instar 1.3.728 → 1.3.730

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAi/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA68jBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAu/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2skBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -26,6 +26,7 @@ import { SpawningTopicsRegistry } from '../core/SpawningTopicsRegistry.js';
 import { TopicReachabilityVerifier } from '../monitoring/TopicReachabilityVerifier.js';
 import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstanceLock.js';
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
+import { resolveAntiThrashKnobs, readingValidity } from '../core/SwapAntiThrash.js';
 import { shouldReleaseOnComplete, planClaimOnSpawn, ownershipNonce } from '../core/ownershipFollowsLiveWork.js';
 import { PrHandLease } from '../core/PrHandLease.js';
 import { claimSuspensionExcludesPin } from '../core/TopicClaimAnnotationStore.js';
@@ -760,6 +761,12 @@ let _quotaAwareScheduler = null;
 // Subscription & Auth Standard P1.3 — pre-limit proactive swap monitor. Null
 // until wired (requires the scheduler; gated behind subscriptionPool.proactiveSwap).
 let _proactiveSwapMonitor = null;
+// swap-continuity-antithrash §3/§4 — the anti-thrash spine. The ledger + engine
+// load and hydrate UNCONDITIONALLY at boot (R4-L3: reactive rows append
+// regardless of antiThrash.enabled, so the index is warm at a mid-run flag
+// flip). Null only when construction itself failed (non-fatal).
+let _swapAntiThrashEngine = null;
+let _swapWorkGate = null;
 async function spawnSessionForTopic(sessionManager, telegram, sessionName, topicId, latestMessage, topicMemory, userProfile, precomputedContext, 
 /** Subscription & Auth Standard P1.3 (additive): launch under this account's
  *  config home + record its id (the quota-aware account-swap mechanism).
@@ -5013,6 +5020,12 @@ export async function startServer(options) {
             // idle-monitor's rateLimitedAtIdle hand-off. `enabled` OMITTED from defaults ⇒
             // dev-agent live / dark-fleet.
             idleThrottleSettleGate: resolveDevAgentGate(config.monitoring?.idleThrottleSettleGate?.enabled, config),
+            // Standby-write reconciliation §3.3 (round-2 L3): per-machine
+            // SessionBuildContextStore re-key. The id comes from the coordinator/
+            // mesh identity via this LATE-RESOLVING getter (the mesh id is assigned
+            // further down the boot, after SessionManager exists); identity-less
+            // installs resolve null → the literal 'local' inside the store.
+            buildContextMachineId: () => _meshSelfId,
         });
         // Wire the SAME TTL-cached SDK-credit reader PR1's routing policy uses, so
         // the reroute 'auto' decision and the intelligence-funnel routing share one
@@ -14956,6 +14969,94 @@ export async function startServer(options) {
                 divergenceChecker = undefined;
             }
         }
+        // ── Swap-continuity anti-thrash spine (swap-continuity-antithrash §3/§4) ──
+        // SwapLedger + SwapAntiThrashEngine + SwapWorkGate. Constructed and
+        // hydrated UNCONDITIONALLY (R4-L3): the ledger loads at every boot
+        // regardless of antiThrash.enabled so the in-memory index (dwell /
+        // reversal / breaker / frequency) is warm the moment the flag flips on
+        // mid-run — the §7.1 half-enable trap closed for this key. All antiThrash
+        // knobs are read LIVE per tick via the getter (the config object is
+        // shared + mutated in place by config PATCHes).
+        const antiThrashKnobsGetter = () => resolveAntiThrashKnobs(config.subscriptionPool?.proactiveSwap?.antiThrash, {
+            thresholdPct: config.subscriptionPool?.proactiveSwap?.thresholdPct,
+            tickMs: config.subscriptionPool?.proactiveSwap?.tickMs,
+        });
+        // swapContinuity (Piece 2, the work gate): the `enabled` KEY IS OMITTED
+        // from shipped config on purpose — omission routes it through the
+        // dev-agent gate (live on a dev agent, dark on the fleet; the #1001
+        // anti-mechanism). `enabled` is RESTART-REQUIRED (§7.1 — the gate wiring
+        // into SessionRefresh is constructor-injected); dryRun + numeric knobs
+        // are read live per evaluation via the getters below.
