instar 1.3.704 → 1.3.705

package/dist/core/registryHighWater.js

@@ -0,0 +1,120 @@
+/**
+ * Registry high-water marker + degenerate-state classification
+ * (silent-loss-refusal-conservation §2.D — "Verify the State, Not Its Symbol" +
+ * "Cross-Store Coherence Is an Invariant").
+ *
+ * The 2026-07-01 silent-loss root cause: a machine's `users.json` was a fixture-
+ * clobbered / emptied store, and sender re-validation armed against it and
+ * rejected EVERYONE (including the operator). The fix (§2.D) refuses to arm
+ * against a degenerate registry — but a FRESH install writes `users.json` as `[]`,
+ * byte-identical to an EMPTIED-by-deletion store. A durable "this registry has
+ * held a real user before" high-water marker disambiguates them:
+ *
+ *   - never-populated `[]` (no high-water)  → DEGENERATE → fail toward DELIVERY.
+ *   - emptied-by-deletion `[]` (high-water) → POPULATED  → keep REJECTING + shout.
+ *   - parse-failure / corrupt / partial     → UNKNOWN_UNSAFE → fail CLOSED (reject).
+ *
+ * High-water is MONOTONIC (never cleared on user removal) and machine-local — it
+ * shares `users.json`'s FS trust boundary (flipping it in the dangerous direction
+ * needs the same local FS access as clobbering users.json itself), so it needs no
+ * separate integrity envelope (§2.D at-rest honesty).
+ *
+ * Pure + dependency-free (fs only): the arm decision reads the RAW file bytes so it
+ * can see states the in-memory UserManager (post fixture-refusal) has already
+ * dropped. Callers stat-gate the read (§2.D per-call arm decision).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** The durable high-water marker path (machine-local, shares users.json trust boundary). */
+export function registryHighWaterPath(stateDir) {
+    return path.join(stateDir, 'state', 'registry-high-water.json');
+}
+/** Has this machine's authoritative local registry EVER held a resolvable real user? */
+export function readRegistryHighWater(stateDir) {
+    try {
+        const raw = fs.readFileSync(registryHighWaterPath(stateDir), 'utf-8');
+        const obj = JSON.parse(raw);
+        return obj?.everPopulated === true;
+    }
+    catch {
+        // @silent-fallback-ok: a high-water read fault → treat as never-populated,
+        // which classifies an empty registry as degenerate → DELIVER (fail toward
+        // delivery), the safe direction for the silent-loss class this fixes.
+        return false;
+    }
+}
+/**
+ * Set the high-water marker (monotonic; idempotent). Called on every path that
+ * introduces a real (non-fixture) user into the authoritative local `users.json`
+ * — an API/CLI register + a non-fixture initialUsers merge + the §4 boot back-fill.
+ * NEVER set from WS2.6 replication-in (advisory, does not enter users.json).
+ * Returns true iff it wrote (was previously unset).
+ */
+export function setRegistryHighWater(stateDir, reason) {
+    if (readRegistryHighWater(stateDir))
+        return false;
+    const p = registryHighWaterPath(stateDir);
+    try {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        const tmp = `${p}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify({ everPopulated: true, setAt: new Date().toISOString(), reason }, null, 2));
+        fs.renameSync(tmp, p);
+        return true;
+    }
+    catch {
+        // @silent-fallback-ok: best-effort marker write; a write fault just means the
+        // marker isn't set yet — it is retried on the next real-user register, and an
+        // unset marker fails TOWARD delivery (never a silent reject).
+        return false;
+    }
+}
+/**
+ * Classify the raw on-disk registry state for the sender-re-validation arm
+ * decision (§2.D taxonomy). Reads the RAW file (never the in-memory manager) so
+ * it sees emptied / corrupt states the manager may have masked.
+ *
+ * Taxonomy (decision 5):
+ *   - clean ENOENT + NO high-water            → degenerate (deliver — a fresh install).
+ *   - valid `[]` + NO high-water              → degenerate (deliver).
+ *   - valid `[]` + high-water                 → populated (emptied locally → keep rejecting + HIGH alert).
+ *   - ENOENT/missing + high-water             → unknown-unsafe (had users, file vanished → fail closed).
+ *   - valid non-empty array                   → populated (arm normally).
+ *   - parse-failure / non-array / partial     → unknown-unsafe (corruption/tampering → fail closed).
+ */
+export function classifyRegistry(usersFilePath, stateDir) {
+    const highWater = readRegistryHighWater(stateDir);
+    let raw;
+    try {
+        raw = fs.readFileSync(usersFilePath, 'utf-8');
+    }
+    catch (err) {
+        // ENOENT (never created) → clean degenerate UNLESS high-water evidence exists.
+        if (err?.code === 'ENOENT') {
+            return highWater
+                ? { klass: 'unknown-unsafe', detail: 'users.json missing but high-water present (store vanished)', rawUserCount: 0 }
+                : { klass: 'degenerate', detail: 'users.json absent (fresh install)', rawUserCount: 0 };
+        }
+        // A non-ENOENT read error (permissions, transient lock) is NOT "never
+        // populated" — never silently open delivery. Fail closed.
+        return { klass: 'unknown-unsafe', detail: `users.json unreadable: ${err?.message ?? 'error'}`, rawUserCount: 0 };
+    }
+    // A raw-non-empty file that will not parse is corruption / a partial write /
+    // tampering — NOT "never populated". Fail CLOSED (§2.D UNKNOWN_UNSAFE).
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { klass: 'unknown-unsafe', detail: 'users.json parse-failure (corrupt/partial-write)', rawUserCount: 0 };
+    }
+    if (!Array.isArray(parsed)) {
+        return { klass: 'unknown-unsafe', detail: 'users.json is not a JSON array (schema mismatch)', rawUserCount: 0 };
+    }
+    if (parsed.length === 0) {
+        return highWater
+            ? { klass: 'populated', detail: 'users.json is [] with high-water (emptied by deletion)', rawUserCount: 0 }
+            : { klass: 'degenerate', detail: 'users.json is [] with no high-water (never populated)', rawUserCount: 0 };
+    }
+    return { klass: 'populated', detail: `users.json has ${parsed.length} user entr${parsed.length === 1 ? 'y' : 'ies'}`, rawUserCount: parsed.length };
+}
+//# sourceMappingURL=registryHighWater.js.map

