instar 1.3.729 → 1.3.731

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAi/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+hkBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAu/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ykBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -26,6 +26,7 @@ import { SpawningTopicsRegistry } from '../core/SpawningTopicsRegistry.js';
 import { TopicReachabilityVerifier } from '../monitoring/TopicReachabilityVerifier.js';
 import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstanceLock.js';
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
+import { resolveAntiThrashKnobs, readingValidity } from '../core/SwapAntiThrash.js';
 import { shouldReleaseOnComplete, planClaimOnSpawn, ownershipNonce } from '../core/ownershipFollowsLiveWork.js';
 import { PrHandLease } from '../core/PrHandLease.js';
 import { claimSuspensionExcludesPin } from '../core/TopicClaimAnnotationStore.js';
@@ -760,6 +761,12 @@ let _quotaAwareScheduler = null;
 // Subscription & Auth Standard P1.3 — pre-limit proactive swap monitor. Null
 // until wired (requires the scheduler; gated behind subscriptionPool.proactiveSwap).
 let _proactiveSwapMonitor = null;
+// swap-continuity-antithrash §3/§4 — the anti-thrash spine. The ledger + engine
+// load and hydrate UNCONDITIONALLY at boot (R4-L3: reactive rows append
+// regardless of antiThrash.enabled, so the index is warm at a mid-run flag
+// flip). Null only when construction itself failed (non-fatal).
+let _swapAntiThrashEngine = null;
+let _swapWorkGate = null;
 async function spawnSessionForTopic(sessionManager, telegram, sessionName, topicId, latestMessage, topicMemory, userProfile, precomputedContext, 
 /** Subscription & Auth Standard P1.3 (additive): launch under this account's
  *  config home + record its id (the quota-aware account-swap mechanism).
@@ -14360,17 +14367,96 @@ export async function startServer(options) {
         // even without ANTHROPIC_API_KEY. Falls back to direct Anthropic API if a key is set
         // and no intelligence is available.
         let responseReviewGate;
+        let reviewCanaryBattery;
         if (config.responseReview?.enabled) {
             if (sharedIntelligence) {
                 const { CoherenceGate } = await import('../core/CoherenceGate.js');
+                const { buildConversationContext } = await import('../core/conversationContextWiring.js');
+                // Context-aware reviewers (context-aware-outbound-review §D10): the
+                // WIRING layer resolves the dev-gate (resolveDevAgentGate needs the
+                // top-level developmentAgent flag, which the gate never receives) and
+                // hands the gate a PRE-RESOLVED conversationalContext block through
+                // the LIVE getter — the kill-switch (`conversationalContext.enabled:
+                // false`) then takes effect at the NEXT evaluate, no restart.
+                const resolveConversationalContext = () => {
+                    const cc = liveConfig.get('responseReview.conversationalContext', config.responseReview?.conversationalContext) ?? {};
+                    const dev = liveConfig.get('developmentAgent', config.developmentAgent);
+                    return {
+                        enabled: resolveDevAgentGate(typeof cc.enabled === 'boolean' ? cc.enabled : undefined, { developmentAgent: dev }),
+                        maxMessages: typeof cc.maxMessages === 'number' ? cc.maxMessages : undefined,
+                        maxCharsPerMessage: typeof cc.maxCharsPerMessage === 'number' ? cc.maxCharsPerMessage : undefined,
+                        maxTotalChars: typeof cc.maxTotalChars === 'number' ? cc.maxTotalChars : undefined,
+                        injectReviewers: Array.isArray(cc.injectReviewers) ? cc.injectReviewers : undefined,
+                    };
+                };
                 responseReviewGate = new CoherenceGate({
                     config: config.responseReview,
                     stateDir: config.stateDir,
                     intelligence: sharedIntelligence,
                     relationships: relationships ?? undefined,
                     adaptiveTrust: adaptiveTrust ?? undefined,
+                    // LIVE config getter (round-1 M2 build items 1+2): carries BOTH the
+                    // CMT-1794 fail-closed kill-switch AND the resolved
+                    // conversationalContext block. Reads through LiveConfig so a config
+                    // edit applies at the next evaluate without a restart.