+        const swapContinuityEnabled = resolveDevAgentGate(config.subscriptionPool?.swapContinuity?.enabled, config);
+        const swapContinuityKnobs = () => {
+            const c = config.subscriptionPool?.swapContinuity;
+            return {
+                enabled: swapContinuityEnabled,
+                dryRun: c?.dryRun ?? true,
+                deferralCeilingMs: c?.deferralCeilingMs ?? 1_800_000,
+                reactiveGraceMs: c?.reactiveGraceMs ?? 120_000,
+                recheckMs: c?.recheckMs ?? 10_000,
+            };
+        };
+        try {
+            const { SwapLedger } = await import('../core/SwapLedger.js');
+            const { SwapAntiThrashEngine, retentionBoundMs, crossKnobWarnings } = await import('../core/SwapAntiThrash.js');
+            const { SwapWorkGate } = await import('../core/SwapWorkGate.js');
+            const swapLedger = new SwapLedger({
+                filePath: path.join(config.stateDir, 'state', 'swap-ledger.jsonl'),
+                windowMs: () => retentionBoundMs(antiThrashKnobsGetter()),
+                // Counts supplied at outage-resume time (the ledger-lost refusals the
+                // writer itself could not record — §3.5/I5).
+                outageRefusalCount: () => _swapAntiThrashEngine?.ledgerLostRefusalCount() ?? 0,
+                machineId: _meshSelfId ?? 'local',
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            _swapAntiThrashEngine = new SwapAntiThrashEngine({
+                ledger: swapLedger,
+                getKnobs: antiThrashKnobsGetter,
+                machineId: _meshSelfId ?? 'local',
+                // P17: episode-deduped attention (the engine dedupes on episodeId;
+                // the id passed here is the stable per-episode dedupe key).
+                raiseAttention: (id, title, body) => {
+                    void telegram
+                        ?.createAttentionItem({
+                        id,
+                        title,
+                        summary: body,
+                        category: 'subscription-pool',
+                        priority: 'HIGH',
+                        sourceContext: 'subscription-pool:swap-antithrash',
+                    })
+                        .catch(() => {
+                        /* @silent-fallback-ok: attention is best-effort; the ledger row is the durable trace */
+                    });
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            _swapAntiThrashEngine.hydrate();
+            // Cross-knob coherence warnings (§7, R4-L2 — warn-only, once at boot).
+            // 15 min = the QuotaPoller's default cadence (pollIntervalMs ?? 15*60_000).
+            for (const w of crossKnobWarnings(antiThrashKnobsGetter(), 15 * 60_000))
+                console.warn(w);
+            _swapWorkGate = new SwapWorkGate({
+                checkSessionWorkState: (tmux) => sessionManager.checkSessionWorkState(tmux),
+                getClaudeSessionId: (tmux) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === tmux)?.claudeSessionId ?? null,
+                hasActiveSubagents: (id) => subagentTracker.hasActiveSubagents(id),
+                getActiveSubagents: (id) => subagentTracker.getActiveSubagents(id).map((r) => ({
+                    agentType: r.agentType,
+                    startedAt: r.startedAt,
+                    ...(r.transcriptPath ? { transcriptPath: r.transcriptPath } : {}),
+                })),
+            });
+        }
+        catch (err) {
+            // @silent-fallback-ok: cascade-isolation — a spine construction failure
+            // must never 503 the server; behavior degrades to pre-brake semantics
+            // (the legacy path) and re-attempts next boot.
