instar 1.3.690 → 1.3.692

package/dist/core/nobodyPollingActuator.js

@@ -0,0 +1,61 @@
+/**
+ * MESH-SELF-HEAL G2 — enforce-mode ACTUATOR (dependency-injected, testable).
+ *
+ * Spec: MESH-SELF-HEAL-SPEC §3.2; build plan: MESH-SELF-HEAL-G2-BUILD.md.
+ *
+ * This is the ENFORCE half of G2: given a `claim` decision from
+ * `decideNobodyPollingClaim`, actually take poll-ownership — win the fenced
+ * epoch-CAS, RE-VERIFY live local poll-success (CAS-win is necessary-not-sufficient,
+ * Adv2-F1), then either start polling (drive the existing poll-follows-lease lever)
+ * or relinquish + self-exclude. The delicate cross-machine authority (the exact
+ * code whose hasty version caused the 2026-06-27 tug-of-war) is isolated behind
+ * INJECTED PORTS so it is unit-testable WITHOUT a live coordinator/lifeline, and so
+ * the dryRun gate is a single, auditable chokepoint.
+ *
+ * Ships DARK + dryRun-first. In dryRun it records "would actuate" and performs ZERO
+ * side effects (no CAS acquire, no poll-lever write) — pure observation. Only an
+ * explicit `dryRun:false` (the enforce promotion) ever touches the lease or polling.
+ *
+ * SECOND-PASS REVIEW REQUIRED before merge (this holds poll-ownership authority).
+ */
+import { decidePostCasSelfReverify } from './nobodyPollingRecovery.js';
+/**
+ * Actuate a G2 claim decision. Pure control-flow over injected ports; the only
+ * authority is exercised through the ports, and ONLY when `dryRun` is false and the
+ * decision is a genuine self-claim. Idempotent per call.
+ */
+export async function applyNobodyPollingRecovery(args) {
+    const { decision, dryRun, ports, ledger, nowIso, log } = args;
+    // Only a genuine self-claim actuates. stand-down / veto / fail-closed / hold /
+    // escalate / await / no-op are non-actuating (the decision recorder already
+    // counted them); the actuator must NEVER touch the lease for those.
+    if (!decision.selfClaims || decision.action !== 'claim') {
+        return { result: 'no-action', reason: `decision=${decision.action}` };
+    }
+    // DARK / dryRun: observe only. Record the counterfactual; perform NO side effect.
+    if (dryRun) {
+        log?.(`[g2-actuator] DRY-RUN would claim poll-ownership (epoch n+1) — no CAS, no poll-lever write`);
+        return { result: 'dry-run-would-claim', reason: 'dry-run-observe-only' };
+    }
+    // ENFORCE: win the fenced epoch-CAS. Losing means a peer won the same episode —
+    // stand down (the single-claimant invariant holds via the fence, not our guess).
+    const won = await ports.acquireFencedCas();
+    if (!won) {
+        return { result: 'cas-lost', reason: 'another-machine-won-the-fenced-epoch' };
+    }
+    // CAS-win is necessary but NOT sufficient (Adv2-F1): re-verify OWN live poll
+    // freshness (current+local) before committing to serve.
+    const reverify = decidePostCasSelfReverify({ localPollSucceededFresh: ports.localPollSucceededFresh() });
+    if (!reverify.commit) {
+        ports.relinquishAndSelfExclude();
+        ledger.recordSelfExclusion(nowIso);
+        log?.(`[g2-actuator] won CAS but self-unfit on re-verify → relinquished + self-excluded`);
+        return { result: 'self-excluded', reason: reverify.reason };
+    }
+    // Committed: drive the poll-follows-lease lever to START polling at the won epoch.
+    // (The caller's post-claim live-verify confirms lifeline-poll-active.json advances.)
+    ports.startPolling(ports.currentEpoch());
+    log?.(`[g2-actuator] claimed poll-ownership + started polling at epoch ${ports.currentEpoch()}`);
+    return { result: 'claimed-serving', reason: 'cas-won-self-reverified-fit' };
+}
+//# sourceMappingURL=nobodyPollingActuator.js.map

