+    peek(machineId) {
+        return this.snapshot.get(machineId);
+    }
+    /** Test/observability — whether the breaker has fired this episode. */
+    get breakerFired() {
+        return this.breakerRaised;
+    }
+}
+//# sourceMappingURL=closeoutLivenessSnapshot.js.map

package/dist/monitoring/closeoutLivenessSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"closeoutLivenessSnapshot.js","sourceRoot":"","sources":["../../src/monitoring/closeoutLivenessSnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AA4CH,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,eAAe,EAAE,GAAG;IACpB,wBAAwB,EAAE,CAAC;CAC5B,CAAC;AAyBF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAkB;IACnD,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,MAAM,UAAU,qBAAqB,CAAC,CAAkB;IACtD,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,GAAG,CAAiB;IACpB,IAAI,CAAe;IACpC;yFACqF;IACpE,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjE;oDACgD;IAC/B,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACnD,0EAA0E;IAClE,oBAAoB,GAAG,CAAC,CAAC;IACjC,+EAA+E;IACvE,aAAa,GAAG,KAAK,CAAC;IAE9B,YAAY,IAAkB,EAAE,GAA6B;QAC3D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,wDAAwD;IACxD,IAAY,gBAAgB;QAC1B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,GAAG,CAAC,OAAe,EAAE,cAAsB,EAAkB,EAAE;QACtF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,uEAAuE;gBACvE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;YAChD,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,oEAAoE;gBACpE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,oEAAoE;YACpE,uDAAuD;YACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,UAAU,GAAc,EAAE,CAAC;QAC/B,IAAI,CAAC;YAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,UAAU,GAAG,EAAE,CAAC;QAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,kEAAkE;QAClE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,OAAO,GAAc,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,+EAA+E;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;gBACjC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,qBAAqB,CAAC,CAAC,CAAC;wBAAE,SAAS,CAAC,gCAAgC;oBACxE,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,CAAC,IAAI,IAAI;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/B,CAAC;gBACD,wEAAwE;gBACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC5E,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,iEAAiE;YACnE,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;QAEJ,+EAA+E;QAC/E,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,oBAAoB,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1F,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,IAAI,EAAE,gBAAgB;oBACtB,KAAK,EAAE,2BAA2B;oBAClC,mBAAmB,EAAE,IAAI,CAAC,oBAAoB;iBAC/C,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzB,EAAE,EAAE,2BAA2B;oBAC/B,KAAK,EAAE,uDAAuD;oBAC9D,OAAO,EAAE,0DAA0D,IAAI,CAAC,oBAAoB,yDAAyD;oBACrJ,WAAW,EAAE,6EAA6E,IAAI,CAAC,oBAAoB,uQAAuQ;iBAC3X,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,SAAiB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.651",
+  "version": "1.3.653",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-24T08:27:53.399Z",
-  "instarVersion": "1.3.651",
+  "generatedAt": "2026-06-24T12:19:12.219Z",
+  "instarVersion": "1.3.653",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "2bcbf83f755cad24f909d1102bee3c6d187aebcb56c66b2f9b6afda4810e6950",
+      "contentHash": "1e975218f0ef7377bf709128150e65af094afcb3ff524c6822f2af136548f12b",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.652.md

@@ -0,0 +1,18 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+On a multi-machine setup, the SessionReaper's post-transfer closeout could terminate the LIVE local session for a topic when the local ownership record was STALE — it acted on "the registry says another machine owns this topic" without ever verifying that the other machine ACTUALLY has a live session for it, so a stale label could get the only live worker killed (and the operator-visible symptom was a `closeout-breaker` "the old session won't close" alert, escalating the wrong thing). This change (dev-gated dark behind `monitoring.sessionReaper.closeoutLivenessGate`, LIVE on a development agent) makes the closeout verify remote liveness first via a machine-local snapshot of each peer's `GET /sessions`: it proceeds ONLY when the owning machine genuinely has a live session (a real duplicate), and WITHHOLDS — never killing the sole live worker — on a no-live-remote-session reading, an unknown/unreachable peer, or any uncertainty (fail-closed everywhere). It also re-keys the closeout breaker counters on the stable topic id so a session-id churn across respawn no longer resets the veto count, and adds a narrow audited keep-reason bypass so a genuine move's leftover with a stale pre-move "recent" message can actually shed. Ships dark on the fleet (the dark stage of the maturation ladder, with explicit fleet-promotion criteria); when off, the closeout's behavior is byte-identical to today.
