instar 1.3.652 → 1.3.654

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA89ftE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAq1gBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -23,6 +23,7 @@ import { handleProcessLevelError } from '../core/uncaughtExceptionPolicy.js';
 import { configureHostSpawnSemaphore } from '../core/hostSpawnSemaphore.js';
 import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstanceLock.js';
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
+import { shouldReleaseOnComplete, planClaimOnSpawn, ownershipNonce } from '../core/ownershipFollowsLiveWork.js';
 import { PrHandLease } from '../core/PrHandLease.js';
 import { parseProfileTrigger, platformMessageIdFrom } from '../core/topicProfileIngress.js';
 import { slugifyChannelName } from '../messaging/slack/sanitize.js';
@@ -48,6 +49,7 @@ import { BootHealthBeacon } from '../server/BootHealthBeacon.js';
 import { TelegramAdapter, TOPIC_STYLE, selectTopicEmoji } from '../messaging/TelegramAdapter.js';
 import { getTelegramInboundDir } from '../messaging/shared/telegramInboundFiles.js';
 import { RelationshipManager } from '../core/RelationshipManager.js';
+import { getFeatureMetricsRecorder } from '../core/CircuitBreakingIntelligenceProvider.js';
 import { configureLlmCircuitBreaker, llmCircuitAvailable } from '../core/LlmCircuitBreaker.js';
 import { computeSelfQuotaState } from '../core/selfQuotaState.js';
 import { isClaudeForbidden } from '../core/claudeForbiddenGuard.js';
@@ -92,7 +94,7 @@ import { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
 import { isRemotelyHandled } from '../core/SessionRouter.js';
 import { isSlackSessionKey, reconstructSlackMessage } from '../core/SlackForwardBridge.js';
 import { formatForwardedTopicContext } from '../core/ForwardedTopicContext.js';
-import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl, detectTailscaleIp, pickPrimaryLanIp, computeSelfMeshEndpoints, advertiseSelfMeshEndpoints } from '../core/MeshUrlAdvertiser.js';
+import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl, detectTailscaleIp, pickPrimaryLanIp, computeSelfMeshEndpoints, advertiseSelfMeshEndpoints, resolveMeshBindHost } from '../core/MeshUrlAdvertiser.js';
 import { PeerEndpointResolver } from '../core/PeerEndpointResolver.js';
 import { relayOutbound } from '../core/TelegramRelay.js';
 import { GitSyncManager } from '../core/GitSync.js';
@@ -110,7 +112,7 @@ import { LocalLeaseStore } from '../core/LocalLeaseStore.js';
 import { LeaseCoordinator } from '../core/LeaseCoordinator.js';
 import { isPeerPresumedDead } from '../core/leaseLiveness.js';
 import { readPollActive, pidAlive as pollPidAlive } from '../core/pollIntent.js';
-import { checkMultiMachineConfigCoherence } from '../core/configCoherence.js';
+import { checkMultiMachineConfigCoherence, checkMeshLiveStateCoherence, MESH_WARMUP_GRACE_MS } from '../core/configCoherence.js';
 import { HttpLeaseTransport } from '../core/HttpLeaseTransport.js';
 import { PeerEndpointRecorder } from '../core/PeerEndpointRecorder.js';
 import { HttpLiveTailTransport } from '../core/HttpLiveTailTransport.js';
@@ -3880,6 +3882,33 @@ export async function startServer(options) {
         // construction (far below) can wire the /api/lease[/pull] receivers to real registry fns.
         let peerEndpointRecorder;
         let getSelfMeshEndpoints;
+        // mesh-coherence-live-state-honesty (Fix (b) / Decision #5): the resolved server bind host,
+        // a BOOT CONSTANT. Declared `let` at OUTER scope (the same scope as getSelfMeshEndpoints)
+        // and assigned inside the mesh-init block so the peerPresenceTimer closure (far below) can
+        // reach it — a const inside the block would be UNREACHABLE from the timer.
+        let meshResolvedBindHost;
+        // mesh-coherence-live-state-honesty (Fix (b) / Decision #6): transition-only emit state +
+        // capped-backoff failure state for the periodic live-coherence check, at outer scope so the
+        // peerPresenceTimer closure persists them across ticks.