package/dist/core/nobodyPollingActuator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nobodyPollingActuator.js","sourceRoot":"","sources":["../../src/core/nobodyPollingActuator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAoCvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAOhD;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE9D,+EAA+E;IAC/E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACxD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,kFAAkF;IAClF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,EAAE,CAAC,4FAA4F,CAAC,CAAC;QACpG,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3E,CAAC;IAED,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAChF,CAAC;IAED,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACjC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnC,GAAG,EAAE,CAAC,kFAAkF,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,mFAAmF;IACnF,qFAAqF;IACrF,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzC,GAAG,EAAE,CAAC,mEAAmE,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AAC9E,CAAC"}

package/dist/core/zombieRelinquish.d.ts

@@ -0,0 +1,90 @@
+/**
+ * MESH-SELF-HEAL G1 — lease↔job binding via a THREE-SIGNAL liveness model (pure core).
+ *
+ * Spec: MESH-SELF-HEAL-SPEC §3.1. The DEEPEST fix: the "in charge" lease means two
+ * things at once — "I'm the coordinator" AND "I'm actually serving you" — and
+ * conflating them is what let the 2026-06-19/27 zombie hold the badge while serving
+ * nothing. G1 binds the two: a holder that has stopped doing the JOB must relinquish
+ * the badge, decided from THREE machine-local, monotonic liveness signals sourced
+ * from the lifeline's ACTUAL-poll truth (FD10: server-intent ≠ lifeline-actual is
+ * exactly what hid the incident).
+ *
+ * This module is the PURE decision (no I/O) so every branch is unit-testable on both
+ * sides. The caller supplies freshness booleans (computed by comparing each
+ * machine-local monotonic watermark against `jobStaleThresholdMs` on its OWN clock —
+ * never a cross-process/cross-machine monotonic subtraction), the debounce result,
+ * and POSITIVE peer-evidence of a global outage. It is SIGNAL/decision only; the
+ * caller actuates via F3's `relinquishAndBroadcast()` (signed tombstone). Ships DARK.
+ *
+ * The three signals (all machine-local, evaluated by the machine about ITSELF):
+ *   - pollAttemptedMonoMs   — a getUpdates cycle was attempted (alive + trying)
+ *   - pollSucceededMonoMs   — a getUpdates response succeeded (channel reachable)
+ *   - serveProgressedMonoMs — a fetched update was dispatched/served (end-to-end)
+ */
+export interface ZombieRelinquishInput {
+    /** This machine currently holds the fenced lease. */
+    holdsLease: boolean;
+    /** The `active` lease role (NOT observe-only/deferential — those are F3's path,
+     *  not G1; finding Int-LOW). G1 only ever acts on an active holder. */
+    isActiveLeaseRole: boolean;
+    /**
+     * Updates are PENDING = `lastFetchedUpdateId > lastServedUpdateId` (the two
+     * poll-side counters) — NOT serve-queue depth, NOT the Telegram-acked offset
+     * (Adv2-F5/Adv3-F-D: the poller advances the offset on FETCH, so "offset not
+     * advanced" would falsely read non-pending even when serve silently dropped).
+     */
+    pending: boolean;
+    /** pollAttemptedMonoMs fresh (within jobStaleThresholdMs, own clock). */
+    pollAttemptedFresh: boolean;
+    /** pollSucceededMonoMs fresh. */
+    pollSucceededFresh: boolean;
+    /** serveProgressedMonoMs fresh (boot-epoch-fenced — a prior incarnation's stamp
+     *  reads as NOT fresh; round-4 Adv4-B). */
+    serveProgressedFresh: boolean;
+    /** The relevant-staleness has PERSISTED across N fresh evaluator ticks (Adv-F8 —
+     *  defeats an evaluator-resume false trip). The caller debounces. */
+    staleConfirmed: boolean;
+    /**
+     * POSITIVE evidence the outage is GLOBAL: a fresh, signed heartbeat from ≥1 live
+     * peer in-window that ALSO reports pollSucceeded-stale. "I can't hear any peer"
+     * must NEVER set this true (Adv2-F2 — a heartbeat-transport partition is not a
+     * global outage; misreading it would HOLD and protect a real zombie).
+     */
+    peerConfirmsGlobalOutage: boolean;
+}
+export type ZombieRelinquishAction = 'not-applicable' | 'healthy' | 'await-confirm' | 'hold-global' | 'relinquish' | 'relinquish-wedged';
+export interface ZombieRelinquishDecision {
+    action: ZombieRelinquishAction;
+    /** Should the caller run relinquishAndBroadcast() now? */
+    relinquish: boolean;
+    /** Short machine-readable reason for the audit log. */
+    reason: string;
+}
+/**
+ * Decide whether an active lease-HOLDER is a zombie that must relinquish. Pure;
+ * the caller actuates only on `relinquish` (quiesce the renew path + draw a
+ * tombstone nonce > the highest it will emit this epoch, then relinquishAndBroadcast).
+ */
+export declare function decideZombieRelinquish(input: ZombieRelinquishInput): ZombieRelinquishDecision;
+/**
+ * G1 soak/observability ledger — evaluable evidence (mirrors G2/G3 close-the-loop).
+ * Counts each decision-class transition. SIGNAL only.
+ */
+export interface ZombieRelinquishLedgerSummary {
+    evaluations: number;
+    relinquishedLocal: number;
+    relinquishedWedged: number;
+    heldGlobal: number;
+    healthy: number;
+    awaitConfirm: number;
+    firstAt: string | null;
+    lastAt: string | null;
+}
+export declare class ZombieRelinquishLedger {
+    private s;
+    record(decision: ZombieRelinquishDecision, nowIso: string): void;
+    summary(): ZombieRelinquishLedgerSummary;
+}
+/** Process-wide shared G1 ledger (mirrors sharedG2NobodyPollingLedger). */
+export declare const sharedG1ZombieRelinquishLedger: ZombieRelinquishLedger;
+//# sourceMappingURL=zombieRelinquish.d.ts.map

