instar 1.3.709 → 1.3.711

package/dist/core/ropeProbeContract.js

@@ -0,0 +1,92 @@
+/**
+ * ropeProbeContract — the U4.3 recovery probe's payload + typed-response contract
+ * (docs/specs/u4-3-breaker-recovery-probe.md §2 "Probe success is the exact typed
+ * contract, never any-2xx").
+ *
+ * The probe reuses the G4 delivery-canary PAYLOAD contract: a signed, bogus-uid
+ * `deliverMessage` MeshRpc command the peer answers with a TYPED refusal per its
+ * role — `not-router` (403, RBAC: we are not the lease holder in the peer's view)
+ * or `sender-rejected` (200 ack, the peer's sender re-validation refused the
+ * bogus uid). Either typed refusal PROVES the whole path: transport connect +
+ * signed envelope verified + the peer's real dispatcher answered. A malformed,
+ * untyped, or unsigned 2xx (captive portal, wrong server) is a FAILURE.
+ *
+ * `parseProbeResponse` is the REGISTERED parser (Scrape/Parser Fixture Realness):
+ * it consumes the RAW response body bytes + HTTP status, and its tests feed it
+ * captured byte-for-byte fixtures of real /mesh/rpc responses (see
+ * tests/fixtures/captured/mesh-rpc-probe-responses/ + SCRAPE_PARSERS in
+ * scripts/lint-scrape-fixture-realness.js).
+ */
+/**
+ * A deliberately-unresolvable sender uid (no Telegram uid is ever this value and
+ * the users registry can never contain it) — the "bogus uid" of the G4 canary
+ * payload contract. The peer's sender re-validation refuses it with the typed
+ * `sender-rejected` ack; it can never inject a real message.
+ */
+export const ROPE_PROBE_BOGUS_UID = 999_999_999_999;
+/** The session-key prefix — non-numeric BY DESIGN so no topic-shaped consumer
+ *  (working-set trigger, spawn bridge — both `Number(session)`-gated) can ever
+ *  act on a probe, and the SenderRejectionNoticer's user-topic exclusion holds. */
+export const ROPE_PROBE_SESSION_PREFIX = 'rope-probe:';
+/**
+ * Build the probe command. `ownershipEpoch: 0` + an unknown session means the
+ * stale-ownership fence passes through to sender re-validation (ownerEpochOf on
+ * an unknown session is null), so the answer is deterministic per role.
+ */
+export function buildRopeProbeCommand(selfMachineId, nonce) {
+    return {
+        type: 'deliverMessage',
+        session: `${ROPE_PROBE_SESSION_PREFIX}${selfMachineId}`,
+        messageId: `rope-probe:${selfMachineId}:${nonce}`,
+        payload: { probe: 'rope-recovery', note: 'signed bogus-uid canary — expect a typed refusal' },
+        ownershipEpoch: 0,
+        // The §3.4 sender re-validation envelope — the bogus uid the peer refuses.
+        senderEnvelope: { userId: ROPE_PROBE_BOGUS_UID },
+    };
+}
+/**
+ * Classify a raw /mesh/rpc probe response (REGISTERED parser — fed captured
+ * byte-for-byte fixtures in tests). Success is the EXACT typed contract:
+ *   - 403 with dispatcher reason `not-router` (peer refused our non-router send), OR
+ *   - 200 ack `{ result: { accepted: 'sender-rejected' } }` (peer's sender
+ *     re-validation refused the bogus uid).
+ * EVERYTHING else — an untyped 2xx, a malformed body, an unsigned/unknown-sender
+ * rejection, or an unexpected acceptance — records as FAILURE.
+ */
+export function parseProbeResponse(rawBody, status) {
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        // @silent-fallback-ok: an unparseable probe response IS the classification
+        // (malformed ⇒ failure) — the verdict carries it; nothing is swallowed.
+        return { typedSuccess: false, classification: 'malformed' };
+    }
+    const obj = (body && typeof body === 'object' ? body : {});
+    if (status === 200) {
+        const accepted = obj.result && typeof obj.result === 'object' ? obj.result.accepted : undefined;
+        if (obj.ok === true && accepted === 'sender-rejected') {
+            return { typedSuccess: true, classification: 'ack-sender-rejected', detail: 'sender-rejected' };
+        }
+        if (obj.ok === true && typeof accepted === 'string') {
+            // A typed ack that ACCEPTED the bogus probe (queued/duplicate/stale-ownership)
+            // is NOT the contract — e.g. a peer whose degenerate registry failed toward
+            // delivery. Recorded as failure (the strict any-2xx-never-closes rule).
+            return { typedSuccess: false, classification: 'accepted-not-refused', detail: accepted };
+        }
+        return { typedSuccess: false, classification: 'untyped-2xx' };
+    }
+    if (status >= 200 && status < 300) {
+        return { typedSuccess: false, classification: 'untyped-2xx' };
+    }
+    const reason = typeof obj.reason === 'string' ? obj.reason : undefined;
+    if (status === 403 && reason === 'not-router') {
+        return { typedSuccess: true, classification: 'refused-not-router', detail: reason };
+    }
+    if (status === 401) {
+        return { typedSuccess: false, classification: 'auth-rejected', detail: reason };
+    }
+    return { typedSuccess: false, classification: 'http-error', detail: reason ?? `status-${status}` };
+}
+//# sourceMappingURL=ropeProbeContract.js.map

