instar 1.3.689 → 1.3.691

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.689",
+  "version": "1.3.691",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-28T05:03:02.832Z",
-  "instarVersion": "1.3.689",
+  "generatedAt": "2026-06-28T09:47:08.176Z",
+  "instarVersion": "1.3.691",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "69ab3406ab2ae0b2fdbd0b9a46b9ce5c6a80c78acee1b4ccbeaa86d69f0bda4f",
+      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1618,7 +1618,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "7920e0bbe7f86ae0e4b5a2f39c6ef2e0272c3e90f1d8dccf11ced30d8bbcc76a",
+      "contentHash": "db0a3a53e3b3fc6d8c9593918944cba27c1faccd5a369d71bf1e555cf20bb028",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.690.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G2 — core decision logic** (increment 1 of the nobody-serving alarm, `MESH-SELF-HEAL-SPEC` §3.2). Adds `src/core/nobodyPollingRecovery.ts`: the PURE, deterministic decision core for the silent-loss backstop — when NO machine is polling Telegram (the zombie-lease-holder state behind the message-drop incidents), exactly ONE fit machine must take over, never zero (drops), never two (the 409 poll-war).
+
+- `electPollClaimant` — deterministic single-claimant election (F4-preferred-awake if fit, else lowest-machineId fit). Machine-agnostic: every machine elects the SAME claimant, which is the structural defense against split-brain double-claim.
+- `decideNobodyPollingClaim` — reduces over the EXISTING B5 detector (`pollerCount.ts`): `ok`→no-op, `dual`→veto (claiming into 2 pollers IS the 409 war), `indeterminate`→fail-closed, unconfirmed silence→await, peer-confirmed global outage→hold, confirmed silence→elect + claim/stand-down/escalate.
+- `decidePostCasSelfReverify` — "CAS-win is necessary but not sufficient": re-check live local poll-freshness before serving; on self-unfit, relinquish + self-exclude.
+- `NobodyPollingLedger` — evaluable soak evidence (episodes, claims, stand-downs, self-exclusions, vetoes), mirroring G3's close-the-loop ledger.
+
+It also wires the core to a **read-only observe surface**, `GET /mesh-selfheal/g2`: it computes the live nobody-polling verdict over the pool, debounces a silence across reads, runs the decision (who would claim), records the soak counterfactual, and returns it. The surface is OBSERVE-only — it reports the decision but does NOT enact it (no lease acquire, no polling change). The enforce-mode actuation (actually taking over polling via the existing poll-follows-lease lever) is the next increment.
+
+## What to Tell Your User
+
+Nothing changes in behavior yet — this is the detector + a read-only status surface for the upcoming "nobody-serving alarm," not yet acting anywhere. When the enforce step lands (next increment), it will detect the "nobody is polling Telegram" state across your machines and have exactly one fit machine take over automatically, so messages stop dropping when a machine goes quiet. No action needed.
+
+## Summary of New Capabilities
+
+- `GET /mesh-selfheal/g2` — read-only observe surface for the nobody-polling detector: live verdict + the single-claimant decision + soak evidence (agent observability; not a user-invokable capability). No config flag or write surface yet; observe-only (no actuation).
+
+## Evidence
+
+- `tests/unit/nobodyPollingRecovery.test.ts` — 18 unit tests covering both sides of every decision boundary (election: preferred-fit / preferred-unfit / no-fit / determinism; verdict reduction: ok/dual/indeterminate/await/hold/claim/stand-down/escalate; self-reverify: fresh→serve / stale→relinquish; ledger accounting).
+- `tests/integration/mesh-selfheal-g2-route.test.ts` — 4 integration tests over the real HTTP pipeline (feature-alive 200; confirmed-silence→claim; transient-silence→await-confirm; two-pollers→veto). All green; typecheck clean.

package/upgrades/1.3.691.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G2 enforce** (MESH-SELF-HEAL-SPEC §3.2) — the take-over actuation for the nobody-serving alarm. When NO machine is polling Telegram (the zombie-lease-holder state behind the message-drop incidents), exactly ONE fit machine now takes over poll-ownership — never zero (drops), never two (the Telegram 409 poll-war).
+
+- `src/core/nobodyPollingActuator.ts` (`applyNobodyPollingRecovery`) — dependency-injected actuator: win the fenced epoch-CAS → re-verify own poll-freshness (CAS-win is necessary-not-sufficient) → start polling, else relinquish + self-exclude.