+            console.warn('[instar] swap-continuity anti-thrash spine init failed (non-fatal):', err);
+            _swapAntiThrashEngine = null;
+            _swapWorkGate = null;
+        }
         // SessionRefresh — agent-initiated session respawn. Requires a Telegram
         // adapter (v1 scope: Telegram-bound sessions only). The respawner closure
         // captures `topicMemory` by reference, so even if topicMemory is wired up
@@ -14973,6 +15074,43 @@ export async function startServer(options) {
                 state,
                 telegram: telegramRef,
                 topicResumeMap: _topicResumeMap,
+                // swap-continuity-antithrash §4.2 — the in-flight work gate, bound at
+                // THIS primitive (the funnel every session-killing mutation flows
+                // through). Constructor-injected on purpose: `swapContinuity.enabled`
+                // is restart-required (§7.1); dryRun + numeric knobs read live via
+                // getKnobs. Null when the feature is dark on this install ⇒
+                // byte-for-byte today's behavior (unconditional kill).
+                workGateCtx: swapContinuityEnabled && _swapWorkGate
+                    ? {
+                        probe: (tmux) => _swapWorkGate.probe(tmux),
+                        getKnobs: () => {
+                            const k = swapContinuityKnobs();
+                            return { enabled: k.enabled, dryRun: k.dryRun, reactiveGraceMs: k.reactiveGraceMs, recheckMs: k.recheckMs };
+                        },
+                        recordProceeded: (args) => _swapAntiThrashEngine?.recordProceeded(args),
+                        recordInteractiveRefusal: (args) => _swapAntiThrashEngine?.recordInteractiveRefusal(args),
+                        // §4.3(2) — Q4: v1 reads the in-memory exactly-once map (set on
+                        // inbound, cleared on reply); 'unknown' = the map/ledger is
+                        // unavailable (post-restart, or exactly-once ingress dark).
+                        // `messageLedger`/`currentInboundByTopic` are declared later in
+                        // this boot function and captured by reference — every call
+                        // happens post-boot, so the binding is initialized by then.
+                        resolveUnansweredInbound: (topicId) => {
+                            if (!messageLedger || !currentInboundByTopic)
+                                return 'unknown';
+                            const dedupeKey = currentInboundByTopic.get(String(topicId));
+                            if (!dedupeKey)
+                                return 'none';
+                            const entry = messageLedger.get(dedupeKey);
+                            if (!entry || entry.inputSnapshot === null)
+                                return 'unknown';
+                            const from = entry.senderEnvelope?.username ??
+                                entry.senderEnvelope?.firstName ??
+                                (entry.senderEnvelope?.userId !== undefined ? String(entry.senderEnvelope.userId) : 'unknown sender');
+                            return { body: entry.inputSnapshot, from, at: entry.receivedAt };
+                        },
+                    }
+                    : null,
                 // §10.5 Slack binding — SlackAdapter satisfies SlackRefreshBinding
                 // structurally (getChannelForSession / removeChannelResume /
                 // resolveChannelForSessionFromDisk). Null ⇒ Telegram-only, unchanged.
@@ -15036,6 +15174,30 @@ export async function startServer(options) {
             _quotaAwareScheduler = new QuotaAwareScheduler({
                 listAccounts: () => subscriptionPool.list(),
                 softThresholdPct: config.subscriptionPool?.swapSoftThresholdPct,
+                // swap-continuity-antithrash — the anti-thrash observation + execute-time
+                // revalidation hooks. Reactive decision behavior is untouched (I6):
+                // these only OBSERVE reactive swaps (dwell clock-start, hop alerts,
+                // failed rows) and revalidate PROACTIVE explicit-target calls (§3.3).