+
+## What to Tell Your User
+
+If you run me across more than one machine, I will never close the one session still doing real work just because a stale "who owns this conversation" record points at another machine. Before this, a record that went stale (the other machine already finished) could make my cleanup robot keep trying to kill the live worker in a loop. Now I first confirm the other machine actually has a live session before closing the leftover; if I can't confirm it, I hold off rather than risk killing live work. This is off everywhere except this development agent while it soaks.
+
+## Summary of New Capabilities
+
+- The post-transfer closeout now liveness-gates the kill: it terminates a topic's leftover session ONLY when the owning machine is confirmed to have a live session, and WITHHOLDS (fail-closed) when the owner has no live session, is unreachable, or liveness is unknown — so a stale ownership record can never get the sole live local worker killed.
+- A narrow, audited `recent-user-message` bypass lets a genuinely-moved leftover finally shed, but only after re-checking every OTHER keep-guard (active-subagent, open-commitment, …), so a live-working session is never killed by the bypass.
+- The closeout veto breaker is re-keyed on the stable topic id (not the churning session id), and the whole behavior ships dark behind `monitoring.sessionReaper.closeoutLivenessGate` (default OFF; dev-gated live-on-dev / dark-on-fleet) — flag off is byte-identical to today.

package/upgrades/1.3.653.md

@@ -0,0 +1,85 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The multi-machine `SessionOwnership` record can drift away from where the live
+session actually is, leaving a stale `active(owner=this-machine)` label after a
+transferred-here session completes. PR #1258 (`post-transfer-closeout-correctness`)
+*stopped the harm* by liveness-gating the `SessionReaper` closeout so it never
+kills a live local session on a stale label — a compensating control. This change
+removes the stale record itself, so the dangerous state can't arise:
+
+- **Part A — release-on-complete.** On the `sessionComplete` event, the owning
+  machine issues a `release` CAS for a topic-owned session it actively owns, so the
+  record advances to `released` (→ `ownerOf` reads null) instead of being stuck
+  `active`. Guarded by a session-identity check (FD9): the release is WITHHELD if a
+  DIFFERENT live session is bound to the topic — compared by the stable per-instance
+  key `startedAt`, NOT the reusable tmux name — closing the same-machine A∥B
+  "released record, live session" race the adversarial reviewer caught. Withheld on
+  every uncertainty (unresolvable topic, unprovable instance identity, registry
+  throw, CAS-lost).
+- **Part B — claim-on-spawn.** The autonomous respawn path (which bypasses the
+  router's claim) issues a fenced-epoch `place → claim` so ownership follows the
+  live session onto this machine. It NEVER force-claims a peer-owned topic (force is
+  reserved for the reconciler's death-evidence path) — a post-gate owned-elsewhere
+  race withholds + records one neutral audit row. A lost CAS is a no-op (the spawn
+  still runs; the existing reconciler/applier converge).
+- **Part D — double-dispatch recovery gate.** The single ungated recovery funnel
+  `SessionRecovery.checkAndRecover` (and the lease-gated `recoverStuckMessages`) now
+  consults per-topic ownership before re-running locally. A reachable-peer owner →
+  forward to the owner (don't re-run); an unreachable-peer owner → withhold (the
+  message rides the durable inbound queue); a null/self owner → re-run locally. The
+  registry-read-error path is deliberately fail-OPEN (re-run locally) and labeled as
+  such, emitting a `recovery-gate-registry-unknown` telemetry row so the tradeoff is
+  measured before any fleet promotion.