+- `MultiMachineCoordinator.evaluateNobodyPolling()` — wires the detector + single-claimant election to the actuator with the real lease ports (`acquireIfEligible` / `currentEpoch` / `writeLeasePollIntent` / `relinquishAndBroadcast`), debounced (confirm=3) and reentrancy-guarded.
+- `server.ts` `refreshPool` — runs it on the existing 30s pool cadence, fire-and-forget.
+
+Ships **dark + dryRun-first** (`multiMachine.nobodyPollingRecovery`, OMITS `enabled` → dev-gated). In dryRun it detects + elects + records the soak counterfactual but performs ZERO side effects (no lease acquire, no poll-lever write) — verified by an independent second-pass review (the high-risk lease-authority gate). Flipping `dryRun:false` is the deliberate enforce promotion, gated on two tracked prerequisites: the real pollSucceeded watermark + the peer-confirmed global-outage plumbing (see MESH-SELF-HEAL-G2-BUILD.md).
+
+## What to Tell Your User
+
+When this is turned on (it ships off, in observe-only mode for now), it fixes the "nobody is polling, so my messages silently drop" problem on multi-machine setups: if the in-charge machine goes quiet, exactly one healthy machine automatically takes over polling — no tug-of-war, no duplicates, no action needed from you. Single-machine setups are unaffected.
+
+## Summary of New Capabilities
+
+- `multiMachine.nobodyPollingRecovery` `{ dryRun }` — opt-in (dev-gated) nobody-polling take-over: detect → elect one machine → acquire the fenced lease → start polling. Dark + dryRun by default (observe-only; zero side effects until a deliberate enforce promotion).
+
+## Evidence
+
+- `tests/unit/nobodyPollingActuator.test.ts` — 5 tests, both sides of every boundary incl. the critical dryRun=zero-side-effects safety invariant (no CAS, no poll-write) and CAS-lost / self-excluded / claimed-serving.
+- Builds on the merged G2 core (18 unit) + observe route (4 integration). Dark-gate lint golden map updated for the +7 line shift. Typecheck clean; full G2 suite green.
+- Independent Phase-5 second-pass review: CONCUR (dryRun invariant holds; single-claimant is the fenced CAS; no tug-of-war). Its one minor concern (reentrancy guard) was fixed in this commit.

package/upgrades/side-effects/mesh-self-heal-g2-core.md

@@ -0,0 +1,32 @@
+# Side-Effects Review — Mesh Self-Heal G2 (core decision logic)
+
+**Change:** The PURE decision core of G2 (nobody-polling detector + single-claimant recovery) from `MESH-SELF-HEAL-SPEC.md` §3.2 — `src/core/nobodyPollingRecovery.ts` + 18 unit tests. Three pure functions (`electPollClaimant`, `decideNobodyPollingClaim`, `decidePostCasSelfReverify`) + a soak ledger. This is increment 1 of G2: the decision logic only. It is NOT YET WIRED to any tick, route, or actuation — it has ZERO runtime effect until a later increment consumes it. (Wiring + the `/mesh-selfheal/g2` observe route + the enforce-mode actuation via the existing poll-follows-lease lever + CAS are the next increment — see MESH-SELF-HEAL-G2-BUILD.md.)
+
+**Decision point?** The MODULE encodes a decision (who claims poll-ownership), but nothing CALLS it yet, so in this increment there is no live decision-point. Signal-vs-authority still assessed (Q4).
+
+## 1. Over-block (legitimate inputs wrongly rejected?)
+N/A as shipped — unwired, no inputs flow through it. By design the decision FAILS toward NOT-claiming on every ambiguity (`dual`→veto, `indeterminate`→fail-closed, unconfirmed silence→await, global-outage→hold, no-fit→escalate). The only `claim` outcome requires confirmed real silence + this machine being the deterministically-elected single claimant. A wrongful claim is the harm (a 2nd poller / 409 war), so the gate is biased hard against claiming.
+
+## 2. Under-block (failure modes still missed?)
+As pure logic, none in-scope. The KNOWN not-yet-built pieces (tracked, not orphan-deferred): the actuation (CAS acquire + poll-lever start/stop) and the post-claim live-verify of `lifeline-poll-active.json`. Until those land, this module cannot cause OR prevent anything — it is inert decision logic with full test coverage.