package/dist/core/registryHighWater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryHighWater.js","sourceRoot":"","sources":["../../src/core/registryHighWater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4FAA4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;AAClE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,CAAC;QAC3D,OAAO,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAAc;IACnE,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACtC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,8EAA8E;QAC9E,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB,EAAE,QAAgB;IACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+EAA+E;QAC/E,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,4DAA4D,EAAE,YAAY,EAAE,CAAC,EAAE;gBACpH,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,mCAAmC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,sEAAsE;QACtE,0DAA0D;QAC1D,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,0BAA2B,GAAa,EAAE,OAAO,IAAI,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC9H,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,kDAAkD,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,kDAAkD,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS;YACd,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,wDAAwD,EAAE,YAAY,EAAE,CAAC,EAAE;YAC3G,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,uDAAuD,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACtJ,CAAC"}

package/dist/core/senderRejectionNotice.d.ts

@@ -0,0 +1,89 @@
+/**
+ * SenderRejectionNoticer (silent-loss-refusal-conservation §2.C — the
+ * deterministic, UNIFIED loss notice on the refusing path).
+ *
+ * When the router yields a first-class `rejected` outcome for a USER-originated
+ * message (the owner re-validated the sender and refused), the ingress machine
+ * must TELL the user — the parent principle "A Refusal Stays a Refusal" demands
+ * every rejection be conserved through a notice, never left to a log line the
+ * operator might miss. This helper is the single funnel BOTH the live consumer
+ * (Telegram / Slack) and the queue-drain loss path route through, keyed on ONE
+ * canonical cause (`sender-deauthorized`), so the two paths can never emit two
+ * differently-worded notices.
+ *
+ * Properties (all injected → unit-testable, deterministic on a fake clock):
+ *   - Neutral FIXED wording, no topology leak, no resend invitation (§2.C).
+ *   - Durable per-messageId dedupe (the ledger `markRejected` marker seam) so a
+ *     replay produces ONE notice; a secondary in-memory 30-min (topic,cause) window.
+ *   - Cross-topic ceiling: >3 distinct topics for one (peer,cause) in a window →
+ *     suppress per-topic notices, emit ONE aggregated hub alert (deduped).
+ *   - Flapping-proof decay: per-(peer,cause) re-notice cadence decays 30m→2h→6h on
+ *     time-since-first-observed, and only resets after a SUSTAINED clear window.
+ *   - Sender-side divergence signal: local-resolves + remote-rejects → ONE deduped
+ *     advisory coherence alert (feeds G1; never auto-remediation).
+ *
+ * Fire-and-forget: the send seams swallow their own errors; a notice failure
+ * never throws into the router/drain.
+ */
+/** The canonical cause the live path and the drain path unify on. */
+export declare const SENDER_DEAUTHORIZED_CAUSE: "sender-deauthorized";
+/** The neutral fixed template (§2.C) — no architecture, no "registry out of sync",
+ *  no resend invitation, no multi-machine topology. */
+export declare const SENDER_DEAUTHORIZED_NOTICE: string;
+export declare const CROSS_TOPIC_CEILING = 3;
+export declare const NOTICE_WINDOW_MS: number;
+/** Flapping-proof re-notice decay steps (time-since-first-observed). */
+export declare const DECAY_STEPS_MS: readonly [number, number, number];
+/** Sustained-clear window before the decay step resets (≥ the longest step). */
+export declare const SUSTAINED_CLEAR_MS: number;
+export interface SenderRejectionEvent {
+    /** 'telegram' → topicId is a numeric topic; 'slack' → slackKey routes in-thread. */
+    adapter: 'telegram' | 'slack';
+    topicId?: number;
+    slackKey?: string;
+    /** The rejected message's id — the durable dedupe key. */
+    messageId: string;
+    /** The rejected sender's platform uid (for the divergence probe). */
+    senderUid?: number;
+    /** Peer that decided the rejection (for the (peer,cause) ceiling/decay). */
+    peer?: string;
+}
+export interface SenderRejectionNoticerDeps {
+    /** Send the neutral notice to a Telegram topic (fire-and-forget). */
+    sendTelegram: (topicId: number, text: string) => void;
+    /** Send the neutral notice in a Slack thread (fire-and-forget). Optional. */
+    sendSlack?: (slackKey: string, text: string) => void;
+    /** Raise ONE aggregated alert to the operator hub (ceiling breach + divergence). */
+    alertHub: (title: string, body: string) => void;
+    /**
+     * Durable per-messageId dedupe marker (the ledger `markRejected` seam). Returns
+     * true iff THIS call first-marked the message rejected (so fire the notice);
+     * false → already marked (a replay) → skip. When absent, dedupe falls back to
+     * the in-memory window only.
+     */
+    markRejectedDurable?: (messageId: string) => boolean;
+    /** Ingress-side registry probe for the divergence signal: does the rejected uid
+     *  resolve on OUR (cached) registry? local-resolves + remote-rejects = divergence. */
+    resolvesLocally?: (uid: number) => boolean;
+    now?: () => number;
+}
+export declare class SenderRejectionNoticer {
+    private readonly d;
+    private readonly now;
+    /** Per-(peer,cause) episode state (machine-local, in-memory; re-arms on lease flip). */
+    private readonly causeState;
+    /** In-memory secondary dedupe: (topic|cause) → lastNoticeAt (30-min window). */
+    private readonly topicWindow;
+    /** Divergence-alert dedupe: peer → lastAlertAt. */
+    private readonly divergenceAlerted;
+    constructor(deps: SenderRejectionNoticerDeps);
+    /**
+     * Handle a first-class `rejected` outcome. Idempotent per messageId (durable);
+     * enforces the cross-topic ceiling + flapping decay; raises the divergence
+     * signal. Never throws.
+     */
+    onRejected(evt: SenderRejectionEvent): void;
+    private onRejectedInner;
+    private emit;
+}
+//# sourceMappingURL=senderRejectionNotice.d.ts.map