+        //   _meshCoherenceLastCodes: the SET of codes emitted on the previous tick — a code logs
+        //     ONLY on absent→present; a LEVEL-TRIGGERED reset clears a code when its divergence
+        //     resolves, so a later recurrence logs fresh (one line per divergence episode).
+        //   _meshCoherenceEmitCounts: per-code re-emit tally enforcing the optional emitCap ceiling.
+        //   _meshCoherenceConsecFailures/_meshCoherenceTicksSinceAttempt: capped consecutive-failure
+        //     backoff so a sustained-corrupt registry does not re-throw-and-swallow every 30s.
+        //   _meshCoherenceFailing: a healthy→failing LATCH so the 'error' metric is TRANSITION-GATED
+        //     (one row when the read STARTS failing, not one per attempt).
+        let _meshCoherenceLastCodes = new Set();
+        const _meshCoherenceEmitCounts = new Map();
+        let _meshCoherenceConsecFailures = 0;
+        let _meshCoherenceTicksSinceAttempt = 0;
+        let _meshCoherenceFailing = false;
+        // Half-open breaker (all three brakes): BACKOFF (a read failure trips it to ≤1 attempt per
+        // MAX_BACKOFF_TICKS×30s ≈ 10min), BREAKER (the failing-latch + backoff; a successful read
+        // CLOSES it), CAP (MAX_BACKOFF_TICKS floors the re-probe rate; the 'error' metric is
+        // transition-gated). Deliberately HALF-OPEN (re-probing), NOT hard-STOP: a signal-only
+        // honesty observer that STOPS attempting goes BLIND if the registry recovers.
+        const MAX_BACKOFF_TICKS = 20;
         let leaseCoordinatorRef;
         let liveTailBuffer;
         let liveTailSendTransport;
@@ -4039,6 +4068,20 @@ export async function startServer(options) {
                 // and the LIVE meshTransport gate. Shared by the receiver routes (sender/puller
                 // direction) and the transport's pull-RESPONSE path (holder direction).
                 getSelfMeshEndpoints = () => idMgr.getMachineEndpoints(selfMachineId);
+                // mesh-coherence-live-state-honesty (Fix (b) / Decision #5): assign the resolved bind
+                // host from the SAME meshBindActive expression the AgentServer bind callsite uses
+                // (server.ts construction → AgentServer.ts:3469). boundHost is a BOOT CONSTANT (the bind
+                // cannot change without a restart — which is exactly the b.1 divergence), so a single
+                // boot-scope assignment is the live truth.
+                {
+                    const meshBindActiveForCoherence = coordinator.managers.identityManager.hasIdentity() &&
+                        config.multiMachine?.meshTransport?.enabled !== false;
+                    meshResolvedBindHost = resolveMeshBindHost({
+                        configHost: config.host,
+                        meshBindActive: meshBindActiveForCoherence,
+                        meshBindHostOverride: config.multiMachine?.meshTransport?.bindHost,
+                    });
+                }
                 peerEndpointRecorder = new PeerEndpointRecorder({
                     getPeerEndpoints: (id) => idMgr.getMachineEndpoints(id),
                     updateMachineEndpoints: (id, eps) => idMgr.updateMachineEndpoints(id, eps),
@@ -7333,6 +7376,13 @@ export async function startServer(options) {
                                 }
                             }
                             catch { /* @silent-fallback-ok: best-effort midWork tag; a failure must never undo the successful respawn (the run is alive, which is the goal). */ }
+                            // Ownership Follows Live Work — Part B (claim-on-spawn, FD2): this
+                            // autonomous respawn bypasses route() (which is what normally claims),
+                            // so ownership would stay on whatever machine last held it. Issue the
+                            // fenced-epoch place→claim onto THIS machine. The helper is a strict
+                            // no-op when the flag is OFF / single-machine, and best-effort (a lost
+                            // CAS / owned-by-peer race withholds — never undoes the live spawn).
+                            _claimOwnershipForAutonomousSpawn?.(topicId);
                         },
                         claimInflight: (topicId) => {
                             if (livenessInflight.has(topicId))
@@ -8468,6 +8518,67 @@ export async function startServer(options) {
                     }
                     return { cleared: false, reason: 'timeout' };
                 },
+                // ── Part D: double-dispatch recovery gate (ownership-follows-live-work) ──
+                // Injected primitives so checkAndRecover consults per-topic ownership
+                // before re-running locally. All read the late-bound registry/pool deps
+                // (sessionOwnershipRegistry @ ~15976, _meshSelfId, machinePoolRegistry @
+                // ~15703) — these closures fire at runtime, after those are assigned.