+
+All three parts ride ONE dark flag `multiMachine.ownershipFollowsLiveWork`, OMITTED
+from `ConfigDefaults` so `resolveDevAgentGate` resolves it LIVE on a dev agent / DARK
+on the fleet. With the flag OFF (or a single-machine agent — `_meshSelfId` null), the
+behavior is byte-identical to before: no release-on-complete, no claim-on-spawn, and
+the recovery paths run their existing logic with no ownership consultation.
+
+## What to Tell Your User
+
+Nothing yet — this ships dark on the fleet (live only on development agents for
+dogfooding) and is internal plumbing with no user-facing surface. The fleet flip is
+an evidence-gated dev soak, tracked separately (see the spec's fleet-promotion
+acceptance criteria). Do NOT narrate it as a finished capability.
+
+## Summary of New Capabilities
+
+- The multi-machine ownership record self-corrects toward where the live work is:
+  a completed session releases, an autonomous spawn claims, and a non-router recovery
+  path forwards (instead of double-dispatching) a topic this machine no longer owns.
+- Purely additive and dev-agent-gated; flag OFF / single-machine = byte-identical to
+  today. Every ownership write is the existing fenced-epoch CAS, best-effort, never
+  forced; Part D's ownership read is a signal that can only ever withhold a local
+  re-run or forward to the owner — never a new kill or send.
+
+## Evidence
+
+- `npx tsc --noEmit` — clean.
+- Full repo lint suite (`npm run lint`) — green (incl. `lint-cas-emit-placement`:
+  12 CAS sites all paired; `lint-dev-agent-dark-gate`; `lint-no-direct-destructive`).
+- 66 new tests across all three tiers, all green:
+  - Unit: `tests/unit/ownershipFollowsLiveWork.test.ts` (26 — Part A/B pure helpers
+    both-sides incl. FD9 same-machine A∥B clobber + not-yet-bound; FD10 nonce
+    collision-resistance; the A∥B and B∥transfer fenced-epoch races against the real
+    registry FSM) + `tests/unit/ownershipFollowsLiveWork-recovery-gate.test.ts` (10 —
+    Part D every ownership state + the fail-open-but-counted telemetry assertion) +
+    `tests/unit/stuck-message-recovery.test.ts` (3 added — the third Part-D site).
+  - Integration: `tests/integration/ownership-follows-live-work.test.ts` (6 — the
+    Part D gate wired with the REAL `MachinePoolRegistry` online signal; Part A/B
+    against the real registry).
+  - E2E: `tests/e2e/ownership-follows-live-work-lifecycle.test.ts` (7 — flag
+    resolution alive-on-dev / dark-on-fleet through the REAL ConfigDefaults +
+    `resolveDevAgentGate`; the PR #1258 stale-record lifecycle regression fixed at
+    the source).
+- Legacy regression suites green (no breakage): SessionOwnership, SessionOwnershipRegistry,
+  SessionRecovery, the three session-reaper suites (the PR #1258 area), OwnershipReconciler,
+  OwnershipApplier, devGatedFeatures-wiring (validates the new dev-gated entry).
+- Spec: `docs/specs/ownership-follows-live-work.md` (converged 3 rounds, codex-cli:gpt-5.5
+  external reviewer; 11 frontloaded decisions). Convergence report sibling.

package/upgrades/side-effects/ownership-follows-live-work.md

@@ -0,0 +1,137 @@
+# Side-Effects Review — Ownership Follows Live Work (release-on-complete + claim-on-spawn + double-dispatch recovery gate)
+
+**Version / slug:** `ownership-follows-live-work`
+**Date:** `2026-06-24`
+**Author:** Echo (autonomous)
+**Spec:** `docs/specs/ownership-follows-live-work.md` (converged, approved, 11 frontloaded decisions)
+**Second-pass reviewer:** independent Phase-5 review (the operator owns the trace/commit/PR ceremony)
+
+## Summary of the change
+
+Three independent gaps let the multi-machine `SessionOwnership` record drift from
+where the live session actually is. This change makes the record self-correcting,
+removing the stale-`active` cause PR #1258's reaper-closeout gate had to compensate
+for. All three parts ride ONE dark flag `multiMachine.ownershipFollowsLiveWork`
+(OMITTED from ConfigDefaults → `resolveDevAgentGate`: live-on-dev / dark-on-fleet).