+                antiThrash: _swapAntiThrashEngine
+                    ? {
+                        readingValid: (acct, nowMs) => readingValidity(acct, nowMs, antiThrashKnobsGetter().quotaFreshnessMs).valid,
+                        getKnobs: () => {
+                            const k = antiThrashKnobsGetter();
+                            return { thresholdPct: k.thresholdPct, targetHeadroomPct: k.targetHeadroomPct, minImprovementPct: k.minImprovementPct };
+                        },
+                        resolveCurrentAccountId: (sessionName) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === sessionName)?.subscriptionAccountId ?? null,
+                        onReactiveExecuted: (a) => _swapAntiThrashEngine?.recordReactiveExecuted(a),
+                        onReactiveFailed: (a) => _swapAntiThrashEngine?.recordExecFailure({
+                            session: a.session,
+                            from: a.from,
+                            ...(a.to ? { to: a.to } : {}),
+                            kind: 'reactive',
+                            errorClass: a.errorClass,
+                            nowMs: a.nowMs,
+                        }),
+                        onReactiveRateCapRefusal: (s, n) => _swapAntiThrashEngine?.noteReactiveRateCapRefusal(s, n),
+                    }
+                    : undefined,
                 refreshFn: async (o) => {
                     if (!_sessionRefresh)
                         return false;
@@ -15044,8 +15206,13 @@ export async function startServer(options) {
                         reason: o.reason,
                         configHome: o.configHome,
                         accountId: o.accountId,
+                        // I11: callerClass set ONLY server-internally — the scheduler is
+                        // the one caller that knows its lane (proactive funnel vs reactive).
+                        callerClass: o.callerClass,
                     });
-                    return r.ok;
+                    // Object form: surfaces the structured refusal code so the
+                    // anti-thrash observation layer can classify failures (§3.1/§3.6).
+                    return r.ok ? { ok: true } : { ok: false, code: r.code };
                 },
                 onNoAlternate: (sessionName, exhaustedAccountId) => {
                     void telegramRef.createAttentionItem({
@@ -15127,6 +15294,18 @@ export async function startServer(options) {
                     maxSwapsPerCycle: proactiveCfg.maxSwapsPerCycle,
                     cooldownMs: proactiveCfg.cooldownMs,
                     tickMs: proactiveCfg.tickMs,
+                    // swap-continuity-antithrash §3 — the brake engine at the proactive
+                    // DECISION chokepoint. Knobs read LIVE per tick (§7.1). dryRun keeps
+                    // the legacy decision path byte-identical while the engine logs
+                    // would-refuse shadow rows (the rung-2 soak).
+                    antiThrash: _swapAntiThrashEngine
+                        ? { engine: _swapAntiThrashEngine, getKnobs: antiThrashKnobsGetter }
+                        : undefined,
+                    // §4 — the in-flight work gate (proactive arm: defer, ceiling-drop).
+                    // The monitor owns the deferral lifecycle; the gate is stateless.
+                    workGate: _swapWorkGate
+                        ? { probe: (s) => _swapWorkGate.probe(s), getContinuity: swapContinuityKnobs }
+                        : undefined,
                     logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
                 });
                 _proactiveSwapMonitor.start();
@@ -16367,6 +16546,12 @@ export async function startServer(options) {
          * no-op (the spawn still runs; the reconciler/applier converge — FD11).
          */
         let _claimOwnershipForAutonomousSpawn = null;
+        // Standby-write reconciliation (§3.2): the pool block's ownership store is
+        // captured here so the WriteAdmission constructed just before AgentServer
+        // can boot-warm its ownership index from it + register the interface-level
+        // onCommit hook. Stays null on pool-dark installs (the index warms empty;
+        // scoped domains collapse to the legacy lease boolean anyway).
+        let _writeAdmissionOwnershipStore = null;
         try {
             const meshMod = await import('../core/MeshRpc.js');
             const idMod = await import('../core/MachineIdentity.js');
@@ -16568,6 +16753,7 @@ export async function startServer(options) {
                     epochFloorOf: (sk) => ownershipEpochFloor?.(sk) ?? 0,
                     logger: (m) => console.log(pc.dim(`  ${m}`)),
                 });
+                _writeAdmissionOwnershipStore = ownershipStore;
                 const ownReg = sessionOwnershipRegistry;
                 // WS1.1: expose a read-only ownership lookup to the drain's
                 // spawn-boundary re-check (module-scope; the drain closure is defined
@@ -19890,10 +20076,81 @@ export async function startServer(options) {
             console.warn(pc.yellow(`  Rope-health monitor init failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`));
             ropeHealthMonitor = null;
         }
+        // ── Standby-Write Reconciliation + Typed Refusal (docs/specs/standby-write-reconciliation.md) ──
+        // Ownership-scoped write admission replacing the blanket lease-boolean
+        // standby guard. Dev-gated dark (`enabled` OMITTED from defaults →
+        // resolveDevAgentGate) + dryRun-FIRST: while dry the LEGACY blanket guard
+        // keeps enforcing and this layer only logs would-verdicts (§9.6). The
+        // attach below is ONE-WAY and lands BEFORE routes are wired (AgentServer
+        // is constructed just after), so no HTTP mutating route can ever observe a
+        // half-attached state (§3.2 pre-construction window).
