instar 1.3.653 → 1.3.655

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgvgBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA02gBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -49,6 +49,7 @@ import { BootHealthBeacon } from '../server/BootHealthBeacon.js';
 import { TelegramAdapter, TOPIC_STYLE, selectTopicEmoji } from '../messaging/TelegramAdapter.js';
 import { getTelegramInboundDir } from '../messaging/shared/telegramInboundFiles.js';
 import { RelationshipManager } from '../core/RelationshipManager.js';
+import { getFeatureMetricsRecorder } from '../core/CircuitBreakingIntelligenceProvider.js';
 import { configureLlmCircuitBreaker, llmCircuitAvailable } from '../core/LlmCircuitBreaker.js';
 import { computeSelfQuotaState } from '../core/selfQuotaState.js';
 import { isClaudeForbidden } from '../core/claudeForbiddenGuard.js';
@@ -93,7 +94,7 @@ import { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
 import { isRemotelyHandled } from '../core/SessionRouter.js';
 import { isSlackSessionKey, reconstructSlackMessage } from '../core/SlackForwardBridge.js';
 import { formatForwardedTopicContext } from '../core/ForwardedTopicContext.js';
-import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl, detectTailscaleIp, pickPrimaryLanIp, computeSelfMeshEndpoints, advertiseSelfMeshEndpoints } from '../core/MeshUrlAdvertiser.js';
+import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl, detectTailscaleIp, pickPrimaryLanIp, computeSelfMeshEndpoints, advertiseSelfMeshEndpoints, resolveMeshBindHost } from '../core/MeshUrlAdvertiser.js';
 import { PeerEndpointResolver } from '../core/PeerEndpointResolver.js';
 import { relayOutbound } from '../core/TelegramRelay.js';
 import { GitSyncManager } from '../core/GitSync.js';
@@ -111,7 +112,7 @@ import { LocalLeaseStore } from '../core/LocalLeaseStore.js';
 import { LeaseCoordinator } from '../core/LeaseCoordinator.js';
 import { isPeerPresumedDead } from '../core/leaseLiveness.js';
 import { readPollActive, pidAlive as pollPidAlive } from '../core/pollIntent.js';
-import { checkMultiMachineConfigCoherence } from '../core/configCoherence.js';
+import { checkMultiMachineConfigCoherence, checkMeshLiveStateCoherence, MESH_WARMUP_GRACE_MS } from '../core/configCoherence.js';
 import { HttpLeaseTransport } from '../core/HttpLeaseTransport.js';
 import { PeerEndpointRecorder } from '../core/PeerEndpointRecorder.js';
 import { HttpLiveTailTransport } from '../core/HttpLiveTailTransport.js';
@@ -3881,6 +3882,33 @@ export async function startServer(options) {
         // construction (far below) can wire the /api/lease[/pull] receivers to real registry fns.
         let peerEndpointRecorder;
         let getSelfMeshEndpoints;
+        // mesh-coherence-live-state-honesty (Fix (b) / Decision #5): the resolved server bind host,
+        // a BOOT CONSTANT. Declared `let` at OUTER scope (the same scope as getSelfMeshEndpoints)
+        // and assigned inside the mesh-init block so the peerPresenceTimer closure (far below) can
+        // reach it — a const inside the block would be UNREACHABLE from the timer.
+        let meshResolvedBindHost;
+        // mesh-coherence-live-state-honesty (Fix (b) / Decision #6): transition-only emit state +
+        // capped-backoff failure state for the periodic live-coherence check, at outer scope so the
+        // peerPresenceTimer closure persists them across ticks.
+        //   _meshCoherenceLastCodes: the SET of codes emitted on the previous tick — a code logs
+        //     ONLY on absent→present; a LEVEL-TRIGGERED reset clears a code when its divergence
+        //     resolves, so a later recurrence logs fresh (one line per divergence episode).
+        //   _meshCoherenceEmitCounts: per-code re-emit tally enforcing the optional emitCap ceiling.
+        //   _meshCoherenceConsecFailures/_meshCoherenceTicksSinceAttempt: capped consecutive-failure
+        //     backoff so a sustained-corrupt registry does not re-throw-and-swallow every 30s.
+        //   _meshCoherenceFailing: a healthy→failing LATCH so the 'error' metric is TRANSITION-GATED
+        //     (one row when the read STARTS failing, not one per attempt).
+        let _meshCoherenceLastCodes = new Set();
+        const _meshCoherenceEmitCounts = new Map();
+        let _meshCoherenceConsecFailures = 0;
+        let _meshCoherenceTicksSinceAttempt = 0;
+        let _meshCoherenceFailing = false;
+        // Half-open breaker (all three brakes): BACKOFF (a read failure trips it to ≤1 attempt per
+        // MAX_BACKOFF_TICKS×30s ≈ 10min), BREAKER (the failing-latch + backoff; a successful read
+        // CLOSES it), CAP (MAX_BACKOFF_TICKS floors the re-probe rate; the 'error' metric is
+        // transition-gated). Deliberately HALF-OPEN (re-probing), NOT hard-STOP: a signal-only
+        // honesty observer that STOPS attempting goes BLIND if the registry recovers.