+                // Strict no-op when the flag resolves OFF / single-machine.
+                ownershipFollowsLiveWork: () => resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config),
+                ownerOfTopic: (topicId) => {
+                    // ownReg.ownerOf — MAY THROW (the gate's fail-OPEN registry-unknown
+                    // branch). NO catch here: a throw must propagate so the gate takes its
+                    // labeled fail-open path (catching here would mask it).
+                    const reg = sessionOwnershipRegistry;
+                    if (!reg)
+                        return null; // pool dark / single-machine → no peer can own it
+                    return reg.ownerOf(String(topicId));
+                },
+                selfMachineId: () => _meshSelfId,
+                // Owner-reachability — the SAME shared helper the third Part-D site
+                // (recoverStuckMessages) uses, so the two gates can never diverge. MAY
+                // THROW: the gate treats a throw as the unreachable-peer branch (the
+                // record names a peer). NO catch here (propagate to the gate's handler).
+                isOwnerReachable: (owner) => isOwnerReachableShared(owner),
+                forwardPendingInboundViaRoute: async (topicId) => {
+                    // Forward the topic's ALREADY-DURABLE pending inbound through the
+                    // existing durable-inbound-queue drain (which routes via route() +
+                    // applies isRemotelyHandled at dispatch). When the durable queue is not
+                    // wired (the common case today), there is no durable pending inbound to
+                    // forward → nonePending:true (the gate withholds the local respawn; the
+                    // leftover idle session is converged by the existing reaper/reconciler).
+                    const q = _inboundQueue;
+                    if (!q)
+                        return { forwarded: 0, nonePending: true };
+                    const sk = String(topicId);
+                    let hasPending = false;
+                    try {
+                        hasPending = q.hasQueued(sk);
+                    }
+                    catch {
+                        hasPending = false;
+                    }
+                    if (!hasPending)
+                        return { forwarded: 0, nonePending: true };
+                    try {
+                        const summary = await q.onOwnershipTransition(sk);
+                        return { forwarded: summary?.dispatched ?? 0, nonePending: false };
+                    }
+                    catch {
+                        // @silent-fallback-ok — the drain is best-effort; route()'s own ledger
+                        // owns delivery + exactly-once. There WAS pending, so nonePending:false.
+                        return { forwarded: 0, nonePending: false };
+                    }
+                },
+                emitRecoveryGateTelemetry: (row) => {
+                    // ONE neutral observational row to the machine-local sentinel audit so
+                    // the fail-OPEN tradeoff is MEASURED (the fleet-promotion gate reads it).
+                    try {
+                        const auditPath = path.join(config.stateDir, 'logs', 'sentinel-events.jsonl');
+                        fs.appendFileSync(auditPath, JSON.stringify({ ts: new Date().toISOString(), ...row }) + '\n');
+                    }
+                    catch { /* @silent-fallback-ok — telemetry is observability; never affects the recovery decision */ }
+                },
             });
             // Track context exhaustion kills to prevent beforeSessionKill from re-saving
             // resume UUIDs (which would cause an infinite death loop)
@@ -14830,6 +14941,21 @@ export async function startServer(options) {
         // Self-attests hardware + records a self-heartbeat so GET /pool + the Machines tab show
         // this machine online with its specs; peer liveness is fed from MachineHeartbeat.
         let machinePoolRegistry;
+        // Ownership Follows Live Work — Part D shared owner-reachability helper (FD/
+        // decision-completeness #4 unification). "reachable peer" = the SAME signal the
+        // router uses (`machinePoolRegistry.getCapacity(owner)?.online === true`, the
+        // isMachineAlive seam). Used by BOTH Part-D gates — the SessionRecovery deps
+        // (checkAndRecover) and the recoverStuckMessages site — so the two can NEVER
+        // make divergent reachability calls. A function declaration (hoisted) so both
+        // callsites — one textually before this line — resolve it; it reads
+        // machinePoolRegistry by closure at call time. THROWS-by-propagation are the
+        // caller's unreachable-peer branch; here we only return the boolean (an absent
+        // registry / unknown machine → false = treat as unreachable, the safe side).