package/dist/core/senderRejectionNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"senderRejectionNotice.d.ts","sourceRoot":"","sources":["../../src/core/senderRejectionNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE;uDACuD;AACvD,eAAO,MAAM,0BAA0B,QAEc,CAAC;AAEtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAC/C,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAoE,CAAC;AAChG,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAA4C,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,oFAAoF;IACpF,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD;0FACsF;IACtF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAeD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;gBAEnD,IAAI,EAAE,0BAA0B;IAK5C;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,oBAAoB,GAAG,IAAI;IAQ3C,OAAO,CAAC,eAAe;IAqFvB,OAAO,CAAC,IAAI;CAOb"}

package/dist/core/senderRejectionNotice.js

@@ -0,0 +1,149 @@
+/**
+ * SenderRejectionNoticer (silent-loss-refusal-conservation §2.C — the
+ * deterministic, UNIFIED loss notice on the refusing path).
+ *
+ * When the router yields a first-class `rejected` outcome for a USER-originated
+ * message (the owner re-validated the sender and refused), the ingress machine
+ * must TELL the user — the parent principle "A Refusal Stays a Refusal" demands
+ * every rejection be conserved through a notice, never left to a log line the
+ * operator might miss. This helper is the single funnel BOTH the live consumer
+ * (Telegram / Slack) and the queue-drain loss path route through, keyed on ONE
+ * canonical cause (`sender-deauthorized`), so the two paths can never emit two
+ * differently-worded notices.
+ *
+ * Properties (all injected → unit-testable, deterministic on a fake clock):
+ *   - Neutral FIXED wording, no topology leak, no resend invitation (§2.C).
+ *   - Durable per-messageId dedupe (the ledger `markRejected` marker seam) so a
+ *     replay produces ONE notice; a secondary in-memory 30-min (topic,cause) window.
+ *   - Cross-topic ceiling: >3 distinct topics for one (peer,cause) in a window →
+ *     suppress per-topic notices, emit ONE aggregated hub alert (deduped).
+ *   - Flapping-proof decay: per-(peer,cause) re-notice cadence decays 30m→2h→6h on
+ *     time-since-first-observed, and only resets after a SUSTAINED clear window.
+ *   - Sender-side divergence signal: local-resolves + remote-rejects → ONE deduped
+ *     advisory coherence alert (feeds G1; never auto-remediation).
+ *
+ * Fire-and-forget: the send seams swallow their own errors; a notice failure
+ * never throws into the router/drain.
+ */
+/** The canonical cause the live path and the drain path unify on. */
+export const SENDER_DEAUTHORIZED_CAUSE = 'sender-deauthorized';
+/** The neutral fixed template (§2.C) — no architecture, no "registry out of sync",
+ *  no resend invitation, no multi-machine topology. */
+export const SENDER_DEAUTHORIZED_NOTICE = "I got your message but couldn't confirm you as an approved sender, so it wasn't delivered. " +
+    "I've logged the details so this can be diagnosed.";
+export const CROSS_TOPIC_CEILING = 3;
+export const NOTICE_WINDOW_MS = 30 * 60 * 1000; // 30-min secondary window
+/** Flapping-proof re-notice decay steps (time-since-first-observed). */
+export const DECAY_STEPS_MS = [30 * 60 * 1000, 2 * 60 * 60 * 1000, 6 * 60 * 60 * 1000];
+/** Sustained-clear window before the decay step resets (≥ the longest step). */
+export const SUSTAINED_CLEAR_MS = DECAY_STEPS_MS[DECAY_STEPS_MS.length - 1];
+export class SenderRejectionNoticer {
+    d;
+    now;
+    /** Per-(peer,cause) episode state (machine-local, in-memory; re-arms on lease flip). */
+    causeState = new Map();
+    /** In-memory secondary dedupe: (topic|cause) → lastNoticeAt (30-min window). */
+    topicWindow = new Map();
+    /** Divergence-alert dedupe: peer → lastAlertAt. */
+    divergenceAlerted = new Map();
+    constructor(deps) {
+        this.d = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    /**
+     * Handle a first-class `rejected` outcome. Idempotent per messageId (durable);
+     * enforces the cross-topic ceiling + flapping decay; raises the divergence
+     * signal. Never throws.
+     */
+    onRejected(evt) {
+        try {
+            this.onRejectedInner(evt);
+        }
+        catch {
+            /* fire-and-forget: a notice fault must never propagate into routing */
+        }
+    }
+    onRejectedInner(evt) {
+        const nowMs = this.now();