package/dist/core/ropeProbeContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ropeProbeContract.js","sourceRoot":"","sources":["../../src/core/ropeProbeContract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAEpD;;mFAEmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,KAAa;IACxE,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,GAAG,yBAAyB,GAAG,aAAa,EAAE;QACvD,SAAS,EAAE,cAAc,aAAa,IAAI,KAAK,EAAE;QACjD,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,kDAAkD,EAAE;QAC7F,cAAc,EAAE,CAAC;QACjB,2EAA2E;QAC3E,cAAc,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;KAClC,CAAC;AACnB,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAc;IAChE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,wEAAwE;QACxE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAIxD,CAAC;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACtD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAClG,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpD,+EAA+E;YAC/E,4EAA4E;YAC5E,wEAAwE;YACxE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC9C,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,UAAU,MAAM,EAAE,EAAE,CAAC;AACrG,CAAC"}

package/dist/core/tailscaleStatusParser.d.ts

@@ -0,0 +1,46 @@
+/**
+ * tailscaleStatusParser — U4.5's SECOND declared data source (R-r2-3): the
+ * Tailscale key-expiry tier reads a bounded exec of `tailscale status --json`
+ * (docs/specs/u4-5-rope-health-alerts.md §2). Key expiry is NOT in the U4.3
+ * resolver snapshot (the resolver never sees it), so it has its OWN parser.
+ *
+ * CONTENT-SCRUB BOUNDARY (spec §2 "Content scrub is a hard rule"): the raw
+ * tailscale JSON carries IPs, DNS names, tailnet names, account emails and
+ * public keys. NONE of that leaves this parser — the return shape carries key
+ * EXPIRY TIMES and role labels ONLY. Alert/digest text downstream is composed
+ * exclusively from this scrubbed shape.
+ *
+ * `parseTailscaleStatus` is a REGISTERED parser (Scrape/Parser Fixture
+ * Realness): its tests feed it captured byte-for-byte fixtures of real
+ * `tailscale status --json` output (tests/fixtures/captured/tailscale-status/
+ * + SCRAPE_PARSERS in scripts/lint-scrape-fixture-realness.js).
+ */
+/** One scrubbed key-expiry entry. `role` is the ONLY identity that survives. */
+export interface TailscaleKeyExpiryEntry {
+    role: 'self' | 'peer';
+    /** ISO-8601 expiry, or null when the node has no expiring key (e.g. expiry disabled). */
+    keyExpiryIso: string | null;
+}
+export interface TailscaleStatusParse {
+    /** False ⇒ the body did not parse as the expected tailscale status JSON. */
+    parsed: boolean;
+    /** Scrubbed entries (self first, then peers in object order). Empty when !parsed. */
+    entries: TailscaleKeyExpiryEntry[];
+}
+/**
+ * Parse raw `tailscale status --json` stdout into the scrubbed key-expiry
+ * shape. Tolerant of absent fields (a node without KeyExpiry yields null);
+ * a malformed body yields `{ parsed: false, entries: [] }` — the expiry tier
+ * is then silently absent for that pass (never an error state, spec R-r2-3).
+ */
+export declare function parseTailscaleStatus(rawBody: string): TailscaleStatusParse;
+/**
+ * The days-until-soonest-expiry summary the monitor's degraded tier consumes.
+ * Returns null when no entry carries an expiry.
+ */
+export declare function soonestKeyExpiry(parse: TailscaleStatusParse, nowMs: number): {
+    role: 'self' | 'peer';
+    expiresAtIso: string;
+    inDays: number;
+} | null;
+//# sourceMappingURL=tailscaleStatusParser.d.ts.map