+        function isOwnerReachableShared(owner) {
+            const cap = machinePoolRegistry?.getCapacity(owner);
+            return cap?.online === true;
+        }
+        void isOwnerReachableShared; // referenced from the late deps closures (hoisted)
         try {
             const poolMod = await import('../core/MachinePoolRegistry.js');
             const osMod = await import('node:os');
@@ -15112,6 +15238,18 @@ export async function startServer(options) {
         // git-backed store swaps in for the Track-H proof (the registry is store-agnostic).
         let meshRpcDispatcher;
         let sessionOwnershipRegistry;
+        /**
+         * Ownership Follows Live Work — Part B (claim-on-spawn). Assigned inside the
+         * durable-ownership wiring block (where `ownReg`/`emitPlacement`/`_meshSelfId`
+         * are in lexical scope) and CALLED from the AutonomousLivenessReconciler
+         * `respawn` closure (defined ~7900, invoked at runtime AFTER this is wired).
+         * Null until wired and a strict no-op when the flag resolves OFF or
+         * `_meshSelfId` is null (single-machine). The closure issues a fenced-epoch
+         * `place → claim` so ownership follows the live autonomous session onto THIS
+         * machine; it NEVER force-claims a peer-owned topic (FD3) and a lost CAS is a
+         * no-op (the spawn still runs; the reconciler/applier converge — FD11).
+         */
+        let _claimOwnershipForAutonomousSpawn = null;
         try {
             const meshMod = await import('../core/MeshRpc.js');
             const idMod = await import('../core/MachineIdentity.js');
@@ -15491,6 +15629,167 @@ export async function startServer(options) {
                     }
                     catch { /* observability never endangers the observed */ }
                 };
+                // ── Ownership Follows Live Work (docs/specs/ownership-follows-live-work.md) ──
+                // Parts A + B wire HERE, inside the durable-ownership block, because this is
+                // the only scope where `ownReg`, `emitPlacement`, and `_meshSelfId` are all in
+                // lexical view. The spec's anchor (server.ts:13247, "alongside the existing
+                // sessionComplete handler") assumed `ownReg`/`_meshSelfId` were in scope there
+                // — they are NOT (they are declared in this nested try-block, textually after).
+                // Registering Part A's `sessionComplete` listener here (a session listener may
+                // be added at any point during init) keeps the release logic where its deps
+                // live; Part B is exposed via the hoisted `_claimOwnershipForAutonomousSpawn`
+                // so the reconciler `respawn` closure (defined ~7900, before this block) can
+                // reach it. (Anchor correction recorded in the implementation summary.)
+                {
+                    const ownershipFollowsLiveWork = resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config);
+                    // ── Part A: release-on-complete ──────────────────────────────────────
+                    // On the SessionManager 'sessionComplete' event, if THIS machine is the
+                    // topic's `active` owner AND no DIFFERENT live session is bound to the
+                    // topic, issue a `release` CAS so the record advances to `released` instead
+                    // of being stuck `active` (the stale label PR #1258's closeout defends
+                    // against). Fail-closed/withhold on EVERY uncertainty. The flag gate is
+                    // re-read here so a session listener registered once at boot is inert when
+                    // the feature resolves OFF (byte-identical legacy behavior).
+                    sessionManager.on('sessionComplete', (session) => {
+                        try {
+                            if (!ownershipFollowsLiveWork || !_meshSelfId)
+                                return; // single-machine / dark = strict no-op
+                            const tmux = session.tmuxSession || session.name;
+                            if (!tmux)
+                                return;
+                            // Resolve the topicId from the completing session's tmux name. A throw
+                            // or empty result → SKIP (fail-closed toward NOT releasing): a topicId
+                            // we cannot resolve is a record we cannot prove is ours (adversarial X2).