+        const cause = SENDER_DEAUTHORIZED_CAUSE;
+        const peer = evt.peer ?? 'unknown';
+        const topicKey = evt.adapter === 'telegram' ? (evt.topicId ?? 'tg?') : (evt.slackKey ?? 'slack?');
+        // Durable per-messageId dedupe (the ledger marker). A replay of the SAME
+        // rejected message must produce ZERO additional notices.
+        if (this.d.markRejectedDurable && !this.d.markRejectedDurable(evt.messageId)) {
+            return; // already noticed for this message (durable) → nothing more to do.
+        }
+        // Divergence signal (advisory, feeds G1) — probe our OWN registry.
+        if (evt.senderUid != null && this.d.resolvesLocally) {
+            try {
+                if (this.d.resolvesLocally(evt.senderUid)) {
+                    const last = this.divergenceAlerted.get(peer) ?? -Infinity;
+                    if (nowMs - last >= NOTICE_WINDOW_MS) {
+                        this.divergenceAlerted.set(peer, nowMs);
+                        this.d.alertHub('Sender-registry divergence', `A sender resolves on THIS machine but was rejected by "${peer}" — the peer's user registry may be degenerate or a deauthorization is still replicating. Advisory only (feeds the coherence audit); no auto-remediation.`);
+                    }
+                }
+            }
+            catch { /* @silent-fallback-ok: divergence probe is best-effort — an advisory coherence signal only, never gates the notice */ }
+        }
+        // (peer,cause) episode bookkeeping (cross-topic ceiling + flapping decay).
+        const causeKey = `${peer}|${cause}`;
+        let st = this.causeState.get(causeKey);
+        if (st) {
+            // Sustained-clear reset: if the cause has been silent ≥ the longest decay
+            // step, this is a fresh episode — re-arm the fast cadence.
+            if (nowMs - st.lastObservedAt >= SUSTAINED_CLEAR_MS) {
+                st = undefined;
+                this.causeState.delete(causeKey);
+            }
+        }
+        if (!st) {
+            st = { firstObservedAt: nowMs, lastNoticeAt: -Infinity, topics: new Map(), ceilingAlerted: false, lastObservedAt: nowMs };
+            this.causeState.set(causeKey, st);
+        }
+        st.lastObservedAt = nowMs;
+        // Prune + record the distinct topic within the rolling window.
+        for (const [k, seen] of st.topics) {
+            if (nowMs - seen > NOTICE_WINDOW_MS)
+                st.topics.delete(k);
+        }
+        st.topics.set(topicKey, nowMs);
+        // Cross-topic ceiling: >3 distinct topics for one (peer,cause) → suppress
+        // per-topic notices, emit ONE aggregated hub alert.
+        if (st.topics.size > CROSS_TOPIC_CEILING) {
+            if (!st.ceilingAlerted) {
+                st.ceilingAlerted = true;
+                this.d.alertHub('Sender rejections across many topics', `"${peer}" is rejecting senders across ${st.topics.size} topics (cause: ${cause}). Per-topic notices are suppressed to avoid a flood; check the peer's user registry health.`);
+            }
+            return; // ceiling breached — no per-topic notice.
+        }
+        // Flapping-proof decay cadence (time-since-first-observed). A short recovery
+        // does NOT re-arm the fast cadence (only the sustained-clear reset above does).
+        const ageMs = nowMs - st.firstObservedAt;
+        let step = DECAY_STEPS_MS[0];
+        if (ageMs >= DECAY_STEPS_MS[1])
+            step = DECAY_STEPS_MS[2];
+        else if (ageMs >= DECAY_STEPS_MS[0])
+            step = DECAY_STEPS_MS[1];
+        // Secondary in-memory (topic,cause) window bound.
+        const windowKey = `${topicKey}|${cause}`;
+        const lastForTopic = this.topicWindow.get(windowKey) ?? -Infinity;
+        // Emit unless within the current decay step for this (peer,cause) AND within
+        // the secondary (topic,cause) window.
+        if (nowMs - st.lastNoticeAt < step && nowMs - lastForTopic < NOTICE_WINDOW_MS) {
+            return;
+        }
+        st.lastNoticeAt = nowMs;
+        this.topicWindow.set(windowKey, nowMs);
+        this.emit(evt);
+    }
+    emit(evt) {
+        if (evt.adapter === 'telegram' && evt.topicId != null) {
+            this.d.sendTelegram(evt.topicId, SENDER_DEAUTHORIZED_NOTICE);
+        }
+        else if (evt.adapter === 'slack' && evt.slackKey && this.d.sendSlack) {
+            this.d.sendSlack(evt.slackKey, SENDER_DEAUTHORIZED_NOTICE);
+        }
+    }
+}
+//# sourceMappingURL=senderRejectionNotice.js.map