package/dist/core/zombieRelinquish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zombieRelinquish.d.ts","sourceRoot":"","sources":["../../src/core/zombieRelinquish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,UAAU,EAAE,OAAO,CAAC;IACpB;2EACuE;IACvE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;+CAC2C;IAC3C,oBAAoB,EAAE,OAAO,CAAC;IAC9B;yEACqE;IACrE,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,SAAS,GACT,eAAe,GACf,aAAa,GACb,YAAY,GACZ,mBAAmB,CAAC;AAExB,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,0DAA0D;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB,CAsC7F;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,CAAC,CAGP;IAEF,MAAM,CAAC,QAAQ,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAchE,OAAO,IAAI,6BAA6B;CAGzC;AAED,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,wBAA+B,CAAC"}

package/dist/core/zombieRelinquish.js

@@ -0,0 +1,95 @@
+/**
+ * MESH-SELF-HEAL G1 — lease↔job binding via a THREE-SIGNAL liveness model (pure core).
+ *
+ * Spec: MESH-SELF-HEAL-SPEC §3.1. The DEEPEST fix: the "in charge" lease means two
+ * things at once — "I'm the coordinator" AND "I'm actually serving you" — and
+ * conflating them is what let the 2026-06-19/27 zombie hold the badge while serving
+ * nothing. G1 binds the two: a holder that has stopped doing the JOB must relinquish
+ * the badge, decided from THREE machine-local, monotonic liveness signals sourced
+ * from the lifeline's ACTUAL-poll truth (FD10: server-intent ≠ lifeline-actual is
+ * exactly what hid the incident).
+ *
+ * This module is the PURE decision (no I/O) so every branch is unit-testable on both
+ * sides. The caller supplies freshness booleans (computed by comparing each
+ * machine-local monotonic watermark against `jobStaleThresholdMs` on its OWN clock —
+ * never a cross-process/cross-machine monotonic subtraction), the debounce result,
+ * and POSITIVE peer-evidence of a global outage. It is SIGNAL/decision only; the
+ * caller actuates via F3's `relinquishAndBroadcast()` (signed tombstone). Ships DARK.
+ *
+ * The three signals (all machine-local, evaluated by the machine about ITSELF):
+ *   - pollAttemptedMonoMs   — a getUpdates cycle was attempted (alive + trying)
+ *   - pollSucceededMonoMs   — a getUpdates response succeeded (channel reachable)
+ *   - serveProgressedMonoMs — a fetched update was dispatched/served (end-to-end)
+ */
+/**
+ * Decide whether an active lease-HOLDER is a zombie that must relinquish. Pure;
+ * the caller actuates only on `relinquish` (quiesce the renew path + draw a
+ * tombstone nonce > the highest it will emit this epoch, then relinquishAndBroadcast).
+ */
+export function decideZombieRelinquish(input) {
+    const { holdsLease, isActiveLeaseRole, pending, pollAttemptedFresh, pollSucceededFresh, serveProgressedFresh, staleConfirmed, peerConfirmsGlobalOutage, } = input;
+    // G1 only acts on an ACTIVE holder. A non-holder / observe-only / deferential
