instar 1.3.694 → 1.3.696

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.694",
+  "version": "1.3.696",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-28T10:37:09.930Z",
-  "instarVersion": "1.3.694",
+  "generatedAt": "2026-06-28T11:46:24.604Z",
+  "instarVersion": "1.3.696",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "f53b56a0023769d5746f77707be0cee1718f0574871c0c42d916c044b516c8af",
+      "contentHash": "e41424c2003a76d2538ff115cf9304afd47e5558e174619e641cdc066c2f3048",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1618,7 +1618,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "db0a3a53e3b3fc6d8c9593918944cba27c1faccd5a369d71bf1e555cf20bb028",
+      "contentHash": "287cd007cb05b3803cab57274aa2ba288444768c676923920f8feab1e81bb3db",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.695.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G1 — serve-progress dispatch-seam write** (wiring increment B1, MESH-SELF-HEAL-SPEC §3.1). Wires `writeServeProgress` into the `/internal/telegram-forward` handler — right after a fetched update is claimed for processing (past dedup-drop + sentinel-stop) — so the third liveness watermark (`serveProgressedMonoMs`) records REAL end-to-end serve progress instead of sitting unwritten.
+
+This makes the §3.1 third signal live: a machine that is actually serving fetched updates advances the watermark; a fetched-and-dropped zombie does not. Unconditional + best-effort (a write failure never affects routing); the watermark is still unread until the next increment (the relinquish evaluator).
+
+## What to Tell Your User
+
+Nothing changes in behavior — this is inert internal plumbing recording a health watermark (whether this machine is actually serving fetched messages) for the deepest multi-machine self-heal piece. No action needed.
+
+## Summary of New Capabilities
+
+- None user-facing. The serve-progress watermark (`state/serve-progress.json`) now records real data at the inbound dispatch seam; consumed by a later relinquish-evaluator increment.
+
+## Evidence
+
+- `tests/integration/serve-progress-dispatch-seam.test.ts` — drives the real `/internal/telegram-forward` handler and asserts `state/serve-progress.json` is written (with a monotonic stamp, bootId, serverPid) when the handler processes a fetched update. Typecheck clean.

package/upgrades/1.3.696.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Mesh Self-Heal **G1 zombie-relinquish evaluator** (the FINAL G1 piece, MESH-SELF-HEAL-SPEC §3.1). Wires `decideZombieRelinquish` into `MultiMachineCoordinator.tickLease()`'s holder branch via `evaluateZombieRelinquish()`: each tick, a lease-HOLDER reads its three machine-local liveness watermarks (poll-attempted / poll-succeeded / serve-progressed), debounces the relevant staleness (3 ticks), and — on a confirmed zombie — relinquishes the badge so a healthy machine takes over (via G2's single-claimant). This completes the lease↔job binding: holding the badge now requires actually doing the job.
+
+Ships **dark + dryRun-first** (`multiMachine.zombieRelinquish`, dev-gated): gate-off is a strict no-op; dryRun records "would relinquish" and performs NO actuation. Two independent gates (`enabled` + `dryRun`) protect the relinquish. A key correctness fix: the serve-progress watermark is read with the SAME boot id the dispatch seam wrote with (`getCurrentBootId()`), so the boot-epoch fence matches. Flipping `dryRun:false` (the enforce promotion) is gated on tracked refinements (the pending counters, peer global-outage evidence, the boot-id-null fallback reconciliation) + a live-verify on the real pair.
+
+## What to Tell Your User
+
+When this is turned on (it ships off, observe-only for now), it fixes the root cause behind the message-drop incidents: a machine that holds the "in charge" badge but has quietly stopped fetching/serving your messages will automatically hand the badge off — instead of sitting on it while messages drop — and a healthy machine takes over. No action needed; single-machine setups are unaffected.
+
+## Summary of New Capabilities
+
+- `multiMachine.zombieRelinquish` `{ dryRun }` — opt-in (dev-gated) zombie self-relinquish: a lease-holder that has stopped serving gives up the badge. Dark + dryRun by default (observe-only; zero actuation until a deliberate enforce promotion).
+
+## Evidence
+
+- Builds on the merged pure `decideZombieRelinquish` (11 unit tests) + `serveProgress` (6 unit tests) + the dispatch-seam write. Dark-gate lint golden map updated (+7); no-silent-fallbacks ratchet at baseline; typecheck clean; G1 unit suite green.
+- Independent Phase-5 second-pass review: **CONCUR** (dryRun safety guaranteed; the bootId-consistency fix correct; false-relinquish safe; no tick-wedge). One non-blocking enforce-enable note recorded.