+
+## 3. Level-of-abstraction fit
+Correct layer. It REDUCES over the existing B5 detector (`pollerCount.ts` `evaluatePollerCount`) rather than re-folding poll-counts (spec finding Int2-A — reuse, don't reinvent). It is a pure decision module mirroring `leaseGatedSpawn.ts` (G3) — no I/O, fully unit-testable, consumed by a thin wiring layer later.
+
+## 4. Signal vs authority compliance
+COMPLIANT. Pure functions (no I/O, no blocking authority). The election is deterministic + machine-agnostic (every machine computing it over the same inputs elects the SAME claimant — the structural defense against split-brain double-claim). The actual authority (acquiring the fenced epoch-CAS) lives in the existing lease coordinator, which the future wiring will call; this module only DECIDES, it does not ENACT. `decidePostCasSelfReverify` encodes "CAS-win is necessary but not sufficient" (Adv2-F1) so the eventual enactment re-checks live local freshness before serving.
+
+## 5. Interactions
+None in this increment (unwired). The design's intended interactions (documented for the wiring increment): consumes B5's verdict; the claim drives the existing poll-follows-lease lever; self-exclusion advertises into the existing heartbeat. No shadowing — it adds a decision layer ON TOP of B5, not parallel to it.
+
+## 6. External surfaces
+None yet. No route, no config flag, no audit write in this increment — the module is pure. The exported `sharedG2NobodyPollingLedger` singleton mirrors `sharedG3SoakLedger`; it is written/read only once the wiring + `/mesh-selfheal/g2` route land.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS multi-machine coherence logic. Posture: the decision is computed LOCALLY on each machine from the replicated/advertised pool capacities + B5 verdict, and is deterministic so all machines agree on the single claimant without a coordination round-trip (the election is the coherence mechanism). The watermarks it will eventually read (`pollSucceededMonoMs` etc.) are machine-local, never replicated (spec §3.1 Sca-F1) — but that plumbing is the wiring increment, not this one.
+
+## 8. Rollback cost
+Trivial — revert the commit. The module is unreferenced by any runtime path, so removing it cannot affect a running agent. No config, no migration, no state.
+
+## Second-pass review
+Not triggered for this increment: the module is unwired pure logic with no live decision-point, block/allow authority, or session-lifecycle touch. The Phase-5 second-pass IS required for the WIRING increment (it will consume the lease/poll-ownership authority — "lease"/"sentinel"/session-lifecycle territory) and is flagged in MESH-SELF-HEAL-G2-BUILD.md.

package/upgrades/side-effects/mesh-self-heal-g2-enforce.md

@@ -0,0 +1,38 @@
+# Side-Effects Review — Mesh Self-Heal G2 (enforce actuation)
+
+**Change:** The ENFORCE half of G2 (MESH-SELF-HEAL-SPEC §3.2) — actually taking over poll-ownership when nobody is polling. HIGH-RISK: it holds cross-machine poll-ownership authority (the area whose hasty version caused the 2026-06-27 tug-of-war). Pieces:
+- `src/core/nobodyPollingActuator.ts` (`applyNobodyPollingRecovery`) — dependency-injected actuator: dryRun gate → `acquireFencedCas` → `decidePostCasSelfReverify` → `startPolling` / `relinquishAndSelfExclude`. 5 unit tests.
+- `MultiMachineCoordinator.evaluateNobodyPolling()` — the wiring: gate (`nobodyPollingRecoveryCfg`) → B5 verdict → debounce (`_g2SilenceStreak`, confirm=3) → `decideNobodyPollingClaim` → record → actuate (real ports: `leaseCoordinator.acquireIfEligible` / `currentEpoch` / `writeLeasePollIntent(true)` / `relinquishAndBroadcast`). Reentrancy-guarded (`_g2Evaluating`).
+- `server.ts` `refreshPool` — the 30s cadence (fire-and-forget, gated inside the coordinator).
+- `ConfigDefaults`: `multiMachine.nobodyPollingRecovery: { dryRun: true }` (OMITS `enabled` → dev-gated). Dark-gate lint golden map updated (+7 line shift).