+
+Files added:
+- `src/core/ownershipFollowsLiveWork.ts` — pure decision helpers (`shouldReleaseOnComplete`
+  for Part A's gate incl. the FD9 session-identity guard; `planClaimOnSpawn` for Part
+  B; `ownershipNonce` — the FD10 single collision-resistant nonce source). Single-
+  sourced so the gate logic is unit-testable.
+- `tests/unit/ownershipFollowsLiveWork.test.ts`, `tests/unit/ownershipFollowsLiveWork-recovery-gate.test.ts`,
+  `tests/integration/ownership-follows-live-work.test.ts`, `tests/e2e/ownership-follows-live-work-lifecycle.test.ts`.
+- `upgrades/next/ownership-follows-live-work.md` — release fragment (agent-only / experimental).
+
+Files modified:
+- `src/commands/server.ts` — (A) a new flag-gated `sessionComplete` listener wired
+  INSIDE the durable-ownership block (the only scope where `ownReg`/`emitPlacement`/
+  `_meshSelfId` are in lexical view — an anchor correction, see below) issuing a
+  release CAS + the mandatory `emitPlacement`; (B) a hoisted
+  `_claimOwnershipForAutonomousSpawn` helper called from the AutonomousLivenessReconciler
+  `respawn` closure after a successful spawn; (D) Part-D deps wired into the
+  SessionRecovery construction + the `recoverStuckMessages` per-topic owner skip; a
+  shared `isOwnerReachableShared` helper used by BOTH Part-D gates.
+- `src/monitoring/SessionRecovery.ts` — the Part-D recovery gate: new injected deps
+  on `SessionRecoveryDeps` + the `decideOwnershipForRecovery` decision method +
+  the forward/withhold/proceed handling at the top of `checkAndRecover`.
+- `src/messaging/stuckMessageRecovery.ts` — the third Part-D site: an optional
+  `ownerElsewhereReachable` dep that SKIPS (leaves untouched) a topic owned by a
+  reachable peer.
+- `src/core/types.ts` — the optional `multiMachine.ownershipFollowsLiveWork?: boolean`.
+- `src/core/devGatedFeatures.ts` — the `DEV_GATED_FEATURES` registration.
+
+## Anchor corrections (code-grounding discipline)
+
+The spec's anchors were close but the code won in three places:
+1. **Part A scope.** The spec said register the release handler "alongside the
+   existing `sessionComplete` handler (server.ts:13247)" assuming `ownReg`/`_meshSelfId`
+   were in scope there. They are NOT — they are declared in a nested try-block textually
+   AFTER 13247. The handler is registered INSIDE that block (a session listener may be
+   added at any init point); functionally identical, correct scope.
+2. **`getSessionForTopic` returns a session NAME, not a Session.** The spec's Part A
+   pseudocode read `liveForTopic.startedAt` off the result; the real method returns
+   `string | null`. The implementation resolves the name to the running Session via
+   `sessionManager.listRunningSessions()` and reads its `startedAt`.
+3. **Part B/D scope.** Part B's claim is exposed via a hoisted helper so the respawn
+   closure (defined before the ownership block) can reach it; Part D's deps are
+   late-bound closures that read the registry/pool assigned later — both invoked at
+   runtime, after wiring.
