instar 1.3.688 → 1.3.690

package/dist/server/routes.js

@@ -8,9 +8,11 @@ import { Router } from 'express';
 import { execFileSync } from 'node:child_process';
 import { createHash, timingSafeEqual, randomUUID } from 'node:crypto';
 import { classifyActionClaim } from '../core/action-claim.js';
+import { sharedG3SoakLedger, decideLeaseGatedSpawn } from '../core/leaseGatedSpawn.js';
 import { getHostSpawnSemaphore, configuredSpawnAcquireMs, configuredSpawnWaitersMax } from '../core/hostSpawnSemaphore.js';
 import { activeSpawnPollers } from '../core/SpawnCapIntelligenceProvider.js';
 import { poolPollerVerdict } from '../core/pollerCount.js';
+import { decideNobodyPollingClaim, sharedG2NobodyPollingLedger } from '../core/nobodyPollingRecovery.js';
 import { canonicalPushKey } from '../core/PrHandLease.js';
 import { enrollPaneSessionName } from '../core/FrameworkLoginDriver.js';
 import fs from 'node:fs';
@@ -4561,6 +4563,21 @@ export function createRoutes(ctx) {
         }
         res.json(ctx.sessionReaper.snapshot());
     });
+    // G3 lease-gated-spawn soak evidence (MESH-SELF-HEAL-SPEC §3.3). The operator's
+    // PROMOTION-EVIDENCE surface — the answer to "is this dark feature actually
+    // doing anything, and should I promote it?" (operator directive 2026-06-27:
+    // observe-mode must produce an evaluable promotion recommendation, not rot
+    // dark forever). `summary` carries the counterfactual `wouldHavePreventedDuplicate`;
+    // `promotion` is the deterministic recommendation (promote | keep-soaking |
+    // consider-removal | enforcing). Read-only; never gates.
+    router.get('/mesh-selfheal/g3', (_req, res) => {
+        res.json({
+            feature: 'lease-gated-spawn',
+            flag: 'multiMachine.sessionPool.ownershipCheckedSpawn',
+            summary: sharedG3SoakLedger.summary(),
+            promotion: sharedG3SoakLedger.promotionSignal(),
+        });
+    });
     // AgentWorktreeReaper (RESPONSIBLE-RESOURCE-USAGE — OS resource hygiene). The
     // pull-surface answer to "which stale worktrees can be reclaimed, and why is
     // each kept?": every `.worktrees/` worktree's verdict (active-lock /
@@ -11389,6 +11406,56 @@ document.getElementById('mcpForm').addEventListener('submit', async function (e)
             machines: caps.map((c) => ({ machineId: c.machineId, nickname: c.nickname, online: c.online, pollingActive: c.pollingActive })),
         });
     });
+    // G2 nobody-polling silence debounce — module-scoped streak across reads, so a
+    // transient handoff-gap silence never reads as confirmed (Adv-F9).
+    const G2_NOBODY_POLLING_CONFIRM_OBSERVATIONS = 3;
+    let _g2SilenceStreak = 0;
+    // GET /mesh-selfheal/g2 — MESH-SELF-HEAL-SPEC §3.2 G2 OBSERVE surface (increment
+    // 2: detector + single-claimant election, REPORT-only). Computes the B5 verdict
+    // over the live pool, debounces a `silence` across reads (nobodyPollingConfirmObservations),
+    // runs the pure G2 decision (who should claim poll-ownership), records the
+    // counterfactual to the shared soak ledger, and returns it. OBSERVE-only: it
+    // does NOT actuate (no fenced-CAS acquire, no poll-lever write) — the enforce
+    // actuation is the next increment. Read-driven: each poll advances the soak.
+    router.get('/mesh-selfheal/g2', (_req, res) => {
+        const caps = ctx.machinePoolRegistry?.getCapacities() ?? [];
+        const sync = ctx.coordinator ? ctx.coordinator.getSyncStatus() : null;
+        const selfMachineId = ctx.coordinator?.identity?.machineId ?? null;
+        const verdict = poolPollerVerdict(caps.map((c) => ({ machineId: c.machineId, online: c.online, pollingActive: c.pollingActive })), false);
+        // Debounce a silence across reads (Adv-F9: a normal handoff gap is transient
+        // and must not trip a claim). Module-scoped streak counter.