+    // machine is handled elsewhere (F3 / G2), never here.
+    if (!holdsLease || !isActiveLeaseRole) {
+        return { action: 'not-applicable', relinquish: false, reason: 'not-an-active-holder' };
+    }
+    // The relevant liveness signal: end-to-end SERVE progress when updates are
+    // pending, else the poll-SUCCESS heartbeat when idle (no pending work to serve).
+    const relevantStale = pending ? !serveProgressedFresh : !pollSucceededFresh;
+    if (!relevantStale) {
+        return { action: 'healthy', relinquish: false, reason: pending ? 'serve-progressing' : 'poll-succeeding' };
+    }
+    // Debounce: a single stale read is not a zombie (an evaluator-resume blip).
+    if (!staleConfirmed) {
+        return { action: 'await-confirm', relinquish: false, reason: 'stale-not-yet-confirmed' };
+    }
+    // The poll LOOP itself is wedged (not even attempting) → relinquish unconditionally;
+    // a wedged holder serves nothing and HOLD cannot be justified.
+    if (!pollAttemptedFresh) {
+        return { action: 'relinquish-wedged', relinquish: true, reason: 'poll-loop-wedged-pollattempted-stale' };
+    }
+    // pollAttempted is fresh (alive + trying) but the channel/serve is stale. Only a
+    // POSITIVE peer confirmation that the outage is shared justifies HOLD; absent it,
+    // treat as LOCAL failure and relinquish (the safe direction — G2 picks a server).
+    if (peerConfirmsGlobalOutage) {
+        return { action: 'hold-global', relinquish: false, reason: 'global-outage-peer-confirmed-hold' };
+    }
+    return { action: 'relinquish', relinquish: true, reason: 'local-failure-relinquish-safe-direction' };
+}
+export class ZombieRelinquishLedger {
+    s = {
+        evaluations: 0, relinquishedLocal: 0, relinquishedWedged: 0, heldGlobal: 0,
+        healthy: 0, awaitConfirm: 0, firstAt: null, lastAt: null,
+    };
+    record(decision, nowIso) {
+        if (decision.action === 'not-applicable')
+            return; // a non-holder is a non-event
+        this.s.evaluations += 1;
+        switch (decision.action) {
+            case 'relinquish':
+                this.s.relinquishedLocal += 1;
+                break;
+            case 'relinquish-wedged':
+                this.s.relinquishedWedged += 1;
+                break;
+            case 'hold-global':
+                this.s.heldGlobal += 1;
+                break;
+            case 'healthy':
+                this.s.healthy += 1;
+                break;
+            case 'await-confirm':
+                this.s.awaitConfirm += 1;
+                break;
+        }
+        if (this.s.firstAt === null)
+            this.s.firstAt = nowIso;
+        this.s.lastAt = nowIso;
+    }
+    summary() {
+        return { ...this.s };
+    }
+}
+/** Process-wide shared G1 ledger (mirrors sharedG2NobodyPollingLedger). */
+export const sharedG1ZombieRelinquishLedger = new ZombieRelinquishLedger();
+//# sourceMappingURL=zombieRelinquish.js.map