+
+## Decision-point inventory
+
+- **Added (Part A — authority):** a `release` CAS callsite on `sessionComplete`, gated
+  by (a) flag+self, (b) owner===self & status active, (c) the FD9 session-identity
+  guard. Fail-CLOSED on every uncertainty (withhold the release). Paired with the
+  mandatory `emitPlacement('released')` (cas-emit-placement lint).
+- **Added (Part B — authority):** a `place→claim` CAS pair on the autonomous respawn.
+  NEVER force-claims a peer-owned topic (FD3). Fail-CLOSED (withhold + one neutral
+  audit row on a post-gate owned-elsewhere race).
+- **Added (Part D — SIGNAL, not authority):** a per-topic `ownerOf` read inside
+  `checkAndRecover` + `recoverStuckMessages` that can ONLY ever WITHHOLD a local
+  re-run / forward to the owner — never a new kill or send. Direction is MIXED and
+  labeled per state: reachable-peer→forward (fail-closed), unreachable-peer incl.
+  reachability-throw→withhold (fail-closed), null/self→proceed, ownerOf-throw→proceed
+  (fail-OPEN, instrumented). No existing decision boundary is removed or weakened.
+
+No new HTTP route, no new repeating loop (Part A fires once per completion event,
+Part B once per spawn, the recovery gate is a one-shot pre-respawn check).
+
+## Roll-up across the seven review dimensions
+
+1. **Over-block**: none on the user channel. Part D can only WITHHOLD a local recovery
+   re-run / forward it to the true owner — it never blocks a user message. Parts A/B
+   withhold an ownership WRITE on uncertainty (the safe direction); a withheld release
+   at worst leaves a stale `active` the existing reconciler + PR #1258 closeout still
+   handle.
+2. **Under-block**: none. No gate is loosened. Part B never force-claims; Part A never
+   releases a record it can't prove is the completed work's; Part D's fail-OPEN branch
+   is narrowly the registry-unreadable case (an already-broken state) and is counted.
+3. **Level-of-abstraction fit**: correct. The A/B decision logic is single-sourced in a
+   pure helper module (unit-testable); the CAS + emitPlacement pairing stays at the
+   server wiring site where those deps live. Part D's decision lives in SessionRecovery
+   (its deps are injected) with the primitives bound at server init.
+4. **Signal-vs-authority compliance**: Parts A/B issue real AUTHORITY through the SAME
+   guarded `SessionOwnershipRegistry.cas()` FSM at a fenced `epoch+1` (no new FSM
+   transition, no new authority surface). Part D's `ownerOf` is a SIGNAL. Every new
+   try/catch is either an `@silent-fallback-ok` best-effort observability path or a
+   deliberate fail-closed/fail-open branch documented in code — complies with the
+   no-silent-fallbacks posture (lint green).
+5. **Interactions**: writes to the EXISTING replicated ownership lifecycle (same
+   `emitPlacement` → coherence journal → OwnershipApplier path the user-move
+   release/transfer already use), so a Part A release / Part B claim replicates exactly
+   like today's releases. The `isOwnerReachable` signal is the SAME
+   `machinePoolRegistry.getCapacity(owner).online` the router uses (shared helper — the
+   two Part-D gates can't diverge). No new shared state.
+6. **External surfaces**: NONE. No new endpoint, no egress, no third-party spend, no
+   destructive fs/git action. The only new on-disk writes are append-only neutral audit
+   rows to the EXISTING machine-local `logs/sentinel-events.jsonl` /
+   `logs/autonomous-liveness.jsonl`. Single-machine agents are a strict no-op.
+7. **Rollback cost**: low. Dev-gated dark on the fleet; a config flip force-darks even a
+   dev agent. The flag OFF / single-machine path is byte-identical to today (locked by
+   the flag-OFF regression tests across all three tiers). No migration needed (the flag
+   is omitted from ConfigDefaults — the gate decides at runtime).