+        if (verdict.verdict === 'silence')
+            _g2SilenceStreak += 1;
+        else
+            _g2SilenceStreak = 0;
+        const silenceConfirmed = _g2SilenceStreak >= G2_NOBODY_POLLING_CONFIRM_OBSERVATIONS;
+        // fit (observe approximation): heartbeat-fresh = a candidate that COULD take
+        // over polling. In a `silence` NOBODY is polling, so fitness is NOT tied to
+        // pollingActive (that would exclude exactly the idle-but-healthy machines that
+        // should claim). The enforce increment refines this with the machine-local
+        // pollSucceededMonoMs re-verify (post-CAS) + self-exclusion advertisement.
+        const machines = caps.map((c) => ({ machineId: c.machineId, fit: !!c.online }));
+        const decision = decideNobodyPollingClaim({
+            selfMachineId: selfMachineId ?? '(unknown)',
+            pollerVerdict: verdict.verdict,
+            silenceConfirmed,
+            preferredAwakeMachineId: sync?.preferredAwakeMachineId ?? null,
+            machines,
+            // Peer-evidence-of-global-outage plumbing is the enforce increment; observe
+            // never claims a global outage (false → a confirmed silence proceeds to elect).
+            globalOutageEvidence: false,
+        });
+        sharedG2NobodyPollingLedger.recordClaim(decision, new Date().toISOString());
+        res.json({
+            enabled: !!ctx.machinePoolRegistry,
+            verdict,
+            silenceStreak: _g2SilenceStreak,
+            silenceConfirmed,
+            selfMachineId,
+            decision,
+            ledger: sharedG2NobodyPollingLedger.summary(),
+        });
+    });
     // GET /pool/poll-cache — WS4.4(f) global pool-cache observability
     // (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4 clause (f)). Read-only: reports
     // whether the shared per-peer poll cache is wired, its TTL + load-shed
@@ -14645,6 +14712,34 @@ document.getElementById('mcpForm').addEventListener('submit', async function (e)
                 if (resumeSessionId) {
                     console.log(`[telegram-forward] Found resume UUID for topic ${topicId}: ${resumeSessionId} (source: TopicResumeMap — trusted)`);
                 }
+                // G3 — record the lease-gated-spawn decision for this SECONDARY spawn
+                // entry (the /internal/telegram-forward auto-spawn). This route is
+                // same-machine-only (injectionDropped respawn @server.ts + the lifeline
+                // poll) — cross-machine delivery bypasses it via MeshRpc→durable queue —
+                // so there is NO forward seam here and gating can never ping-pong.
+                // forwardAvailable:false makes this RECORD-ONLY: it always spawns
+                // (never strands a local re-entry), but feeds the shared soak ledger so
+                // the promotion evidence covers BOTH spawn entries, not just the cold
+                // path. Dark+dryRun by default ⇒ strict no-op on behavior.
+                try {
+                    const o = ctx.config?.multiMachine?.sessionPool?.ownershipCheckedSpawn ?? {};
+                    const g3 = decideLeaseGatedSpawn({
+                        holdsLease: ctx.coordinator ? ctx.coordinator.holdsLease() : true,
+                        flagEnabled: o.enabled === true,
+                        dryRun: o.dryRun !== false,
+                        singleMachine: ctx.coordinator === null,
+                        forwardAvailable: false,
+                    });
+                    sharedG3SoakLedger.record(g3, new Date().toISOString());
+                    if (g3.action !== 'spawn') {
+                        console.log(`[g3-spawn-gate] (telegram-forward) topic ${topicId}: action=${g3.action} reason=${g3.reason} (record-only — local re-entry, no forward seam)`);
+                    }
+                }
+                catch (err) {
+                    // @silent-fallback-ok — the soak record is observability only; a record
+                    // failure must never block the spawn (the safe direction).
+                    console.warn(`[g3-spawn-gate] (telegram-forward) record failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+                }
                 ctx.sessionManager.spawnInteractiveSession(bootstrapMessage, topicName, { telegramTopicId: topicId, resumeSessionId }).then((newSessionName) => {
                     // Clear resume entry after successful spawn
                     if (resumeSessionId) {