+                            let topicId = null;
+                            try {
+                                const t = telegram?.getTopicForSession(tmux);
+                                if (t != null) {
+                                    const n = typeof t === 'number' ? t : Number(t);
+                                    topicId = Number.isFinite(n) ? n : null;
+                                }
+                            }
+                            catch {
+                                topicId = null; /* @silent-fallback-ok — unresolvable topic → unbound → skip (no release), the deliberate fail-closed direction (adversarial X2) */
+                            }
+                            if (topicId == null)
+                                return; // no topic binding → not topic-owned → skip
+                            const sk = String(topicId);
+                            // Resolve the CURRENT live session's stable instance key for the
+                            // session-identity guard (FD9). `telegram.getSessionForTopic` returns
+                            // the live session NAME (an anchor correction vs the spec's pseudocode,
+                            // which assumed it returned a Session); resolve that name to the
+                            // running Session and read its `startedAt` (the stable per-instance
+                            // key — tmux NAMES are reused across respawn). `undefined` means
+                            // "couldn't enumerate / no live session" → handled fail-closed below.
+                            let liveStartedAt = null; // null = no live session bound
+                            try {
+                                const liveName = telegram?.getSessionForTopic?.(topicId) ?? null;
+                                if (liveName) {
+                                    const liveSess = sessionManager
+                                        .listRunningSessions()
+                                        .find((s) => s.tmuxSession === liveName || s.name === liveName);
+                                    // A bound name with no running Session (already gone) → no DIFFERENT
+                                    // live session (null). A running Session → its startedAt (may be
+                                    // missing on a legacy record → unprovable → withhold via the helper).
+                                    liveStartedAt = liveSess ? (liveSess.startedAt ?? '') : null;
+                                }
+                            }
+                            catch {
+                                // @silent-fallback-ok — cannot enumerate live sessions for the
+                                // identity guard → FAIL-CLOSED. Pass an empty-string key so the
+                                // helper's unprovable-identity branch withholds the release.
+                                liveStartedAt = '';
+                            }
+                            // (a) owner === self AND (b) status === active AND (c) the session-
+                            // identity guard — all resolved by the single-sourced pure helper.
+                            const rec = (() => { try {
+                                return ownReg.read(sk);
+                            }
+                            catch {
+                                return undefined; /* @silent-fallback-ok — registry unreadable → caller withholds the release (fail-closed); a read error must never break the completion path */
+                            } })();
+                            if (rec === undefined)
+                                return; // registry unreadable → withhold (fail-closed)
+                            if (!shouldReleaseOnComplete({
+                                enabled: ownershipFollowsLiveWork,
+                                selfMachineId: _meshSelfId,
+                                record: rec,
+                                completingStartedAt: session.startedAt,
+                                liveStartedAt,
+                            }))
+                                return;
+                            const prevOwner = rec.ownerMachineId;
+                            const r = ownReg.cas({ type: 'release', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'rel-complete', sk) });
+                            // MANDATORY pairing — scripts/lint-cas-emit-placement.js fails CI on an
+                            // unpaired cas(). Records 'released' into the coherence journal so the
+                            // release replicates exactly like the user-move release does. A lost CAS
+                            // (peer advanced the epoch first) is a no-op here — we never retry/force.
+                            emitPlacement(sk, r, 'released', prevOwner);
+                        }
+                        catch {
+                            // @silent-fallback-ok — release-on-complete is best-effort housekeeping
+                            // (FD1); a throw must never break the completion path. The existing
+                            // reconciler/applier + PR #1258 closeout still handle a missed release.
+                        }
+                    });
+                    // ── Part B: claim-on-spawn (assign the hoisted helper) ───────────────
+                    // After an autonomous respawn (the path that genuinely bypasses route()),
+                    // issue a fenced-epoch `place → claim` so ownership follows the live session
+                    // onto THIS machine. Owned-by-peer is NOT force-claimed (FD3): the
+                    // reconciler already gates respawn on topicOwnerElsewhere, so the
+                    // owned-by-peer case should not reach here; if a post-gate race does, the
+                    // claim is withheld and ONE neutral audit row records the divergence.
+                    _claimOwnershipForAutonomousSpawn = (topicId) => {
+                        try {
+                            if (!ownershipFollowsLiveWork || !_meshSelfId)
+                                return; // single-machine / dark = no-op
+                            const sk = String(topicId);
+                            let cur;
+                            try {
+                                cur = ownReg.read(sk);
+                            }
+                            catch {
+                                return; /* registry unreadable → withhold (fail-closed) */
+                            }
+                            const plan = planClaimOnSpawn({ enabled: ownershipFollowsLiveWork, selfMachineId: _meshSelfId, record: cur });
+                            if (plan.action === 'noop')
+                                return; // already ours / dark → nothing to do
+                            if (plan.action === 'place-then-claim') {
+                                // never-seen / released → place then claim onto self.
