instar 1.3.654 → 1.3.656

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAq1gBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi4gBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -6672,7 +6672,14 @@ export async function startServer(options) {
         }
         // Wired by the resume-queue boot block (Part B) once the queue exists;
         // stays false (no "restart queued" lines) until then or in dry-run.
+        // OWNERSHIP predicate (paused-BLIND) — read by the PromiseBeacon I2
+        // double-spawn coordination guard (must keep deferring to the queue while
+        // paused). Distinct from resumeClaimableForSession below.
         let resumeQueuedForSession = () => false;
+        // CLAIMABILITY predicate (paused-AWARE) — read by the ReapNotifier
+        // "restart is queued" copy (honest-session-state-surfaces Finding (c)): a
+        // paused queue won't revive yet, so the claim is suppressed while paused.
+        let resumeClaimableForSession = () => false;
         const reapNotifier = new ReapNotifier({
             resolveTopic: (tmuxSession) => {
                 const t = telegram?.getTopicForSession(tmuxSession);
@@ -6697,7 +6704,9 @@ export async function startServer(options) {
             recordNotify: (e) => reapLog.recordNotify(e),
             quietHoursEndAt: (now) => notificationBatcher.quietHoursEndAt(now),
             summaryReleaseAt: (now) => notificationBatcher.nextSummaryReleaseAt(now),
-            resumeQueuedFor: (tmuxSession) => resumeQueuedForSession(tmuxSession),
+            // Finding (c): the user-facing "restart is queued" copy reads the
+            // CLAIMABILITY predicate (false while paused), NOT the ownership one.
+            resumeQueuedFor: (tmuxSession) => resumeClaimableForSession(tmuxSession),
             // Honest-recycle (honest-session-recycle-spec): tell ReapNotifier whether
             // this session's topic has an ACTIVE autonomous run (and how long is left),
             // so an age-limit RECYCLE of a still-active run reads as a continuation
@@ -6961,7 +6970,10 @@ export async function startServer(options) {
             else {
                 // Feed the notifier's "restart is queued" line (live, non-dry-run only).
                 const rq = resumeQueue;
+                // OWNERSHIP (paused-blind) → I2 double-spawn guard at :11980.
                 resumeQueuedForSession = (tmuxSession) => rq.hasLiveQueuedEntryFor(tmuxSession);
+                // CLAIMABILITY (paused-aware) → ReapNotifier "restart is queued" copy.
+                resumeClaimableForSession = (tmuxSession) => rq.hasClaimableQueuedEntryFor(tmuxSession);
                 const resolveTopicForTmux = (tmuxSession) => {
                     try {
                         const t = telegram?.getTopicForSession(tmuxSession);
@@ -9349,9 +9361,16 @@ export async function startServer(options) {
         // calls that used to live here. Dedupes across the three triggers and
         // vetoes zombie cleanup while a recovery is in flight.
         const { CompactionSentinel } = await import('../monitoring/CompactionSentinel.js');
+        // A session is a legitimate recovery target ONLY while it is in the running
+        // set. A finished/failed/killed session drops out of listRunningSessions(),
+        // so this is the structural guard that stops both sentinels from "recovering"
+        // a session that is simply done — the false-positive that spammed the user
+        // with throttle-resume nudges on a finished session (live incident 2026-06-24).
+        const isSessionRecoverable = (sessionName) => sessionManager.listRunningSessions().some(s => s.tmuxSession === sessionName);
         const compactionSentinel = new CompactionSentinel({
             recoverFn: recoverCompactedSession,
             projectDir: config.projectDir,
+            isSessionRecoverable,
             getClaudeSessionId: (sessionName) => {
                 const session = sessionManager.listRunningSessions()
                     .find(s => s.tmuxSession === sessionName);
@@ -9446,6 +9465,7 @@ export async function startServer(options) {
             notifyFn: rateLimitNotify,
             projectDir: config.projectDir,
             getClaudeSessionId: getClaudeSessionIdForName,
+            isSessionRecoverable,
             // #33 codex parity: for codex sessions, recovery-verification reads the newest
             // codex rollout (account-wide throttle → newest-rollout growth = cleared) and
             // the user-facing messages use OpenAI wording.
@@ -9477,6 +9497,19 @@ export async function startServer(options) {
         sessionManager.on('apiErrorAtIdle', (sessionName) => {
             rateLimitSentinel.report(sessionName, 'idle-error', { errorClass: 'transient-api' });
         });
+        // When a session completes, immediately clear any in-flight recovery for it in
+        // BOTH sentinels. The recoverability guard already blocks NEW recoveries on a
+        // finished session and aborts an in-flight one at its next tick; clearing here
+        // frees the recovery slot (and lifts the zombie-kill veto) immediately instead
+        // of waiting for that tick — and is the explicit completion-cleanup the prior
+        // code lacked (clear() existed but had zero callers). (live incident 2026-06-24)
+        // clear() on both sentinels is a pure synchronous timer-cancel + Map.delete that
+        // cannot throw, so no defensive try/catch is needed here (a wrapper would only be a
+        // silent fallback the no-silent-fallbacks ratchet flags — see the methods).
+        sessionManager.on('sessionComplete', (session) => {
+            rateLimitSentinel.clear(session.tmuxSession);
+            compactionSentinel.clear(session.tmuxSession);
+        });
         // #33 codex parity: the two triggers above read CLAUDE panes / claude-PID watchdog,
         // so a codex session throttled by OpenAI is invisible to them. This poll reads the
         // codex account usage; when codex itself flags a rate-limit hit
@@ -10761,6 +10794,12 @@ export async function startServer(options) {
                     // honest classifier must stay silent so the user hears one voice.
                     // Reuses the same composed checker the SessionReaper uses for its veto.
                     isStuckRecoveryActive: (sessionName) => wedgeRecoveryActive?.(sessionName) ?? false,
+                    // honest-session-state-surfaces Finding (b): lift the Tier-3 honest
+                    // stuck classification into Tier 1 / Tier 2. Dev-gated dark — live on
+                    // a development agent, dark on the fleet (the flag is OMITTED from
+                    // ConfigDefaults so it resolves through the dev-agent gate). Signal
+                    // only — changes the standby MESSAGE TEXT, never the schedule/recovery.
+                    standbyHonestyTiers: resolveDevAgentGate(config.monitoring?.standbyHonestyTiers?.enabled, config),
                     // Shared LLM queue (interactive lane) — cross-monitor concurrency
                     // and daily-spend-cap with PromiseBeacon.
                     sharedLlmQueue,