+
+**Decision point?** YES — it acquires the fenced lease + starts polling. Signal-vs-authority + the dryRun safety invariant are the load-bearing concerns.
+
+## 1. Over-block
+N/A (it grants poll-ownership, never blocks). It biases hard against acting: only a confirmed real silence where this machine is the deterministic single claimant AND wins the fenced CAS AND re-verifies its own poll-freshness ever serves.
+
+## 2. Under-block
+Ships dark+dryRun (default), so nothing actuates until a deliberate `dryRun:false`. **Enforce-ENABLE prerequisites (TRACKED, not orphan-deferred — see MESH-SELF-HEAL-G2-BUILD.md + the enforce note below):** (1) the real `pollSucceededMonoMs`/serve-progress watermark for `localPollSucceededFresh` (currently a lifeline-liveness approximation — consulted ONLY when dryRun:false); (2) peer-confirmed `globalOutageEvidence` plumbing (currently hard-coded false → a confirmed silence proceeds to elect, the local-failure-safe direction). Both are inert under dryRun.
+
+## 3. Level-of-abstraction fit
+The authority lives in the coordinator (it owns the leaseCoordinator); the server only supplies the cadence + capacities. The actuator isolates the delicate flow behind injected ports (testable without a live coordinator; the dryRun gate is a single chokepoint). Reuses `acquireIfEligible` (the SAME fence `tickLease` uses) — not a parallel acquire path.
+
+## 4. Signal vs authority compliance
+COMPLIANT with the safety design: the only authority (acquire CAS + start polling) is exercised through the ports ONLY when `dryRun:false` AND the decision is a genuine self-claim. The election is deterministic + machine-agnostic, but it is NOT the authority — the **fenced CAS is the single-claimant gate** (even if two machines diverge on the election under partition, `acquireIfEligible` admits exactly one; the loser gets `cas-lost` and stands down). `decidePostCasSelfReverify` enforces "CAS-win necessary-not-sufficient."
+
+## 5. Interactions
+- vs `tickLease`: a won CAS makes this machine the holder → `tickLease`'s non-holder acquire converges (doesn't fight); a successful claim flips the verdict to `ok` (self-terminating). Debounce + post-CAS reverify damp flap.
+- Reentrancy: `_g2Evaluating` prevents a >30s eval overlapping the 30s cadence (which would inflate the silence streak pre-await). Added per the 2nd-pass review.
+- Cadence: fire-and-forget with `.catch()` — a slow/failed eval never blocks or fails `refreshPool`.
+
+## 6. External surfaces
+No new route (the observe `/mesh-selfheal/g2` from the prior PR reads the same ledger). New config path `multiMachine.nobodyPollingRecovery` (dev-gated). When `dryRun:false` it WRITES the lease (poll-ownership) — the reason this is dark-first + 2nd-pass-gated.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS the cross-machine recovery actuator. Coherence is the deterministic election + the fenced CAS (one winner, pool-wide). The watermarks it reads are machine-local (skew-immune). Single-machine = strict no-op (no leaseCoordinator/peers → `skipped`).
+
+## 8. Rollback cost
+Trivial — ships dark+dryRun (strict no-op until a deliberate enable). Revert the commit, or leave the flag off. No migration, no state. Even enabled-in-dryRun performs zero side effects.
+
+## Second-Pass Review (REQUIRED — high-risk: lease/poll-ownership authority)
+An independent reviewer audited the actuator + coordinator method + cadence. **Verdict: CONCUR.** Verified: (a) the dryRun invariant HOLDS — the gate sits strictly before every port call; default `dryRun:true` (`?? true`) + dev-gated dark-on-fleet; test pins zero side-effects; (b) single-claimant is genuinely the fenced CAS, not the election guess — a partition divergence still admits exactly one (loser → `cas-lost`); (c) no tug-of-war — the won CAS converges with `tickLease`, debounce + self-reverify damp flap; (d) fail directions correct, hardcoded `globalOutageEvidence:false` is the documented local-safe direction + inert under dryRun. **One concern raised (minor, non-blocking given dark+dryRun): no reentrancy guard** on `evaluateNobodyPolling` — a >30s eval could overlap the 30s tick and inflate `_g2SilenceStreak`. **RESOLVED in this commit** (added `_g2Evaluating` guard, mirroring `leaseTicking`). The reviewer's two enforce-ENABLE prerequisites (the pollSucceeded watermark; the globalOutageEvidence plumbing) are tracked in MESH-SELF-HEAL-G2-BUILD.md as the gate before `dryRun:false`.