package/dist/core/zombieRelinquish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zombieRelinquish.js","sourceRoot":"","sources":["../../src/core/zombieRelinquish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkDH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA4B;IACjE,MAAM,EACJ,UAAU,EAAE,iBAAiB,EAAE,OAAO,EACtC,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,EAC5D,cAAc,EAAE,wBAAwB,GACzC,GAAG,KAAK,CAAC;IAEV,8EAA8E;IAC9E,sDAAsD;IACtD,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACzF,CAAC;IAED,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAC7G,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC3F,CAAC;IAED,qFAAqF;IACrF,+DAA+D;IAC/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC3G,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;AACvG,CAAC;AAiBD,MAAM,OAAO,sBAAsB;IACzB,CAAC,GAAkC;QACzC,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAC1E,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;KACzD,CAAC;IAEF,MAAM,CAAC,QAAkC,EAAE,MAAc;QACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB;YAAE,OAAO,CAAC,8BAA8B;QAChF,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACxB,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,YAAY;gBAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC;gBAAC,MAAM;YACxD,KAAK,mBAAmB;gBAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC;gBAAC,MAAM;YAChE,KAAK,aAAa;gBAAE,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;gBAAC,MAAM;YAClD,KAAK,SAAS;gBAAE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;gBAAC,MAAM;YAC3C,KAAK,eAAe;gBAAE,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;gBAAC,MAAM;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACvB,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.690",
+  "version": "1.3.692",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-28T09:16:28.110Z",
-  "instarVersion": "1.3.690",
+  "generatedAt": "2026-06-28T10:05:54.303Z",
+  "instarVersion": "1.3.692",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -1618,7 +1618,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "7920e0bbe7f86ae0e4b5a2f39c6ef2e0272c3e90f1d8dccf11ced30d8bbcc76a",
+      "contentHash": "db0a3a53e3b3fc6d8c9593918944cba27c1faccd5a369d71bf1e555cf20bb028",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.691.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G2 enforce** (MESH-SELF-HEAL-SPEC §3.2) — the take-over actuation for the nobody-serving alarm. When NO machine is polling Telegram (the zombie-lease-holder state behind the message-drop incidents), exactly ONE fit machine now takes over poll-ownership — never zero (drops), never two (the Telegram 409 poll-war).
+
+- `src/core/nobodyPollingActuator.ts` (`applyNobodyPollingRecovery`) — dependency-injected actuator: win the fenced epoch-CAS → re-verify own poll-freshness (CAS-win is necessary-not-sufficient) → start polling, else relinquish + self-exclude.
+- `MultiMachineCoordinator.evaluateNobodyPolling()` — wires the detector + single-claimant election to the actuator with the real lease ports (`acquireIfEligible` / `currentEpoch` / `writeLeasePollIntent` / `relinquishAndBroadcast`), debounced (confirm=3) and reentrancy-guarded.
+- `server.ts` `refreshPool` — runs it on the existing 30s pool cadence, fire-and-forget.
+
+Ships **dark + dryRun-first** (`multiMachine.nobodyPollingRecovery`, OMITS `enabled` → dev-gated). In dryRun it detects + elects + records the soak counterfactual but performs ZERO side effects (no lease acquire, no poll-lever write) — verified by an independent second-pass review (the high-risk lease-authority gate). Flipping `dryRun:false` is the deliberate enforce promotion, gated on two tracked prerequisites: the real pollSucceeded watermark + the peer-confirmed global-outage plumbing (see MESH-SELF-HEAL-G2-BUILD.md).
+
+## What to Tell Your User
+
+When this is turned on (it ships off, in observe-only mode for now), it fixes the "nobody is polling, so my messages silently drop" problem on multi-machine setups: if the in-charge machine goes quiet, exactly one healthy machine automatically takes over polling — no tug-of-war, no duplicates, no action needed from you. Single-machine setups are unaffected.
+
+## Summary of New Capabilities
+
+- `multiMachine.nobodyPollingRecovery` `{ dryRun }` — opt-in (dev-gated) nobody-polling take-over: detect → elect one machine → acquire the fenced lease → start polling. Dark + dryRun by default (observe-only; zero side effects until a deliberate enforce promotion).
+
+## Evidence
+
+- `tests/unit/nobodyPollingActuator.test.ts` — 5 tests, both sides of every boundary incl. the critical dryRun=zero-side-effects safety invariant (no CAS, no poll-write) and CAS-lost / self-excluded / claimed-serving.
+- Builds on the merged G2 core (18 unit) + observe route (4 integration). Dark-gate lint golden map updated for the +7 line shift. Typecheck clean; full G2 suite green.
+- Independent Phase-5 second-pass review: CONCUR (dryRun invariant holds; single-claimant is the fenced CAS; no tug-of-war). Its one minor concern (reentrancy guard) was fixed in this commit.