package/dist/core/senderRejectionNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"senderRejectionNotice.js","sourceRoot":"","sources":["../../src/core/senderRejectionNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAA8B,CAAC;AAExE;uDACuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GACrC,6FAA6F;IAC7F,mDAAmD,CAAC;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,0BAA0B;AAC1E,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAU,CAAC;AAChG,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAgD5E,MAAM,OAAO,sBAAsB;IAChB,CAAC,CAA6B;IAC9B,GAAG,CAAe;IACnC,wFAAwF;IACvE,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5D,gFAAgF;IAC/D,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD,mDAAmD;IAClC,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/D,YAAY,IAAgC;QAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,GAAyB;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAyB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,yBAAyB,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;QAElG,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7E,OAAO,CAAC,mEAAmE;QAC7E,CAAC;QAED,mEAAmE;QACnE,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC3D,IAAI,KAAK,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAC;wBACrC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACxC,IAAI,CAAC,CAAC,CAAC,QAAQ,CACb,4BAA4B,EAC5B,0DAA0D,IAAI,2JAA2J,CAC1N,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,sHAAsH,CAAC,CAAC;QACpI,CAAC;QAED,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,EAAE,EAAE,CAAC;YACP,0EAA0E;YAC1E,2DAA2D;YAC3D,IAAI,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,kBAAkB,EAAE,CAAC;gBACpD,EAAE,GAAG,SAAS,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAC1H,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,EAAE,CAAC,cAAc,GAAG,KAAK,CAAC;QAE1B,+DAA+D;QAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,IAAI,GAAG,gBAAgB;gBAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE/B,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC;gBACvB,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,CAAC,CAAC,QAAQ,CACb,sCAAsC,EACtC,IAAI,IAAI,iCAAiC,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,KAAK,8FAA8F,CAC9K,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,0CAA0C;QACpD,CAAC;QAED,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,KAAK,GAAG,KAAK,GAAG,EAAE,CAAC,eAAe,CAAC;QACzC,IAAI,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;aACpD,IAAI,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAE9D,kDAAkD;QAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClE,6EAA6E;QAC7E,sCAAsC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC,YAAY,GAAG,IAAI,IAAI,KAAK,GAAG,YAAY,GAAG,gBAAgB,EAAE,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,EAAE,CAAC,YAAY,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAEO,IAAI,CAAC,GAAyB;QACpC,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACvE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF"}