+
+## Cross-machine / mixed-fleet note
+
+The flag resolves PER-MACHINE, which is CORRECT here (unlike a transfer/placement
+feature where half-activation strands a seat): each of A/B/D makes a strictly-MORE-correct
+LOCAL decision (release a record we own, claim a record for a session we run, forward
+instead of double-dispatch). A gate-ON machine self-corrects its own records; a gate-OFF
+peer keeps today's (stale-prone) behavior — no torn/corrupt cross-machine state (each CAS
+is fenced; a gate-OFF machine simply omits some releases/claims, which the existing
+reconciler/applier already tolerate). During the mixed-fleet soak, PR #1258's
+liveness-snapshot gate REMAINS the defense against a peer whose applier is lagged — which
+is why its retirement is a SEPARATE, evidence-gated follow-up after the A/B soak, not
+bundled here. This change does NOT touch `SessionReaper.ts` (PR #1258 owns it) or the FSM
+transitions.
+
+## Evidence pointers
+
+- `npx tsc --noEmit` — clean.
+- `npm run lint` — green (incl. `lint-cas-emit-placement`: 12 CAS sites all paired;
+  `lint-dev-agent-dark-gate`; `lint-no-direct-destructive`; `lint-no-unbounded-llm-spawn`).
+- New tests (66, all green): unit (26 + 10 + 3-added), integration (6), e2e (7).
+- Legacy regression green: SessionOwnership, SessionOwnershipRegistry, SessionRecovery,
+  the three session-reaper suites (PR #1258 area), OwnershipReconciler, OwnershipApplier,
+  devGatedFeatures-wiring (validates the new dev-gated entry — 117 tests).

package/upgrades/side-effects/post-transfer-closeout-correctness.md

@@ -0,0 +1,43 @@
+# Side-Effects Review — Post-Transfer Closeout Correctness (liveness-gate the stale-ownership kill)
+
+**Slug:** `post-transfer-closeout-correctness`
+**Spec:** `docs/specs/post-transfer-closeout-correctness.md` (converged 4 rounds, approved)
+**Author:** Echo (autonomous 24h mesh-robustness mission, topic 27515)
+**Branch:** `echo/ownership-follows-live-work`
+**Risk class:** safety-critical (the changed decision can terminate a LIVE local session) — mitigated by fail-closed-everywhere + a default-OFF dev-gated flag.
+
+## What changed (in-scope files)
+
+- `src/monitoring/closeoutLivenessSnapshot.ts` (NEW) — `CloseoutLivenessSnapshot`: the machine-local, periodically-refreshed snapshot of "which topics have a live session on each peer", built FROM the existing per-peer `GET /sessions` fan-out (no new endpoint). Exposes the synchronous `remoteOwnerHasLiveSession(topicId, machineId) → { state: true|false|'unknown'; reachableAt? }` dep and a bounded, owner-scoped `refresh()` (5s per-fetch timeout, per-pass eviction of departed peers, observability breaker that SURFACES — never STOPS — a persistent all-peers-failed condition). Fail-closed: missing/stale/unreachable → `'unknown'`; a fresh reached peer with an EMPTY topics set is a definitive `false` (the stale-owner signal).
+- `src/monitoring/SessionReaper.ts` (+~220) — Part C decision (`runCloseoutGated`): consults `remoteOwnerHasLiveSession` inside the `else if (otherOwner)` arm, AFTER the pin-conflict hold; `true` → dwell→terminate; `false`/`'unknown'`/dep-absent → WITHHOLD + neutral once-per-episode `possibleStaleOwner` audit. Dwell advances only across DISTINCT snapshot generations (`reachableAt` advancement). Part E: passes `bypassRecentUserMessageForConfirmedMove` ONLY on a confirmed move whose freshest LOCAL user message predates the snapshot (freshest-interaction veto). Secondary: breaker maps (`topicMovedStreak`/`topicMovedVetoes`) re-keyed on the stable TOPIC id with a GC grace window. The legacy path (`runCloseoutLegacy`) is the byte-identical OFF behavior. New config field `closeoutLivenessGate` (default false in the in-code `DEFAULT_SESSION_REAPER_CONFIG`).