+                                const prev0 = cur?.ownerMachineId;
+                                const rp = ownReg.cas({ type: 'place', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'auto-place', sk) });
+                                emitPlacement(sk, rp, 'placed', prev0);
+                                if (rp.ok) {
+                                    const rc = ownReg.cas({ type: 'claim', machineId: _meshSelfId }, { sessionKey: sk, sender: _meshSelfId, nonce: ownershipNonce(_meshSelfId, 'auto-claim', sk) });
+                                    emitPlacement(sk, rc, 'placed', _meshSelfId);
+                                }
+                                // place lost (a peer advanced first) → claim NOT attempted; the
+                                // session still runs locally and the reconciler/applier converge (FD11).
+                                return;
+                            }
+                            // plan.action === 'audit-owned-elsewhere': owned by a PEER → do NOT
+                            // force-claim (FD3, fail-closed). This should not occur on the
+                            // reconciler path (its topicOwnerElsewhere gate already filters it); a
+                            // post-gate race lands ONE neutral, non-directional audit row to the
+                            // machine-local liveness log.
+                            try {
+                                const auditPath = path.join(config.stateDir, 'logs', 'autonomous-liveness.jsonl');
+                                fs.appendFileSync(auditPath, JSON.stringify({
+                                    ts: new Date().toISOString(),
+                                    kind: 'auto-spawn-owned-elsewhere',
+                                    topicId,
+                                    owner: plan.owner,
+                                    status: plan.status,
+                                }) + '\n');
+                            }
+                            catch { /* @silent-fallback-ok — observational audit; never break the spawn */ }
+                        }
+                        catch {
+                            // @silent-fallback-ok — claim-on-spawn is best-effort (FD1/FD11); a throw
+                            // must never undo the successful spawn (the run is alive, which is the goal).
+                        }
+                    };
+                }
                 // The §L3 ownership commands, routed from MeshRpc to the registry CAS.
                 const ownAction = (cmd, sender, env) => {
                     if (cmd.type === 'place') {
@@ -17354,7 +17653,67 @@ export async function startServer(options) {
                         },
                     });
                     void peerPresencePuller.pullOnce();
-                    const peerPresenceTimer = setInterval(() => { void peerPresencePuller.pullOnce(); }, 30_000);
+                    const peerPresenceTick = () => {
+                        void peerPresencePuller.pullOnce();
+                        // mesh-coherence-live-state-honesty (Fix (b)): the periodic, signal-only live-vs-config
+                        // mesh coherence recheck. Dev-gated dark (resolveDevAgentGate on the nested ?.enabled).
+                        if (resolveDevAgentGate(config.monitoring?.meshCoherenceLiveCheck?.enabled, config)) {
+                            // Backoff: after a failure, skip up to min(consecFailures, MAX_BACKOFF_TICKS) ticks
+                            // before retrying. A SUCCESSFUL tick resets the counters (auto-recover).
+                            const backoffTicks = Math.min(_meshCoherenceConsecFailures, MAX_BACKOFF_TICKS);
+                            if (_meshCoherenceConsecFailures > 0 && _meshCoherenceTicksSinceAttempt < backoffTicks) {
+                                _meshCoherenceTicksSinceAttempt += 1;
+                            }
+                            else {
+                                _meshCoherenceTicksSinceAttempt = 0;
+                                // Resolve the tuning knobs (both are actually READ): warmupGraceMs overrides the
+                                // b.2 grace; emitCap (if set) hard-caps re-emits per code per process.
+                                const warmupGraceMs = config.monitoring?.meshCoherenceLiveCheck?.warmupGraceMs ?? MESH_WARMUP_GRACE_MS;
+                                const emitCap = config.monitoring?.meshCoherenceLiveCheck?.emitCap; // undefined ⇒ unbounded
+                                const recorder = getFeatureMetricsRecorder();
+                                // THROW-SAFETY (Decision #11): the live registry read can throw on a corrupt /
+                                // mid-write registry. A signal-only check must NEVER crash the tick. On any read
+                                // failure emit a TRANSITION-GATED 'error' metric row, advance the backoff, and
+                                // do NOT touch the transition state (fail toward silence).