package/dist/core/senderValidationGate.d.ts

@@ -0,0 +1,80 @@
+/**
+ * SenderValidationGate (silent-loss-refusal-conservation §2.D — the wiring-time
+ * registry gate + per-call re-arm).
+ *
+ * The 2026-07-01 incident: sender re-validation armed UNCONDITIONALLY against a
+ * degenerate `users.json` and rejected EVERYONE (including the operator). This
+ * gate re-decides arm/disarm PER MESSAGE (a restored registry re-arms with no
+ * restart) by probing REAL registry state — never a config flag ("Verify the
+ * State, Not Its Symbol"):
+ *
+ *   - degenerate (never-populated / clean-ENOENT / valid-`[]`-no-high-water) →
+ *     DISARM → fail toward DELIVERY (a fresh install must let the operator's first
+ *     message through) + a rate-limited loud log + a deduped alert.
+ *   - unknown-unsafe (parse-failure / corrupt / partial-write / high-water-but-
+ *     unreadable) → ARM but fail CLOSED: keep rejecting unresolved senders + HIGH
+ *     alert. The operator still passes via the LOCAL topic-operator binding (KYP).
+ *   - populated → the PRIMARY arm decision is the OPERATOR-RESOLUTION store-HEALTH
+ *     probe: if the CURRENT topic's LOCALLY-bound operator uid does NOT resolve in
+ *     the registry, DISARM + HIGH alert (the incident's exact signature). Else arm
+ *     and resolve the actual sender.
+ *
+ * The registry read is stat-gated on `(mtimeMs, size)` so repeated messages under
+ * a degenerate broadcast collapse to O(1) while a restored registry re-arms within
+ * one write. Pure logic + injected I/O → both sides of every boundary are testable.
+ */
+import { type RegistryClass } from './registryHighWater.js';
+export type SenderVerdict = 'deliver' | 'reject';
+export interface SenderValidationDecision {
+    verdict: SenderVerdict;
+    /** armed=false means re-validation was skipped (fail toward delivery). */
+    armed: boolean;
+    klass: RegistryClass;
+    reason: string;
+}
+export interface SenderValidationGateDeps {
+    usersFilePath: string;
+    stateDir: string;
+    /** stat (mtimeMs,size) of users.json for the classify cache; null on ENOENT/error. */
+    statUsers: () => {
+        mtimeMs: number;
+        size: number;
+    } | null;
+    /** Does this uid resolve in THIS machine's authoritative registry? (read-only.) */
+    resolveUid: (uid: number) => boolean;
+    /** The CURRENT topic's LOCALLY-bound (authenticated) operator uid, or null. Reads
+     *  the local topic-operator binding ONLY — never a WS2.6 replicated record. */
+    operatorUidForTopic: (session: string) => number | null;
+    /** Deduped/rate-limited alert sink (once-per-boot + 24h per cause handled here). */
+    alert: (level: 'HIGH' | 'INFO', cause: string, message: string) => void;
+    /** Loud log sink (the gate applies its own 1/min-per-cause throttle). */
+    log: (line: string) => void;
+    now?: () => number;
+    /** For tests: override the classifier (default reads the raw file + high-water). */
+    classify?: () => {
+        klass: RegistryClass;
+        detail: string;
+        rawUserCount: number;
+    };
+}
+export declare class SenderValidationGate {
+    private readonly d;
+    private readonly now;
+    private cachedStat;
+    private cachedClass;
+    private readonly logThrottle;
+    private readonly alertDedupe;
+    constructor(deps: SenderValidationGateDeps);
+    private classifyStatGated;
+    private throttledLog;
+    private dedupedAlert;
+    /**
+     * Per-call arm + resolve decision for a forwarded sender envelope. `deliver`
+     * means the sender re-validation ALLOWS the message (armed+resolved, or
+     * disarmed); `reject` means a first-class refusal (→ `sender-rejected` NACK →
+     * §2.A rejected outcome → §2.C notice — the refusal is conserved).
+     */
+    decide(uid: number, session: string): SenderValidationDecision;
+    private safeOperatorUid;
+}
+//# sourceMappingURL=senderValidationGate.d.ts.map

package/dist/core/senderValidationGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"senderValidationGate.d.ts","sourceRoot":"","sources":["../../src/core/senderValidationGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE9E,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,aAAa,CAAC;IACvB,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1D,mFAAmF;IACnF,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;mFAC+E;IAC/E,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxD,oFAAoF;IACpF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAKD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA2B;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,UAAU,CAAmE;IACrF,OAAO,CAAC,WAAW,CAA+E;IAClG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE7C,IAAI,EAAE,wBAAwB;IAK1C,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,wBAAwB;IAoD9D,OAAO,CAAC,eAAe;CAWxB"}