package/dist/core/tailscaleStatusParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscaleStatusParser.d.ts","sourceRoot":"","sources":["../../src/core/tailscaleStatusParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,OAAO,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CAiC1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,MAAM,GACZ;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYxE"}

package/dist/core/tailscaleStatusParser.js

@@ -0,0 +1,80 @@
+/**
+ * tailscaleStatusParser — U4.5's SECOND declared data source (R-r2-3): the
+ * Tailscale key-expiry tier reads a bounded exec of `tailscale status --json`
+ * (docs/specs/u4-5-rope-health-alerts.md §2). Key expiry is NOT in the U4.3
+ * resolver snapshot (the resolver never sees it), so it has its OWN parser.
+ *
+ * CONTENT-SCRUB BOUNDARY (spec §2 "Content scrub is a hard rule"): the raw
+ * tailscale JSON carries IPs, DNS names, tailnet names, account emails and
+ * public keys. NONE of that leaves this parser — the return shape carries key
+ * EXPIRY TIMES and role labels ONLY. Alert/digest text downstream is composed
+ * exclusively from this scrubbed shape.
+ *
+ * `parseTailscaleStatus` is a REGISTERED parser (Scrape/Parser Fixture
+ * Realness): its tests feed it captured byte-for-byte fixtures of real
+ * `tailscale status --json` output (tests/fixtures/captured/tailscale-status/
+ * + SCRAPE_PARSERS in scripts/lint-scrape-fixture-realness.js).
+ */
+/**
+ * Parse raw `tailscale status --json` stdout into the scrubbed key-expiry
+ * shape. Tolerant of absent fields (a node without KeyExpiry yields null);
+ * a malformed body yields `{ parsed: false, entries: [] }` — the expiry tier
+ * is then silently absent for that pass (never an error state, spec R-r2-3).
+ */
+export function parseTailscaleStatus(rawBody) {
+    let body;
+    try {
+        body = JSON.parse(rawBody);
+    }
+    catch {
+        // @silent-fallback-ok: an unparseable status IS the classification (the
+        // expiry tier is absent this pass) — the verdict carries it; nothing hidden.
+        return { parsed: false, entries: [] };
+    }
+    if (!body || typeof body !== 'object')
+        return { parsed: false, entries: [] };
+    const obj = body;
+    // Minimal shape check: real tailscale status JSON always carries BackendState.
+    // A captive portal / wrong-command JSON body without it is NOT the contract.
+    if (typeof obj.BackendState !== 'string')
+        return { parsed: false, entries: [] };
+    const entries = [];
+    const expiryOf = (node) => {
+        if (!node || typeof node !== 'object')
+            return null;
+        const raw = node.KeyExpiry;
+        if (typeof raw !== 'string')
+            return null;
+        const t = Date.parse(raw);
+        return Number.isFinite(t) ? new Date(t).toISOString() : null;
+    };
+    if (obj.Self && typeof obj.Self === 'object') {
+        entries.push({ role: 'self', keyExpiryIso: expiryOf(obj.Self) });
+    }
+    if (obj.Peer && typeof obj.Peer === 'object') {
+        for (const peer of Object.values(obj.Peer)) {
+            entries.push({ role: 'peer', keyExpiryIso: expiryOf(peer) });
+        }
+    }
+    return { parsed: true, entries };
+}
+/**
+ * The days-until-soonest-expiry summary the monitor's degraded tier consumes.
+ * Returns null when no entry carries an expiry.
+ */
+export function soonestKeyExpiry(parse, nowMs) {
+    let best = null;
+    for (const e of parse.entries) {
+        if (!e.keyExpiryIso)
+            continue;
+        const t = Date.parse(e.keyExpiryIso);
+        if (!Number.isFinite(t))
+            continue;
+        const inDays = (t - nowMs) / 86_400_000;
+        if (!best || inDays < best.inDays) {
+            best = { role: e.role, expiresAtIso: e.keyExpiryIso, inDays };
+        }
+    }
+    return best;
+}
+//# sourceMappingURL=tailscaleStatusParser.js.map

package/dist/core/tailscaleStatusParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscaleStatusParser.js","sourceRoot":"","sources":["../../src/core/tailscaleStatusParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,6EAA6E;QAC7E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAkE,CAAC;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEhF,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAiB,EAAE;QAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,GAAI,IAAgC,CAAC,SAAS,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAA+B,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,KAAa;IAEb,IAAI,IAAI,GAA2E,IAAI,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/types.d.ts