+        let writeAdmission = null;
+        if (resolveDevAgentGate(config.multiMachine?.writeAdmission?.enabled, config)) {
+            try {
+                const waMod = await import('../core/WriteAdmission.js');
+                const regMod = await import('../core/WriteDomainRegistry.js');
+                const waMachineId = _meshSelfId ?? coordinator.identity?.machineId ?? null;
+                const waCfg = config.multiMachine?.writeAdmission;
+                writeAdmission = new waMod.WriteAdmission({
+                    thisMachineId: waMachineId,
+                    isReadOnly: () => state.readOnly,
+                    isPoolActive: () => state.sessionPoolActive,
+                    registry: regMod.buildWriteDomainRegistry({ machineId: waMachineId }),
+                    dryRun: waCfg?.dryRun ?? true,
+                    refusalAggregateThreshold: waCfg?.refusalAggregateThreshold ?? 5,
+                    // In-memory session→topic binding ONLY (I2 — the disk fallback is
+                    // forbidden on the admission path).
+                    resolveTopicForSession: (sessionId) => telegram?.getTopicForSession(sessionId) ?? null,
+                    // I7 — local knowledge only: we positively know the holder only when
+                    // it is us; a refusal body's leaseHolder is otherwise null.
+                    leaseHolder: () => (coordinator.holdsLease() ? waMachineId : null),
+                    raiseAttention: telegram
+                        ? (item) => {
+                            void telegram.createAttentionItem({
+                                id: item.id,
+                                title: item.title,
+                                summary: item.body,
+                                category: 'write-admission',
+                                priority: 'NORMAL',
+                                sourceContext: 'write-admission',
+                            }).catch(() => { });
+                        }
+                        : undefined,
+                    logDir: path.join(config.stateDir, 'logs'),
+                }, _writeAdmissionOwnershipStore);
+                state.attachWriteAdmission(writeAdmission);
+                // One-time legacy-key cleanup (§3.3): the pre-re-key shared
+                // `session-build-context` kv entry is removed on the LEASE HOLDER only
+                // (a standby's delete would be refused by the cluster-shared guard —
+                // correctly). Entries self-drain via the 6h max age regardless, so a
+                // machine that never holds the lease loses nothing.
+                try {
+                    if (coordinator.holdsLease() && state.get('session-build-context') !== null) {
+                        state.delete('session-build-context');
+                        console.log(pc.dim('  [write-admission] legacy session-build-context kv entry cleaned up (lease holder, one-time)'));
+                    }
+                }
+                catch {
+                    /* @silent-fallback-ok — the legacy key is inert and self-draining (6h max age);
+                       a failed cleanup only delays its disappearance and retries at the next boot. */
+                }
+                console.log(pc.dim(`  Write-admission: live (${writeAdmission.mode()}) — machine ${waMachineId ?? 'local'}, legacy guard ${writeAdmission.isLive ? 'subsumed' : 'still enforcing'}`));
+            }
+            catch (err) {
+                // @silent-fallback-ok — reported via console.warn; init failure leaves the
+                // layer null → route 503s + the legacy blanket guard keeps enforcing
+                // (§5 fail-toward-today), never blocks boot.
+                console.warn(pc.yellow(`  Write-admission init failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`));
+                writeAdmission = null;
+            }
+        }
+        else {
+            console.log(pc.dim('  Write-admission: dark (multiMachine.writeAdmission resolves off on this agent)'));
+        }
         const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: m.nickname ?? m.machineId, url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.
         _agentServerRef = server;