package/dist/core/senderValidationGate.js

@@ -0,0 +1,133 @@
+/**
+ * SenderValidationGate (silent-loss-refusal-conservation §2.D — the wiring-time
+ * registry gate + per-call re-arm).
+ *
+ * The 2026-07-01 incident: sender re-validation armed UNCONDITIONALLY against a
+ * degenerate `users.json` and rejected EVERYONE (including the operator). This
+ * gate re-decides arm/disarm PER MESSAGE (a restored registry re-arms with no
+ * restart) by probing REAL registry state — never a config flag ("Verify the
+ * State, Not Its Symbol"):
+ *
+ *   - degenerate (never-populated / clean-ENOENT / valid-`[]`-no-high-water) →
+ *     DISARM → fail toward DELIVERY (a fresh install must let the operator's first
+ *     message through) + a rate-limited loud log + a deduped alert.
+ *   - unknown-unsafe (parse-failure / corrupt / partial-write / high-water-but-
+ *     unreadable) → ARM but fail CLOSED: keep rejecting unresolved senders + HIGH
+ *     alert. The operator still passes via the LOCAL topic-operator binding (KYP).
+ *   - populated → the PRIMARY arm decision is the OPERATOR-RESOLUTION store-HEALTH
+ *     probe: if the CURRENT topic's LOCALLY-bound operator uid does NOT resolve in
+ *     the registry, DISARM + HIGH alert (the incident's exact signature). Else arm
+ *     and resolve the actual sender.
+ *
+ * The registry read is stat-gated on `(mtimeMs, size)` so repeated messages under
+ * a degenerate broadcast collapse to O(1) while a restored registry re-arms within
+ * one write. Pure logic + injected I/O → both sides of every boundary are testable.
+ */
+import { classifyRegistry } from './registryHighWater.js';
+const DEGENERATE_LOG_THROTTLE_MS = 60 * 1000; // 1/min per cause
+const ALERT_DEDUPE_MS = 24 * 60 * 60 * 1000; // once-per-boot + 24h per cause
+export class SenderValidationGate {
+    d;
+    now;
+    cachedStat = undefined;
+    cachedClass = null;
+    logThrottle = new Map();
+    alertDedupe = new Map();
+    constructor(deps) {
+        this.d = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    classifyStatGated() {
+        const stat = this.d.statUsers();
+        // Re-classify only when (mtimeMs,size) changed vs the cached read.
+        const unchanged = this.cachedClass !== null &&
+            ((stat === null && this.cachedStat === null) ||
+                (stat !== null && this.cachedStat != null && stat.mtimeMs === this.cachedStat.mtimeMs && stat.size === this.cachedStat.size));
+        if (unchanged)
+            return this.cachedClass;
+        const c = this.d.classify
+            ? this.d.classify()
+            : classifyRegistry(this.d.usersFilePath, this.d.stateDir);
+        this.cachedStat = stat;
+        this.cachedClass = c;
+        return c;
+    }
+    throttledLog(cause, line) {
+        const nowMs = this.now();
+        const last = this.logThrottle.get(cause) ?? -Infinity;
+        if (nowMs - last >= DEGENERATE_LOG_THROTTLE_MS) {
+            this.logThrottle.set(cause, nowMs);
+            this.d.log(line);
+        }
+    }
+    dedupedAlert(level, cause, message) {
+        const nowMs = this.now();
+        const last = this.alertDedupe.get(cause) ?? -Infinity;
+        if (nowMs - last >= ALERT_DEDUPE_MS) {
+            this.alertDedupe.set(cause, nowMs);
+            this.d.alert(level, cause, message);
+        }
+    }
+    /**
+     * Per-call arm + resolve decision for a forwarded sender envelope. `deliver`
+     * means the sender re-validation ALLOWS the message (armed+resolved, or
+     * disarmed); `reject` means a first-class refusal (→ `sender-rejected` NACK →
+     * §2.A rejected outcome → §2.C notice — the refusal is conserved).
+     */
+    decide(uid, session) {
+        // A non-numeric / zero uid cannot be re-validated on the Telegram path — fail
+        // toward delivery (Slack sender re-validation is tracked-followup 4).
+        if (!Number.isFinite(uid) || uid === 0) {
+            return { verdict: 'deliver', armed: false, klass: 'populated', reason: 'no-numeric-uid' };
+        }
+        let c;
+        try {
+            c = this.classifyStatGated();
+        }
+        catch {
+            // A classifier fault is NOT "never populated" — fail CLOSED conservatively,
+            // but still honor the local operator binding (KYP).
+            c = { klass: 'unknown-unsafe', detail: 'classifier-error', rawUserCount: 0 };
+        }
+        if (c.klass === 'degenerate') {
+            this.throttledLog('registry-degenerate', `[sender-validation] registry DEGENERATE (${c.detail}) — DISARMING sender re-validation (fail toward delivery). ${session}`);
+            this.dedupedAlert('INFO', 'registry-degenerate', `Sender re-validation is DISARMED because this machine's user registry is degenerate (${c.detail}). Messages are delivered without sender re-validation until a real user is registered. This is expected on a fresh install; if it is not, the registry may have been emptied — check the registration path and logs/mesh-rejections.jsonl.`);
+            return { verdict: 'deliver', armed: false, klass: c.klass, reason: `degenerate:${c.detail}` };
+        }
+        const opUid = this.safeOperatorUid(session);
+        if (c.klass === 'unknown-unsafe') {
+            this.dedupedAlert('HIGH', 'registry-unknown-unsafe', `This machine's user registry is UNPARSEABLE/corrupt (${c.detail}). Sender re-validation is failing CLOSED (rejecting unresolved senders) to avoid trusting a tampered store; the locally-bound operator still passes. Repair the registry — do NOT delete it.`);
+            // Operator passes via the LOCAL binding even when the registry can't be
+            // parsed (KYP) — the incident's operator must never be locked out.
+            if (opUid != null && uid === opUid) {
+                return { verdict: 'deliver', armed: true, klass: c.klass, reason: 'unknown-unsafe:operator-via-binding' };
+            }
+            if (this.d.resolveUid(uid)) {
+                return { verdict: 'deliver', armed: true, klass: c.klass, reason: 'unknown-unsafe:resolved' };
+            }
+            return { verdict: 'reject', armed: true, klass: c.klass, reason: 'unknown-unsafe:unresolved' };
+        }
+        // populated — PRIMARY arm: the operator-resolution store-HEALTH probe.
+        if (opUid != null && !this.d.resolveUid(opUid)) {
+            this.dedupedAlert('HIGH', 'operator-unresolvable', `The verified operator bound to a topic on this machine no longer resolves in the user registry (uid ${opUid}). Sender re-validation is DISARMED (fail toward reachability) so the operator is never silently locked out — this is the exact 2026-07-01 silent-loss signature. Check the user registration path.`);
+            return { verdict: 'deliver', armed: false, klass: c.klass, reason: 'operator-unresolvable-disarm' };
+        }
+        // Armed + healthy: resolve the actual sender against the real registry.
+        return this.d.resolveUid(uid)
+            ? { verdict: 'deliver', armed: true, klass: c.klass, reason: 'populated:resolved' }
+            : { verdict: 'reject', armed: true, klass: c.klass, reason: 'populated:unresolved' };
+    }
+    safeOperatorUid(session) {
+        try {
+            const v = this.d.operatorUidForTopic(session);
+            return v != null && Number.isFinite(v) && v !== 0 ? v : null;
+        }
+        catch {
+            // @silent-fallback-ok: an operator-resolution fault → null → the gate
+            // declines to arm against a populated registry (fails toward delivery +
+            // alerts), never a silent reject of the operator.
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=senderValidationGate.js.map