+        const MAX_BACKOFF_TICKS = 20;
         let leaseCoordinatorRef;
         let liveTailBuffer;
         let liveTailSendTransport;
@@ -4040,6 +4068,20 @@ export async function startServer(options) {
                 // and the LIVE meshTransport gate. Shared by the receiver routes (sender/puller
                 // direction) and the transport's pull-RESPONSE path (holder direction).
                 getSelfMeshEndpoints = () => idMgr.getMachineEndpoints(selfMachineId);
+                // mesh-coherence-live-state-honesty (Fix (b) / Decision #5): assign the resolved bind
+                // host from the SAME meshBindActive expression the AgentServer bind callsite uses
+                // (server.ts construction → AgentServer.ts:3469). boundHost is a BOOT CONSTANT (the bind
+                // cannot change without a restart — which is exactly the b.1 divergence), so a single
+                // boot-scope assignment is the live truth.
+                {
+                    const meshBindActiveForCoherence = coordinator.managers.identityManager.hasIdentity() &&
+                        config.multiMachine?.meshTransport?.enabled !== false;
+                    meshResolvedBindHost = resolveMeshBindHost({
+                        configHost: config.host,
+                        meshBindActive: meshBindActiveForCoherence,
+                        meshBindHostOverride: config.multiMachine?.meshTransport?.bindHost,
+                    });
+                }
                 peerEndpointRecorder = new PeerEndpointRecorder({
                     getPeerEndpoints: (id) => idMgr.getMachineEndpoints(id),
                     updateMachineEndpoints: (id, eps) => idMgr.updateMachineEndpoints(id, eps),
@@ -6630,7 +6672,14 @@ export async function startServer(options) {
         }
         // Wired by the resume-queue boot block (Part B) once the queue exists;
         // stays false (no "restart queued" lines) until then or in dry-run.
+        // OWNERSHIP predicate (paused-BLIND) — read by the PromiseBeacon I2
+        // double-spawn coordination guard (must keep deferring to the queue while
+        // paused). Distinct from resumeClaimableForSession below.
         let resumeQueuedForSession = () => false;
+        // CLAIMABILITY predicate (paused-AWARE) — read by the ReapNotifier
+        // "restart is queued" copy (honest-session-state-surfaces Finding (c)): a
+        // paused queue won't revive yet, so the claim is suppressed while paused.
+        let resumeClaimableForSession = () => false;
         const reapNotifier = new ReapNotifier({
             resolveTopic: (tmuxSession) => {
                 const t = telegram?.getTopicForSession(tmuxSession);
@@ -6655,7 +6704,9 @@ export async function startServer(options) {
             recordNotify: (e) => reapLog.recordNotify(e),
             quietHoursEndAt: (now) => notificationBatcher.quietHoursEndAt(now),
             summaryReleaseAt: (now) => notificationBatcher.nextSummaryReleaseAt(now),
-            resumeQueuedFor: (tmuxSession) => resumeQueuedForSession(tmuxSession),
+            // Finding (c): the user-facing "restart is queued" copy reads the
+            // CLAIMABILITY predicate (false while paused), NOT the ownership one.
+            resumeQueuedFor: (tmuxSession) => resumeClaimableForSession(tmuxSession),
             // Honest-recycle (honest-session-recycle-spec): tell ReapNotifier whether
             // this session's topic has an ACTIVE autonomous run (and how long is left),
             // so an age-limit RECYCLE of a still-active run reads as a continuation
@@ -6919,7 +6970,10 @@ export async function startServer(options) {
             else {
                 // Feed the notifier's "restart is queued" line (live, non-dry-run only).
                 const rq = resumeQueue;
+                // OWNERSHIP (paused-blind) → I2 double-spawn guard at :11980.
                 resumeQueuedForSession = (tmuxSession) => rq.hasLiveQueuedEntryFor(tmuxSession);
+                // CLAIMABILITY (paused-aware) → ReapNotifier "restart is queued" copy.
+                resumeClaimableForSession = (tmuxSession) => rq.hasClaimableQueuedEntryFor(tmuxSession);
                 const resolveTopicForTmux = (tmuxSession) => {
                     try {
                         const t = telegram?.getTopicForSession(tmuxSession);
@@ -10719,6 +10773,12 @@ export async function startServer(options) {
                     // honest classifier must stay silent so the user hears one voice.
                     // Reuses the same composed checker the SessionReaper uses for its veto.
                     isStuckRecoveryActive: (sessionName) => wedgeRecoveryActive?.(sessionName) ?? false,
+                    // honest-session-state-surfaces Finding (b): lift the Tier-3 honest
+                    // stuck classification into Tier 1 / Tier 2. Dev-gated dark — live on
+                    // a development agent, dark on the fleet (the flag is OMITTED from
+                    // ConfigDefaults so it resolves through the dev-agent gate). Signal
+                    // only — changes the standby MESSAGE TEXT, never the schedule/recovery.