package/upgrades/1.3.692.md

@@ -0,0 +1,25 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G1 — core decision logic** (increment 1 of the lease↔job binding, MESH-SELF-HEAL-SPEC §3.1). Adds `src/core/zombieRelinquish.ts`: the PURE, deterministic decision for the deepest fix — the "in charge" lease currently means two things at once ("I'm the coordinator" AND "I'm actually serving you"), and conflating them is what let a machine hold the badge while serving nothing. G1 binds them: an active holder that has stopped doing the JOB must relinquish.
+
+- `decideZombieRelinquish` — three-signal liveness (pollAttempted / pollSucceeded / serveProgressed, all machine-local, about the machine ITSELF): `not-applicable` for a non-active-holder; `healthy`; `await-confirm` (debounced); `relinquish-wedged` (poll loop dead → unconditional); `hold-global` (only on POSITIVE peer evidence the outage is shared — "can't hear a peer" ≠ global); `relinquish` (confirmed LOCAL failure → safe direction, G2 backstops). Pending work keys on serve-progress; idle keys on poll-success.
+- `ZombieRelinquishLedger` — evaluable soak evidence (mirrors G2/G3).
+
+Pure decision logic, NOT yet wired — ZERO runtime effect until the next increment (the three-signal watermark plumbing incl. the new `state/serve-progress.json` record + the tickLease holder-branch wiring + F3 relinquish actuation) consumes it.
+
+## What to Tell Your User
+
+Nothing changes yet — inert internal decision logic for the deepest part of the multi-machine self-heal, not active anywhere. When the full feature lands, a machine that holds the "in charge" badge but has quietly stopped fetching/serving your messages will automatically hand the badge off (instead of sitting on it while messages drop) — and exactly one healthy machine takes over. No action needed.
+
+## Summary of New Capabilities
+
+- None user-facing in this increment. New internal module `src/core/zombieRelinquish.ts` (pure decision core) consumed by a later wiring increment; no route, config flag, or runtime surface added yet.
+
+## Evidence
+
+- `tests/unit/zombieRelinquish.test.ts` — 11 unit tests covering both sides of every branch: not-a-holder / observe-only → not-applicable; healthy (pending→serve, idle→poll); await-confirm; relinquish-wedged; hold-global (peer-confirmed); relinquish (no peer evidence = safe direction); fetched-and-dropped zombie; ledger accounting. Typecheck clean.