package/dist/core/senderValidationGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"senderValidationGate.js","sourceRoot":"","sources":["../../src/core/senderValidationGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,gBAAgB,EAAsB,MAAM,wBAAwB,CAAC;AA+B9E,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kBAAkB;AAChE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,gCAAgC;AAE7E,MAAM,OAAO,oBAAoB;IACd,CAAC,CAA2B;IAC5B,GAAG,CAAe;IAC3B,UAAU,GAAyD,SAAS,CAAC;IAC7E,WAAW,GAA0E,IAAI,CAAC;IACjF,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzD,YAAY,IAA8B;QACxC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAEO,iBAAiB;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChC,mEAAmE;QACnE,MAAM,SAAS,GACb,IAAI,CAAC,WAAW,KAAK,IAAI;YACzB,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;gBAC1C,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAClI,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,WAAY,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ;YACvB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;YACnB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,IAAY;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,KAAK,GAAG,IAAI,IAAI,0BAA0B,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAsB,EAAE,KAAa,EAAE,OAAe;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,KAAK,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW,EAAE,OAAe;QACjC,8EAA8E;QAC9E,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC5F,CAAC;QAED,IAAI,CAAiE,CAAC;QACtE,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,oDAAoD;YACpD,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC,MAAM,8DAA8D,OAAO,EAAE,CAAC,CAAC;YACtK,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAC7C,wFAAwF,CAAC,CAAC,MAAM,6OAA6O,CAAC,CAAC;YACjV,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAChG,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,yBAAyB,EACjD,wDAAwD,CAAC,CAAC,MAAM,+LAA+L,CAAC,CAAC;YACnQ,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;YAC5G,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YAChG,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QACjG,CAAC;QAED,uEAAuE;QACvE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAC/C,uGAAuG,KAAK,qMAAqM,CAAC,CAAC;YACrT,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACtG,CAAC;QAED,wEAAwE;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE;YACnF,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACzF,CAAC;IAEO,eAAe,CAAC,OAAe;QACrC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,wEAAwE;YACxE,kDAAkD;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/core/types.d.ts

@@ -644,6 +644,18 @@ export interface UserProfile {
      * absent it is derived from `permissions`. See src/permissions/SlackPrincipalResolver.ts.
      */
     orgRole?: string;
+    /**
+     * Signed override allowing a profile that legitimately COLLIDES with a
+     * `TEST_IDENTITY_MARKERS` fixture id to persist + load (silent-loss-refusal-
+     * conservation §2.D). Minted only on a dashboard-PIN-authed request; the load
+     * path VERIFIES the HMAC (no PIN). On the WS2.6 field-clamp denylist — a
+     * legitimately-overridden fixture-collision profile does NOT replicate its
+     * marker (re-mint on the peer if it ever occurs). NOT a bare boolean.
+     */
+    allowTestIdentity?: {
+        marker: string;
+        sig: string;
+    };
 }
 export interface UserChannel {
     /** Channel type (telegram, slack, discord, email, etc.) */