package/upgrades/side-effects/mesh-self-heal-g1-dispatch-seam.md

@@ -0,0 +1,32 @@
+# Side-Effects Review — Mesh Self-Heal G1 (serve-progress dispatch-seam write)
+
+**Change:** Wires `writeServeProgress` into the `/internal/telegram-forward` handler (`src/server/routes.ts`) — right after the exactly-once ingress gate claims a fetched update for processing (past dedup-drop + sentinel-stop), so the serve-progress watermark records REAL end-to-end progress. + 1 integration (wiring) test. This makes the §3.1 third liveness signal live; the reader (the relinquish evaluator) is increment B2.
+
+**Decision point?** No — it WRITES an observability watermark; it gates/decides nothing. (Like `writePollActive`, unconditional + best-effort.)
+
+## 1. Over-block
+N/A — writes only, blocks nothing. Placed AFTER the dedup-drop + sentinel-stop returns, so a dropped duplicate / emergency-stop does NOT stamp serve-progress (correct — those aren't "serve progress").
+
+## 2. Under-block
+N/A. The watermark is unread until increment B2 (the relinquish evaluator). Stamping at the exactly-once-claim point means "the server committed to processing a fetched update" — the liveness B2 needs.
+
+## 3. Level-of-abstraction fit
+Correct seam: the telegram-forward handler is where lifeline-fetched updates arrive + are dispatched (the WS1.1 dispatch path for lifeline-owned-polling agents). The write reuses the merged `serveProgress.ts` module.
+
+## 4. Signal vs authority compliance
+COMPLIANT — pure observability write, no authority. It produces the serveProgressed SIGNAL; the relinquish decision (authority) is a separate, gated increment.
+
+## 5. Interactions
+Monotonic-MAX + machine-global → concurrent dispatch writes only advance (benign). Distinct file from `lifeline-poll-active.json` → no clobber. Best-effort try/catch (`@silent-fallback-ok`) → a write failure never affects routing. Boot-epoch-fenced at read time (the reader discards a prior-incarnation stamp).
+
+## 6. External surfaces
+Writes `state/serve-progress.json` on every processed inbound (local, same-uid, tiny, atomic — like `pollIntent`/`pollActive`). No route, no config, no user-visible change. Not flag-gated because it is pure observability plumbing (the consuming evaluator is the gated piece).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+Machine-local, never replicated — each machine stamps its OWN serve progress for its OWN future relinquish decision. The boot-epoch fence makes it survive-restart-safe.
+
+## 8. Rollback cost
+Trivial — revert the one block. The file is inert (unread until B2). No migration, no behavior change to serving.
+
+## Second-pass review
+Not triggered: an observability watermark write with no decision/authority/session-lifecycle effect (it stamps a liveness file; it does not gate, kill, or route differently). The Phase-5 second-pass IS required for increment B2 (the relinquish evaluator wired into the lease holder-branch + the F3 actuation).