+- `src/core/SessionManager.ts` (+~15) — new narrow `terminateSession` option `bypassRecentUserMessageForConfirmedMove`, mirroring `bypassActiveProcessKeep`: extends the `bypassThis` computation to lift ONLY the `recent-user-message` keep-reason; every other KEEP-guard re-checked and still vetoes.
+- `src/core/gapBCommitmentEvidence.ts` (+~20) — `recentUserMessageAtFromHistory(history) → number | null`: the LOCAL-receipt timestamp of the newest user message, SAME source the `recent-user-message` KEEP-guard reads (shared basis for the Part E veto).
+- `src/core/types.ts` (+~12) — `monitoring.sessionReaper.closeoutLivenessGate?: boolean` (OMITTED-from-default dev-gated flag).
+- `src/core/devGatedFeatures.ts` (+1 entry) — registers `monitoring.sessionReaper.closeoutLivenessGate` in `DEV_GATED_FEATURES` (live-on-dev / dark-fleet via `resolveDevAgentGate`).
+- `src/commands/server.ts` (+~90) — wiring: resolves `closeoutLivenessGate` via `resolveDevAgentGate`; constructs the `CloseoutLivenessSnapshot` + its jittered (±10%) reaper-cadence refresh timer ONLY when the gate resolves on; injects `topicOwnerElsewhereInfo` (atomic machineId+display), `remoteOwnerHasLiveSession`, `recentUserMessageAt`; forwards the new bypass through the `terminate` dep; sets `closeoutLivenessGate` on the reaper config.
+
+## Review
+
+1. **Over-block (a wrong WITHHOLD).** The withhold is the SAFE direction — it only ever KEEPS a live local session the closeout would otherwise have attempted to kill. A genuine duplicate leftover that gets withheld under `'unknown'`/partition is NOT stranded: it still falls through to the normal idle pipeline every tick (the closeout block precedes it), so a sustained partition delays closeout-driven cleanup but never leaks zombies. Worst case is a bounded cleanup delay, never a wrong kill.
+
+2. **Under-block (a wrong kill — the bug class this fixes).** With the gate ON, the ONLY path that reaches the closeout terminate is an explicit `true` from `remoteOwnerHasLiveSession` (owner genuinely has a live session = a real duplicate). Every uncertainty — `false`, `'unknown'`, dep throws, dep absent under the gate, stale/absent snapshot, unreachable peer, null topic binding — fails CLOSED to WITHHOLD. The one residual `true`-side race (remote completes between the snapshot and the terminate) is strictly milder than the original bug (a transient no-worker gap on a topic that DID move, self-healing on the next inbound message) and is bounded by the staleness bound + the dwell-advancement requirement; it is named/accepted in the spec's "Fail-closed everywhere".
+
+3. **Signal vs authority compliance.** COMPLIANT. The change alters only the DECISION to ATTEMPT the closeout terminate; the terminate still routes through the guarded `terminateSession` authority (protected-set, lease-holder, KEEP-guards intact). `remoteOwnerHasLiveSession` is a SIGNAL that informs the decision, never an authority that kills. The Part E bypass is a NARROW, named keep-reason bypass of EXACTLY ONE reason (`recent-user-message`), in the EXACT shape of the existing `bypassActiveProcessKeep` precedent, used ONLY on a liveness-confirmed move — every other KEEP-guard is re-checked and still vetoes.
+
+4. **Level-of-abstraction fit.** Correct layer. Remote liveness is per-peer `/sessions` data; the snapshot reads it (reusing the proven fan-out primitive), the reaper consults it synchronously, the terminate authority is untouched. No new reachability/ownership authority is invented — the closeout simply gains a verification step before acting on the ownership record that already drove it.