+                                try {
+                                    const live = {
+                                        boundHost: meshResolvedBindHost,
+                                        selfEndpoints: getSelfMeshEndpoints?.() ?? [],
+                                        uptimeMs: process.uptime() * 1000,
+                                    };
+                                    const warnings = checkMeshLiveStateCoherence(config.multiMachine, true, live, warmupGraceMs);
+                                    const nowCodes = new Set(warnings.map((w) => w.code));
+                                    let firedThisTick = false;
+                                    for (const w of warnings) {
+                                        if (!_meshCoherenceLastCodes.has(w.code)) { // TRANSITION-ONLY (absent→present)
+                                            const count = _meshCoherenceEmitCounts.get(w.code) ?? 0;
+                                            if (emitCap === undefined || count < emitCap) { // emitCap is READ here
+                                                console.log(pc.yellow(`  ⚠ mesh-live-coherence [${w.code}]: ${w.message}`));
+                                                _meshCoherenceEmitCounts.set(w.code, count + 1);
+                                                firedThisTick = true;
+                                            }
+                                        }
+                                    }
+                                    recorder?.record({ feature: 'mesh-coherence-live', kind: 'event', outcome: firedThisTick ? 'fired' : 'noop' });
+                                    _meshCoherenceLastCodes = nowCodes; // LEVEL-TRIGGERED reset
+                                    _meshCoherenceConsecFailures = 0; // SUCCESS resets the backoff
+                                    _meshCoherenceFailing = false; // clear the latch
+                                }
+                                catch {
+                                    // @silent-fallback-ok: signal-only honesty observer; a registry read error must
+                                    // never crash the tick. TRANSITION-GATED observability — emit ONE 'error' row on
+                                    // the healthy→failing transition (not every attempt), leave the divergence
+                                    // transition state untouched (fail toward silence), and advance the backoff.
+                                    if (!_meshCoherenceFailing) {
+                                        recorder?.record({ feature: 'mesh-coherence-live', kind: 'event', outcome: 'error' });
+                                        _meshCoherenceFailing = true;
+                                    }
+                                    _meshCoherenceConsecFailures += 1;
+                                }
+                            }
+                        }
+                    };
+                    const peerPresenceTimer = setInterval(peerPresenceTick, 30_000);
                     if (typeof peerPresenceTimer.unref === 'function')
                         peerPresenceTimer.unref();
                     const { resolveSessionPoolStage: _resolveSessionPoolStage } = await import('../core/inboundQueueConfig.js');
@@ -18024,6 +18383,32 @@ export async function startServer(options) {
                         epoch: coordinator.getLeaseEpoch(),
                         maxProcessingMs: seamlessness.maxProcessingMs,
                         reinject: reinjectStuck,
+                        // Part D, third site (ownership-follows-live-work): per-topic owner check
+                        // ON TOP of the existing machine-level holdsLease() gate. SKIP a topic
+                        // owned by a REACHABLE peer (leave its stuck messages in the ledger for
+                        // the owner to drain). Flag-gated; every uncertainty resolves to the SAFE
+                        // side (not-owned-elsewhere → re-feed as today). Uses the SAME shared
+                        // reachability helper as the checkAndRecover Part-D gate.
+                        ownerElsewhereReachable: (topic) => {
+                            try {
+                                const on = resolveDevAgentGate(config.multiMachine?.ownershipFollowsLiveWork, config);
+                                if (!on)
+                                    return false; // dark / legacy → no ownership check
+                                const reg = sessionOwnershipRegistry;
+                                const self = _meshSelfId;
+                                if (!reg || !self)
+                                    return false; // single-machine → no peer can own it
+                                const owner = reg.ownerOf(String(topic));
+                                if (!owner || owner === self)
+                                    return false; // unowned / ours → re-feed as today
+                                return isOwnerReachableShared(owner); // peer + reachable → skip (owner drains it)
+                            }
+                            catch {
+                                // @silent-fallback-ok — any uncertainty → SAFE side (re-feed as
+                                // today). Never WITHHOLD a re-feed on a registry/pool blip.
+                                return false;
+                            }
+                        },
                         logger: (m) => console.log(pc.dim(`  ${m}`)),
                     });
                     // Gap #2 (wedge-recovery-drops-messages): an entry whose re-run budget is