+                    liveConfig: () => ({
+                        failClosedOnCriticalAbstain: liveConfig.get('responseReview.failClosedOnCriticalAbstain', config.responseReview?.failClosedOnCriticalAbstain),
+                        conversationalContext: resolveConversationalContext(),
+                    }),
+                    // §D1 conversation source: TopicMemory rows + the topic's verified
+                    // operator binding, distilled by the wiring-layer principal
+                    // computation (buildConversationContext — Know Your Principal). Any
+                    // throw here is caught at acquisition inside the gate (§D5).
+                    conversationContextProvider: (topicId, limit) => {
+                        if (!topicMemory)
+                            return { messages: [], askLicenseMode: 'weak-corroboration-only' };
+                        const rows = topicMemory.getRecentMessages(topicId, limit);
+                        const operator = _agentServerRef?.getTopicOperatorStore()?.getOperator(topicId) ?? null;
+                        return buildConversationContext(rows, operator);
+                    },
                 });
                 console.log(pc.green(`  Response review pipeline: enabled via shared IntelligenceProvider (${Object.keys(config.responseReview.reviewers ?? {}).length} reviewers configured)`));
+                if (resolveConversationalContext().enabled) {
+                    console.log(pc.green('  Response review conversational context: LIVE (context-aware reviewers — dev-gate resolved)'));
+                }
+                else {
+                    console.log(pc.dim('  Response review conversational context: dark (dev-gate resolved off)'));
+                }
+                // §D9.4b canary-battery driver — replays through the Bearer-gated
+                // /review/test route (the SAME plumbing real reviews use; no auth-less
+                // bypass seam) and writes its per-run summary through the gate's §D8
+                // writer. The trigger route 503s while the feature is dark.
+                if (topicMemory) {
+                    const { ReviewCanaryBattery } = await import('../monitoring/ReviewCanaryBattery.js');
+                    const gateForBattery = responseReviewGate;
+                    reviewCanaryBattery = new ReviewCanaryBattery({
+                        topicMemory,
+                        callReviewTest: async (body) => {
+                            const resp = await fetch(`http://127.0.0.1:${config.port}/review/test`, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/json',
+                                    Authorization: `Bearer ${config.authToken ?? ''}`,
+                                },
+                                body: JSON.stringify(body),
+                            });
+                            let parsed = null;
+                            try {
+                                parsed = (await resp.json());
+                            }
+                            catch {
+                                // @silent-fallback-ok — a non-JSON body is reported as a null
+                                // body; the driver records the arm as an error (inconclusive),
+                                // never a silent skip.
+                            }
+                            return { status: resp.status, body: parsed };
+                        },
+                        writeDecisionRow: (row) => gateForBattery.appendDecisionRow(row),
+                        isFeatureLive: () => resolveConversationalContext().enabled,
+                        isObserveOnly: () => liveConfig.get('responseReview.observeOnly', config.responseReview?.observeOnly) === true,
+                        isTestEndpointEnabled: () => liveConfig.get('responseReview.testEndpointDisabled', config.responseReview?.testEndpointDisabled) !== true,
+                    });
+                }
             }
             else {
                 console.warn(pc.yellow(`  Response review pipeline: configured but no IntelligenceProvider available (path-constraints.md Rule 2 forbids direct API path)`));
@@ -14962,6 +15048,94 @@ export async function startServer(options) {
                 divergenceChecker = undefined;
             }
         }
+        // ── Swap-continuity anti-thrash spine (swap-continuity-antithrash §3/§4) ──
+        // SwapLedger + SwapAntiThrashEngine + SwapWorkGate. Constructed and
+        // hydrated UNCONDITIONALLY (R4-L3): the ledger loads at every boot
+        // regardless of antiThrash.enabled so the in-memory index (dwell /
+        // reversal / breaker / frequency) is warm the moment the flag flips on
+        // mid-run — the §7.1 half-enable trap closed for this key. All antiThrash
+        // knobs are read LIVE per tick via the getter (the config object is
+        // shared + mutated in place by config PATCHes).
+        const antiThrashKnobsGetter = () => resolveAntiThrashKnobs(config.subscriptionPool?.proactiveSwap?.antiThrash, {
+            thresholdPct: config.subscriptionPool?.proactiveSwap?.thresholdPct,
+            tickMs: config.subscriptionPool?.proactiveSwap?.tickMs,
+        });
+        // swapContinuity (Piece 2, the work gate): the `enabled` KEY IS OMITTED
+        // from shipped config on purpose — omission routes it through the
+        // dev-agent gate (live on a dev agent, dark on the fleet; the #1001
+        // anti-mechanism). `enabled` is RESTART-REQUIRED (§7.1 — the gate wiring
+        // into SessionRefresh is constructor-injected); dryRun + numeric knobs
+        // are read live per evaluation via the getters below.