package/upgrades/side-effects/mesh-self-heal-g1-core.md

@@ -0,0 +1,32 @@
+# Side-Effects Review — Mesh Self-Heal G1 (core decision logic)
+
+**Change:** The PURE decision core of G1 (lease↔job binding via a three-signal liveness model) from MESH-SELF-HEAL-SPEC §3.1 — `src/core/zombieRelinquish.ts` (`decideZombieRelinquish` + `ZombieRelinquishLedger`) + 11 unit tests. This is increment 1 of G1: the decision only. It is NOT YET WIRED to any tick, watermark plumbing, or actuation — ZERO runtime effect until a later increment consumes it.
+
+**Decision point?** The module encodes a decision (is an active holder a zombie that must relinquish?), but nothing CALLS it yet, so there is no live decision-point in this increment. Signal-vs-authority assessed (Q4).
+
+## 1. Over-block
+N/A — unwired. By design it biases AGAINST relinquishing: `not-applicable` for a non-active-holder; `healthy` when the relevant signal is fresh; `await-confirm` until the staleness persists across N ticks. It only relinquishes on a CONFIRMED zombie.
+
+## 2. Under-block
+As pure logic, none in-scope. The KNOWN not-yet-built pieces (tracked, not orphan-deferred — see MESH-SELF-HEAL-G2-BUILD.md / spec §3.1): the three-signal watermark plumbing (`pollAttempted/SucceededMonoMs` from `lifeline-poll-active.json`; `serveProgressedMonoMs` in a NEW single-writer `state/serve-progress.json` with a boot-epoch fence), the `lastFetched>lastServed` pending counters, the per-tick debounce, the positive-peer-evidence global-outage signal, and the tickLease holder-branch wiring + F3 `relinquishAndBroadcast` actuation (with the tombstone-nonce quiesce). Until those land, this module is inert.
+
+## 3. Level-of-abstraction fit
+Correct. A pure decision module mirroring `nobodyPollingRecovery.ts` (G2) / `leaseGatedSpawn.ts` (G3) — no I/O, fully unit-testable, consumed by a thin wiring layer later. It encodes the spec's exact rule: pending → serveProgressed signal, idle → pollSucceeded signal; wedged poll loop → unconditional relinquish; "can't hear a peer" ≠ global (only positive peer evidence HOLDs).
+
+## 4. Signal vs authority compliance
+COMPLIANT. Pure function, no I/O, no authority. The actual authority (`relinquishAndBroadcast` — a signed tombstone) lives in the lease coordinator, which the future wiring calls; this module only DECIDES. The decision keys ONLY on machine-local signals about the machine ITSELF (never a peer-observed value driving a relinquish; finding Sec-F1) — the structural defense against a skew/partition-induced false relinquish.
+
+## 5. Interactions
+None in this increment (unwired). Intended (wiring increment): reads the lifeline-actual truth (FD10) + the new serve-progress record; the relinquish runs F3's path; it composes with G2 (a relinquished holder lets G2's single-claimant pick a server) and G3 (the lease it binds is the same fence G3's spawn gate reads).
+
+## 6. External surfaces
+None yet. No route, config flag, or watermark write in this increment — pure logic. The exported `sharedG1ZombieRelinquishLedger` singleton mirrors the G2/G3 ledgers; written/read only once the wiring lands.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS the deepest cross-machine coherence fix — binding "holds the lease" to "actually serving" so a zombie holder self-relinquishes. The three watermarks are machine-local, never replicated (Sca-F1), evaluated by each machine about ITSELF (skew-immune — no foreign-monotonic subtraction). The decision is local; coherence emerges because a zombie relinquishes and G2's fenced single-claimant picks the successor.
+
+## 8. Rollback cost
+Trivial — revert the commit. Unreferenced by any runtime path, so removing it cannot affect a running agent. No config, no migration, no state.
+
+## Second-pass review
+Not triggered for this increment (unwired pure logic, no live decision-point / block-allow authority / session-lifecycle touch). The Phase-5 second-pass IS required for the WIRING increment (it consumes lease-relinquish authority + adds cross-process watermark plumbing) and is flagged for that increment.