package/upgrades/side-effects/mesh-self-heal-g2-observe.md

@@ -0,0 +1,34 @@
+# Side-Effects Review — Mesh Self-Heal G2 (observe route)
+
+**Change:** Wires the G2 pure core (this PR's first commit) to a read-only observe surface: `GET /mesh-selfheal/g2` (`src/server/routes.ts`) + 4 integration tests. The route computes the B5 verdict over the live pool (`machinePoolRegistry.getCapacities()`), debounces a `silence` across reads (`G2_NOBODY_POLLING_CONFIRM_OBSERVATIONS = 3`), runs `decideNobodyPollingClaim`, records the counterfactual to `sharedG2NobodyPollingLedger`, and returns `{ verdict, silenceStreak, silenceConfirmed, selfMachineId, decision, ledger }`.
+
+**Decision point?** The route REPORTS a decision (who would claim poll-ownership) but does NOT ENACT it — no fenced-CAS acquire, no poll-lever write. It is observe/read-only. The enacting authority (the enforce increment) is explicitly NOT in this change.
+
+## 1. Over-block
+N/A — read-only, blocks nothing. The decision it reports is biased hard against claiming (dual→veto, indeterminate→fail-closed, unconfirmed-silence→await, no-fit→escalate); only a confirmed real silence with this machine as the deterministic single claimant yields `claim`.
+
+## 2. Under-block
+The observe surface does not act, so it can neither over- nor under-block. KNOWN not-yet-built (tracked, not orphan-deferred): the enforce actuation (CAS acquire + `writePollIntent` poll-lever + post-claim live-verify of `lifeline-poll-active.json`) and peer-evidence-of-global-outage plumbing (`globalOutageEvidence` is hard-coded false here → a confirmed silence proceeds to elect, which is the observe-correct behavior; the HOLD-on-global path is the enforce increment).
+
+## 3. Level-of-abstraction fit
+Correct. The route reuses the EXACT capacity-gathering + `poolPollerVerdict` the adjacent `GET /pool/poller-count` already uses (no new pool plumbing), and the pure decision lives in `nobodyPollingRecovery.ts`. The route is a thin reporter over both.
+
+## 4. Signal vs authority compliance
+COMPLIANT. Read-only observability with no blocking/enacting authority. `selfMachineId` is read from `coordinator.identity?.machineId`; the election is deterministic + machine-agnostic. The route records soak evidence (signal) and returns the decision (signal) — it does not acquire the lease or change polling.
+
+## 5. Interactions
+- Reuses `poolPollerVerdict` (B5) — no reimplementation, no double-fold.
+- The `_g2SilenceStreak` debounce counter is module-scoped per `createRoutes` call (one server process = one counter) — correct (a single server's consecutive reads). It is reset on any non-silence verdict.
+- Records to the process-wide `sharedG2NobodyPollingLedger` — the same singleton the enforce increment's evaluator will use; read-driven recording means the ledger advances as the route is polled (documented; the periodic evaluator is the enforce increment).
+
+## 6. External surfaces
+New route `GET /mesh-selfheal/g2` — Bearer-gated like all routes; classified under the existing `mesh-selfheal` INTERNAL_PREFIXES entry (added by G3, already on main) so it's an agent-read, not a user capability. No config flag, no write surface, no audit file in this increment.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS the cross-machine coherence read. The decision is computed locally from the pool's advertised capacities + the deterministic election, so every machine's `/mesh-selfheal/g2` agrees on the single claimant without a coordination round-trip. `selfMachineId` is machine-local. Read-only — nothing replicates or strands on transfer.
+
+## 8. Rollback cost
+Trivial — revert the commit. The route is read-only and unreferenced by any actuation path; removing it cannot affect a running agent's behavior. No migration, no state.
+
+## Second-pass review
+Not triggered: the route holds NO block/allow authority, touches NO session lifecycle, and performs NO actuation — it is read-only observability over a pure decision. The Phase-5 second-pass IS required for the ENFORCE increment (CAS + poll-lever actuation = lease/poll-ownership authority) and remains flagged in MESH-SELF-HEAL-G2-BUILD.md.