+
+5. **Interactions.** The pin-conflict hold (WS1.3) still WINS ahead of the liveness gate (unchanged). The P19 veto-breaker is preserved; re-keying it on the topic id makes it count correctly across a same-topic respawn (the secondary fix — was ~32 min, now ~10). A WITHHELD episode never accrues breaker vetoes (it never attempted a terminate). Episode-hygiene clears (terminate-success / topic-home / pin-conflict) are preserved under the topic key, so a new episode for the same topic starts clean. The refresher's owner-scoped fan-out (only machineIds that back an owned-elsewhere local leftover) bounds per-tick HTTP to O(distinct remote owners with a leftover here), not O(pool size), and does zero HTTP when there are no leftovers.
+
+6. **External surfaces.** No new route, no new unauthenticated input. The snapshot reuses the existing authenticated `GET /sessions` fetch (Bearer-auth, 5s timeout). The observability breaker raises ONE deduped attention item (P17-coalesced, `sourceContext: 'session-reaper:closeout-snapshot-breaker'`) only after a threshold of consecutive all-peers-failed passes. Audit rows land in this machine's existing `logs/sentinel-events.jsonl`. Nothing new is visible to other users/agents.
+
+7. **Multi-machine posture (Cross-Machine Coherence).** The new `liveRemoteTopics` snapshot is **MACHINE-LOCAL BY DESIGN** — each machine runs its OWN closeout against its OWN locally-built snapshot (the closeout decision is inherently local: "should *I* shed *my* leftover?"). It is NOT replicated and NOT proxied; rebuilt from scratch each refresh (no migration/backup). The `closeoutLivenessGate` flag's per-machine dev-gate resolution is CORRECT here (unlike a transfer/placement feature): the closeout is a per-machine janitor, and each machine making its OWN strictly-more-conservative decision is independently safe — the gate changes only a LOCAL decision, never a replicated record, so a mixed (some-on/some-off) fleet produces only diagnostic asymmetry, never state corruption. A gate-OFF machine retains today's behavior until promoted (the dark stage of the maturation ladder; fleet-promotion criteria are in the spec's `## Verification`).
+
+8. **Rollback cost.** Cheap and immediate. Flip `monitoring.sessionReaper.closeoutLivenessGate: false` in `.instar/config.json` (an explicit false force-darks even a dev agent; restart sessions/server to apply) → the snapshot refresher is never constructed, the new deps are left absent, the maps stay session-id-keyed, and the closeout's observable behavior is exactly canonical `main`. No data migration: the only new persisted artifacts are audit rows in `sentinel-events.jsonl` (additive). The in-memory snapshot evaporates on the next boot.
+
+## Migration parity
+
+`closeoutLivenessGate` is a DEV-GATED flag: it is OMITTED from `src/config/ConfigDefaults.ts` (NOT hardcoded `false`) so `resolveDevAgentGate` resolves it LIVE on a dev agent / DARK on the fleet, exactly like `topicProfiles` / `credentialRepointing` / the multi-machine seamlessness flags. Because it is omitted, `applyDefaults` never writes it to a deployed agent's config and the runtime gate handles it — so existing agents pick up the (dev-gated-off-on-fleet) behavior on update with no config write needed. An explicit config value always wins (false force-darks, true is the fleet-flip). The in-code constructor default (`DEFAULT_SESSION_REAPER_CONFIG.closeoutLivenessGate = false`) is the safe fallback when the field is absent.
+
+## No-deferrals
+
+This spec's scope is exactly "stop the dangerous kill" — Parts A (ownership release-on-complete), B (claim-on-spawn), and D (double-dispatch recovery gate) of the broader audit are an EXPLICIT separate follow-up PR, never in this scope. They are tracked via a durable one-time-action commitment opened on merge (the constitution's "Close the Loop" mechanism), which also carries the gate's retirement plan (when A/B land and make the ownership record self-correcting, the snapshot/refresher/dep retire; the Part E bypass + the topic-keyed breaker counters REMAIN — they fix orthogonal problems A/B don't address). No orphan deferral language; the false-case audit is deliberately observational-only (NO ownership-CAS write — that is Part A/B's job).