package/upgrades/side-effects/mesh-self-heal-g2-enforce.md

@@ -0,0 +1,38 @@
+# Side-Effects Review — Mesh Self-Heal G2 (enforce actuation)
+
+**Change:** The ENFORCE half of G2 (MESH-SELF-HEAL-SPEC §3.2) — actually taking over poll-ownership when nobody is polling. HIGH-RISK: it holds cross-machine poll-ownership authority (the area whose hasty version caused the 2026-06-27 tug-of-war). Pieces:
+- `src/core/nobodyPollingActuator.ts` (`applyNobodyPollingRecovery`) — dependency-injected actuator: dryRun gate → `acquireFencedCas` → `decidePostCasSelfReverify` → `startPolling` / `relinquishAndSelfExclude`. 5 unit tests.
+- `MultiMachineCoordinator.evaluateNobodyPolling()` — the wiring: gate (`nobodyPollingRecoveryCfg`) → B5 verdict → debounce (`_g2SilenceStreak`, confirm=3) → `decideNobodyPollingClaim` → record → actuate (real ports: `leaseCoordinator.acquireIfEligible` / `currentEpoch` / `writeLeasePollIntent(true)` / `relinquishAndBroadcast`). Reentrancy-guarded (`_g2Evaluating`).
+- `server.ts` `refreshPool` — the 30s cadence (fire-and-forget, gated inside the coordinator).
+- `ConfigDefaults`: `multiMachine.nobodyPollingRecovery: { dryRun: true }` (OMITS `enabled` → dev-gated). Dark-gate lint golden map updated (+7 line shift).
+
+**Decision point?** YES — it acquires the fenced lease + starts polling. Signal-vs-authority + the dryRun safety invariant are the load-bearing concerns.
+
+## 1. Over-block
+N/A (it grants poll-ownership, never blocks). It biases hard against acting: only a confirmed real silence where this machine is the deterministic single claimant AND wins the fenced CAS AND re-verifies its own poll-freshness ever serves.
+
+## 2. Under-block
+Ships dark+dryRun (default), so nothing actuates until a deliberate `dryRun:false`. **Enforce-ENABLE prerequisites (TRACKED, not orphan-deferred — see MESH-SELF-HEAL-G2-BUILD.md + the enforce note below):** (1) the real `pollSucceededMonoMs`/serve-progress watermark for `localPollSucceededFresh` (currently a lifeline-liveness approximation — consulted ONLY when dryRun:false); (2) peer-confirmed `globalOutageEvidence` plumbing (currently hard-coded false → a confirmed silence proceeds to elect, the local-failure-safe direction). Both are inert under dryRun.
+
+## 3. Level-of-abstraction fit
+The authority lives in the coordinator (it owns the leaseCoordinator); the server only supplies the cadence + capacities. The actuator isolates the delicate flow behind injected ports (testable without a live coordinator; the dryRun gate is a single chokepoint). Reuses `acquireIfEligible` (the SAME fence `tickLease` uses) — not a parallel acquire path.
+
+## 4. Signal vs authority compliance
+COMPLIANT with the safety design: the only authority (acquire CAS + start polling) is exercised through the ports ONLY when `dryRun:false` AND the decision is a genuine self-claim. The election is deterministic + machine-agnostic, but it is NOT the authority — the **fenced CAS is the single-claimant gate** (even if two machines diverge on the election under partition, `acquireIfEligible` admits exactly one; the loser gets `cas-lost` and stands down). `decidePostCasSelfReverify` enforces "CAS-win necessary-not-sufficient."
+
+## 5. Interactions
+- vs `tickLease`: a won CAS makes this machine the holder → `tickLease`'s non-holder acquire converges (doesn't fight); a successful claim flips the verdict to `ok` (self-terminating). Debounce + post-CAS reverify damp flap.
+- Reentrancy: `_g2Evaluating` prevents a >30s eval overlapping the 30s cadence (which would inflate the silence streak pre-await). Added per the 2nd-pass review.
+- Cadence: fire-and-forget with `.catch()` — a slow/failed eval never blocks or fails `refreshPool`.
+
+## 6. External surfaces
+No new route (the observe `/mesh-selfheal/g2` from the prior PR reads the same ledger). New config path `multiMachine.nobodyPollingRecovery` (dev-gated). When `dryRun:false` it WRITES the lease (poll-ownership) — the reason this is dark-first + 2nd-pass-gated.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS the cross-machine recovery actuator. Coherence is the deterministic election + the fenced CAS (one winner, pool-wide). The watermarks it reads are machine-local (skew-immune). Single-machine = strict no-op (no leaseCoordinator/peers → `skipped`).
+
+## 8. Rollback cost
+Trivial — ships dark+dryRun (strict no-op until a deliberate enable). Revert the commit, or leave the flag off. No migration, no state. Even enabled-in-dryRun performs zero side effects.
+
+## Second-Pass Review (REQUIRED — high-risk: lease/poll-ownership authority)
+An independent reviewer audited the actuator + coordinator method + cadence. **Verdict: CONCUR.** Verified: (a) the dryRun invariant HOLDS — the gate sits strictly before every port call; default `dryRun:true` (`?? true`) + dev-gated dark-on-fleet; test pins zero side-effects; (b) single-claimant is genuinely the fenced CAS, not the election guess — a partition divergence still admits exactly one (loser → `cas-lost`); (c) no tug-of-war — the won CAS converges with `tickLease`, debounce + self-reverify damp flap; (d) fail directions correct, hardcoded `globalOutageEvidence:false` is the documented local-safe direction + inert under dryRun. **One concern raised (minor, non-blocking given dark+dryRun): no reentrancy guard** on `evaluateNobodyPolling` — a >30s eval could overlap the 30s tick and inflate `_g2SilenceStreak`. **RESOLVED in this commit** (added `_g2Evaluating` guard, mirroring `leaseTicking`). The reviewer's two enforce-ENABLE prerequisites (the pollSucceeded watermark; the globalOutageEvidence plumbing) are tracked in MESH-SELF-HEAL-G2-BUILD.md as the gate before `dryRun:false`.