@@ -2092,6 +2092,25 @@ export interface MeshTransportConfig {
     maxProbeBackoffMs?: number;
     /** Bind host override (Decision 17). Default: '0.0.0.0' when enabled else '127.0.0.1'. */
     bindHost?: string;
+    /**
+     * Recovery-probe master switch. DELIBERATELY OMITTED from ConfigDefaults so the
+     * developmentAgent gate resolves it (live-on-dev in dry-run day one, dark on
+     * the fleet) — see DEV_GATED_FEATURES `ropeRecoveryProbe`.
+     */
+    recoveryProbeEnabled?: boolean;
+    /** Dry-run SENDS real probes (harmless typed-refusal contract) and logs
+     *  would-close verdicts but never mutates the HealthRecord. Default true. */
+    recoveryProbeDryRun?: boolean;
+    /** P19 floor cadence for a permanently-dead / slow-but-alive rope. Default 900000 (15 min). */
+    recoveryProbeFloorMs?: number;
+    /** Consecutive probe failures before the exhaustion transition + escalate-once. Default 20. */
+    recoveryProbeExhaustAttempts?: number;
+    /** A probe-close→re-death inside this window counts as a probe failure for backoff. Default 600000. */
+    recoveryProbeReopenEpisodeWindowMs?: number;
+    /** Mid-recovery episode cadence (never the resolver's trivially-true ~5s). Default 45000. */
+    recoveryProbeMidIntervalMs?: number;
+    /** Consecutive successful probes WITHOUT lastKnownGood reclaim before floor cadence. Default 20. */
+    recoveryProbeMaxUnreclaimedSuccesses?: number;
 }
 export interface MultiMachineConfig {
     /** Whether multi-machine is enabled */
@@ -4288,6 +4307,43 @@ export interface MonitoringConfig {
         /** Self-heal line on a live respawn (default true). */
         notifyUser?: boolean;
     };
+    /**
+     * U4.5 — Rope-Health Alerts (docs/specs/u4-5-rope-health-alerts.md). The
+     * in-server RopeHealthMonitor: its own bounded 30s evaluation loop over the
+     * U4.3 PeerEndpointResolver.snapshot() seam, deterministic sleep-aware
+     * classification (ok / degraded / peer-offline / urgent), episode-deduped
+     * HIGH partition alerts, Tailscale key-expiry warnings, and the
+     * GET /mesh/rope-health read surface the rope-health-digest job consumes.
+     *
+     * `enabled` is DELIBERATELY OPTIONAL (dev-gate convention): omitted from
+     * ConfigDefaults so resolveDevAgentGate decides — LIVE on a development
+     * agent day one, DARK on the fleet (the route 503s, no timer exists).
+     */
+    ropeHealth?: {
+        /** Dev-gate convention: omit to let resolveDevAgentGate decide. */
+        enabled?: boolean;
+        /** Urgent (HIGH-alert) tier master — rides the same dev gate (default: true). */
+        urgentEnabled?: boolean;
+        /** Time-pinned flap filter on the all-down condition (default: 60000). */
+        urgentDebounceMs?: number;
+        /** Continuous health required before an episode ends (default: 600000). */
+        clearSustainMs?: number;
+        /** Tailscale key expiry warning horizon in days (default: 14). */
+        keyExpiryWarnDays?: number;
+        /**
+         * Telegram topic id the rope-health-digest job delivers to (mirrors the
+         * burnDetection.alertTopicId precedent — R-r2-8). Default UNSET: the digest
+         * job LOGS only; the operator sets their hub topic id to get delivery.
+         */
+        digestTopicId?: number;
+        /**
+         * HARD CAP on self-wake urgent suppression (default: 300000). Bounded per
+         * docs/audits/multi-machine-seamless-ux-audit-2026-07.md finding P1-A7:
+         * SleepWakeDetector can emit FALSE wake events (event-loop stalls misread
+         * as sleeps), so a "recently slept" signal is a short grace, never a veto.
+         */
+        wakeGraceMaxMs?: number;
+    };
     /**
      * AutonomousProgressHeartbeat — a hedged, change-gated, sparse liveness
      * BACKSTOP that posts ONE purely-observational line when an autonomous run