+                    standbyHonestyTiers: resolveDevAgentGate(config.monitoring?.standbyHonestyTiers?.enabled, config),
                     // Shared LLM queue (interactive lane) — cross-monitor concurrency
                     // and daily-spend-cap with PromiseBeacon.
                     sharedLlmQueue,
@@ -17611,7 +17671,67 @@ export async function startServer(options) {
                         },
                     });
                     void peerPresencePuller.pullOnce();
-                    const peerPresenceTimer = setInterval(() => { void peerPresencePuller.pullOnce(); }, 30_000);
+                    const peerPresenceTick = () => {
+                        void peerPresencePuller.pullOnce();
+                        // mesh-coherence-live-state-honesty (Fix (b)): the periodic, signal-only live-vs-config
+                        // mesh coherence recheck. Dev-gated dark (resolveDevAgentGate on the nested ?.enabled).
+                        if (resolveDevAgentGate(config.monitoring?.meshCoherenceLiveCheck?.enabled, config)) {
+                            // Backoff: after a failure, skip up to min(consecFailures, MAX_BACKOFF_TICKS) ticks
+                            // before retrying. A SUCCESSFUL tick resets the counters (auto-recover).
+                            const backoffTicks = Math.min(_meshCoherenceConsecFailures, MAX_BACKOFF_TICKS);
+                            if (_meshCoherenceConsecFailures > 0 && _meshCoherenceTicksSinceAttempt < backoffTicks) {
+                                _meshCoherenceTicksSinceAttempt += 1;
+                            }
+                            else {
+                                _meshCoherenceTicksSinceAttempt = 0;
+                                // Resolve the tuning knobs (both are actually READ): warmupGraceMs overrides the
+                                // b.2 grace; emitCap (if set) hard-caps re-emits per code per process.
+                                const warmupGraceMs = config.monitoring?.meshCoherenceLiveCheck?.warmupGraceMs ?? MESH_WARMUP_GRACE_MS;
+                                const emitCap = config.monitoring?.meshCoherenceLiveCheck?.emitCap; // undefined ⇒ unbounded
+                                const recorder = getFeatureMetricsRecorder();
+                                // THROW-SAFETY (Decision #11): the live registry read can throw on a corrupt /
+                                // mid-write registry. A signal-only check must NEVER crash the tick. On any read
+                                // failure emit a TRANSITION-GATED 'error' metric row, advance the backoff, and
+                                // do NOT touch the transition state (fail toward silence).
+                                try {
+                                    const live = {
+                                        boundHost: meshResolvedBindHost,
+                                        selfEndpoints: getSelfMeshEndpoints?.() ?? [],
+                                        uptimeMs: process.uptime() * 1000,
+                                    };
+                                    const warnings = checkMeshLiveStateCoherence(config.multiMachine, true, live, warmupGraceMs);
+                                    const nowCodes = new Set(warnings.map((w) => w.code));
+                                    let firedThisTick = false;
+                                    for (const w of warnings) {
+                                        if (!_meshCoherenceLastCodes.has(w.code)) { // TRANSITION-ONLY (absent→present)
+                                            const count = _meshCoherenceEmitCounts.get(w.code) ?? 0;
+                                            if (emitCap === undefined || count < emitCap) { // emitCap is READ here
+                                                console.log(pc.yellow(`  ⚠ mesh-live-coherence [${w.code}]: ${w.message}`));
+                                                _meshCoherenceEmitCounts.set(w.code, count + 1);
+                                                firedThisTick = true;
+                                            }
+                                        }
+                                    }
+                                    recorder?.record({ feature: 'mesh-coherence-live', kind: 'event', outcome: firedThisTick ? 'fired' : 'noop' });
+                                    _meshCoherenceLastCodes = nowCodes; // LEVEL-TRIGGERED reset
+                                    _meshCoherenceConsecFailures = 0; // SUCCESS resets the backoff
+                                    _meshCoherenceFailing = false; // clear the latch
+                                }
+                                catch {
+                                    // @silent-fallback-ok: signal-only honesty observer; a registry read error must
+                                    // never crash the tick. TRANSITION-GATED observability — emit ONE 'error' row on
+                                    // the healthy→failing transition (not every attempt), leave the divergence
+                                    // transition state untouched (fail toward silence), and advance the backoff.
+                                    if (!_meshCoherenceFailing) {
+                                        recorder?.record({ feature: 'mesh-coherence-live', kind: 'event', outcome: 'error' });
+                                        _meshCoherenceFailing = true;
+                                    }
+                                    _meshCoherenceConsecFailures += 1;
+                                }
+                            }
+                        }
+                    };
+                    const peerPresenceTimer = setInterval(peerPresenceTick, 30_000);
                     if (typeof peerPresenceTimer.unref === 'function')
                         peerPresenceTimer.unref();
                     const { resolveSessionPoolStage: _resolveSessionPoolStage } = await import('../core/inboundQueueConfig.js');