package/upgrades/side-effects/mesh-self-heal-g1-evaluator.md

@@ -0,0 +1,33 @@
+# Side-Effects Review — Mesh Self-Heal G1 (zombie-relinquish evaluator)
+
+**Change:** The FINAL G1 piece (MESH-SELF-HEAL-SPEC §3.1) — `MultiMachineCoordinator.evaluateZombieRelinquish()` wired into `tickLease()`'s HOLDER branch (after renew). HIGH-RISK: it makes a holder GIVE UP the fenced awake-lease when its three machine-local liveness watermarks go stale. Ships DARK + dryRun-first behind `multiMachine.zombieRelinquish` (dev-gated). + `zombieRelinquishCfg()` gate, debounce (`_g1RelinquishStreak`, confirm=3), reentrancy guard (`_g1Evaluating`), ConfigDefaults block, dark-gate golden-map +7.
+
+**Decision point?** YES — relinquish authority. The dryRun safety invariant + the bootId-consistency fix are load-bearing.
+
+## 1. Over-block
+N/A (it relinquishes, never blocks). Biases against relinquishing: not-a-holder → skip; relevant signal fresh → healthy; stale → debounced 3 ticks; only a confirmed zombie relinquishes.
+
+## 2. Under-block
+Ships dark+dryRun → no actuation until a deliberate `dryRun:false`. **Enforce-ENABLE prerequisites (TRACKED):** (1) the `lastFetched>lastServed` `pending` counters (currently `pending=false` → keys on pollSucceeded; serveProgressedFresh is computed but inert until pending is wired); (2) positive-peer `globalOutageEvidence` (currently false → local-failure-safe direction); (3) the boot-id-null writer/reader fallback asymmetry (writer falls back to `boot-${pid}`, reader SKIPS on null — reconcile before flipping `pending` live; raised by the 2nd-pass). All inert under dryRun.
+
+## 3. Level-of-abstraction fit
+The authority (relinquishAndBroadcast) lives in the leaseCoordinator; the evaluator only decides + calls it. Mirrors `evaluateNobodyPolling`. Reads watermarks via the merged `serveProgress`/`pollIntent` modules.
+
+## 4. Signal vs authority compliance
+COMPLIANT: the only authority (relinquish) fires ONLY when `decision.relinquish && !dryRun`, double-gated (enabled + dryRun). The decision keys on machine-local-about-itself signals (Sec-F1) — never a peer value drives a relinquish.
+
+## 5. Interactions
+- **bootId consistency (the key correctness fix):** serve-progress is WRITTEN with `getCurrentBootId()` (routes.ts dispatch seam) and READ with `getCurrentBootId()` here — NOT `this.bootId` (a distinct `${pid}-${hrtime}`). Using `this.bootId` would always mismatch the boot-epoch fence → serve never fresh → false zombie. Confirmed correct by the 2nd-pass. `performance.now()` is the shared same-process clock for the freshness subtraction.
+- vs tickLease: runs AFTER renew+reconcile in the holder branch; relinquish (when enabled) hands off → next tick the machine is a non-holder → skip. Debounce + reentrancy guard prevent flap/overlap.
+
+## 6. External surfaces
+New config `multiMachine.zombieRelinquish` (dev-gated). When `dryRun:false` it WRITES the lease (relinquish) — the reason it ships dark + 2nd-pass-gated. Records to `sharedG1ZombieRelinquishLedger`.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+The deepest cross-machine fix: binds lease-holding to actually-serving. Machine-local watermarks (skew-immune); the relinquish lets G2's fenced single-claimant pick the successor. Single-machine = no leaseCoordinator → strict no-op.
+
+## 8. Rollback cost
+Trivial — ships dark+dryRun (strict no-op). Revert or leave the flag off. No migration.
+
+## Second-Pass Review (REQUIRED — high-risk: lease-relinquish authority)
+Independent reviewer: **CONCUR.** (a) dryRun safety GUARANTEED — relinquish reachable only under `!cfg.dryRun`, double-gated by `enabled` (dev-gate, false on fleet); shipped `dryRun ?? true`. (b) The bootId fix is CORRECT — reader uses `getCurrentBootId()` (same source as the writer), not `this.bootId`; `performance.now()` same clock domain. (c)/(d) False-relinquish safe — `pending=false` keys on pollSucceeded (serveProgressedFresh inert until enforce-enable); debounce + isActiveLeaseRole + null-bootId skip + no-poll-active→wedged-only-after-confirm; global-outage=false is the safe direction. (e) reentrancy guard + `.catch` + try/finally → can't wedge/double-fire. **One non-blocking note** (enforce-ENABLE prerequisite, NOT a merge blocker given dark+dryRun): the boot-id-null writer-fallback vs reader-skip asymmetry — reconcile before flipping `pending` live. Recorded in §2 above.