+        const swapContinuityEnabled = resolveDevAgentGate(config.subscriptionPool?.swapContinuity?.enabled, config);
+        const swapContinuityKnobs = () => {
+            const c = config.subscriptionPool?.swapContinuity;
+            return {
+                enabled: swapContinuityEnabled,
+                dryRun: c?.dryRun ?? true,
+                deferralCeilingMs: c?.deferralCeilingMs ?? 1_800_000,
+                reactiveGraceMs: c?.reactiveGraceMs ?? 120_000,
+                recheckMs: c?.recheckMs ?? 10_000,
+            };
+        };
+        try {
+            const { SwapLedger } = await import('../core/SwapLedger.js');
+            const { SwapAntiThrashEngine, retentionBoundMs, crossKnobWarnings } = await import('../core/SwapAntiThrash.js');
+            const { SwapWorkGate } = await import('../core/SwapWorkGate.js');
+            const swapLedger = new SwapLedger({
+                filePath: path.join(config.stateDir, 'state', 'swap-ledger.jsonl'),
+                windowMs: () => retentionBoundMs(antiThrashKnobsGetter()),
+                // Counts supplied at outage-resume time (the ledger-lost refusals the
+                // writer itself could not record — §3.5/I5).
+                outageRefusalCount: () => _swapAntiThrashEngine?.ledgerLostRefusalCount() ?? 0,
+                machineId: _meshSelfId ?? 'local',
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            _swapAntiThrashEngine = new SwapAntiThrashEngine({
+                ledger: swapLedger,
+                getKnobs: antiThrashKnobsGetter,
+                machineId: _meshSelfId ?? 'local',
+                // P17: episode-deduped attention (the engine dedupes on episodeId;
+                // the id passed here is the stable per-episode dedupe key).
+                raiseAttention: (id, title, body) => {
+                    void telegram
+                        ?.createAttentionItem({
+                        id,
+                        title,
+                        summary: body,
+                        category: 'subscription-pool',
+                        priority: 'HIGH',
+                        sourceContext: 'subscription-pool:swap-antithrash',
+                    })
+                        .catch(() => {
+                        /* @silent-fallback-ok: attention is best-effort; the ledger row is the durable trace */
+                    });
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            _swapAntiThrashEngine.hydrate();
+            // Cross-knob coherence warnings (§7, R4-L2 — warn-only, once at boot).
+            // 15 min = the QuotaPoller's default cadence (pollIntervalMs ?? 15*60_000).
+            for (const w of crossKnobWarnings(antiThrashKnobsGetter(), 15 * 60_000))
+                console.warn(w);
+            _swapWorkGate = new SwapWorkGate({
+                checkSessionWorkState: (tmux) => sessionManager.checkSessionWorkState(tmux),
+                getClaudeSessionId: (tmux) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === tmux)?.claudeSessionId ?? null,
+                hasActiveSubagents: (id) => subagentTracker.hasActiveSubagents(id),
+                getActiveSubagents: (id) => subagentTracker.getActiveSubagents(id).map((r) => ({
+                    agentType: r.agentType,
+                    startedAt: r.startedAt,
+                    ...(r.transcriptPath ? { transcriptPath: r.transcriptPath } : {}),
+                })),
+            });
+        }
+        catch (err) {
+            // @silent-fallback-ok: cascade-isolation — a spine construction failure
+            // must never 503 the server; behavior degrades to pre-brake semantics
+            // (the legacy path) and re-attempts next boot.
+            console.warn('[instar] swap-continuity anti-thrash spine init failed (non-fatal):', err);
+            _swapAntiThrashEngine = null;
+            _swapWorkGate = null;
+        }
         // SessionRefresh — agent-initiated session respawn. Requires a Telegram
         // adapter (v1 scope: Telegram-bound sessions only). The respawner closure
         // captures `topicMemory` by reference, so even if topicMemory is wired up
@@ -14979,6 +15153,43 @@ export async function startServer(options) {
                 state,
                 telegram: telegramRef,
                 topicResumeMap: _topicResumeMap,
+                // swap-continuity-antithrash §4.2 — the in-flight work gate, bound at
+                // THIS primitive (the funnel every session-killing mutation flows
+                // through). Constructor-injected on purpose: `swapContinuity.enabled`
+                // is restart-required (§7.1); dryRun + numeric knobs read live via
+                // getKnobs. Null when the feature is dark on this install ⇒
+                // byte-for-byte today's behavior (unconditional kill).
+                workGateCtx: swapContinuityEnabled && _swapWorkGate
+                    ? {
+                        probe: (tmux) => _swapWorkGate.probe(tmux),
+                        getKnobs: () => {
+                            const k = swapContinuityKnobs();
+                            return { enabled: k.enabled, dryRun: k.dryRun, reactiveGraceMs: k.reactiveGraceMs, recheckMs: k.recheckMs };
+                        },
+                        recordProceeded: (args) => _swapAntiThrashEngine?.recordProceeded(args),
+                        recordInteractiveRefusal: (args) => _swapAntiThrashEngine?.recordInteractiveRefusal(args),
+                        // §4.3(2) — Q4: v1 reads the in-memory exactly-once map (set on
+                        // inbound, cleared on reply); 'unknown' = the map/ledger is
+                        // unavailable (post-restart, or exactly-once ingress dark).
+                        // `messageLedger`/`currentInboundByTopic` are declared later in
+                        // this boot function and captured by reference — every call
+                        // happens post-boot, so the binding is initialized by then.
+                        resolveUnansweredInbound: (topicId) => {
+                            if (!messageLedger || !currentInboundByTopic)
+                                return 'unknown';
+                            const dedupeKey = currentInboundByTopic.get(String(topicId));
+                            if (!dedupeKey)
+                                return 'none';
+                            const entry = messageLedger.get(dedupeKey);
+                            if (!entry || entry.inputSnapshot === null)
+                                return 'unknown';
+                            const from = entry.senderEnvelope?.username ??
+                                entry.senderEnvelope?.firstName ??
+                                (entry.senderEnvelope?.userId !== undefined ? String(entry.senderEnvelope.userId) : 'unknown sender');
+                            return { body: entry.inputSnapshot, from, at: entry.receivedAt };
+                        },
+                    }
+                    : null,
                 // §10.5 Slack binding — SlackAdapter satisfies SlackRefreshBinding
                 // structurally (getChannelForSession / removeChannelResume /
                 // resolveChannelForSessionFromDisk). Null ⇒ Telegram-only, unchanged.
@@ -15042,6 +15253,30 @@ export async function startServer(options) {
             _quotaAwareScheduler = new QuotaAwareScheduler({
                 listAccounts: () => subscriptionPool.list(),
                 softThresholdPct: config.subscriptionPool?.swapSoftThresholdPct,
+                // swap-continuity-antithrash — the anti-thrash observation + execute-time
+                // revalidation hooks. Reactive decision behavior is untouched (I6):
+                // these only OBSERVE reactive swaps (dwell clock-start, hop alerts,
+                // failed rows) and revalidate PROACTIVE explicit-target calls (§3.3).
+                antiThrash: _swapAntiThrashEngine
+                    ? {
+                        readingValid: (acct, nowMs) => readingValidity(acct, nowMs, antiThrashKnobsGetter().quotaFreshnessMs).valid,
+                        getKnobs: () => {
+                            const k = antiThrashKnobsGetter();
+                            return { thresholdPct: k.thresholdPct, targetHeadroomPct: k.targetHeadroomPct, minImprovementPct: k.minImprovementPct };
+                        },
+                        resolveCurrentAccountId: (sessionName) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === sessionName)?.subscriptionAccountId ?? null,
+                        onReactiveExecuted: (a) => _swapAntiThrashEngine?.recordReactiveExecuted(a),
+                        onReactiveFailed: (a) => _swapAntiThrashEngine?.recordExecFailure({
+                            session: a.session,
+                            from: a.from,
+                            ...(a.to ? { to: a.to } : {}),
+                            kind: 'reactive',
+                            errorClass: a.errorClass,
+                            nowMs: a.nowMs,
+                        }),
+                        onReactiveRateCapRefusal: (s, n) => _swapAntiThrashEngine?.noteReactiveRateCapRefusal(s, n),
+                    }
+                    : undefined,
                 refreshFn: async (o) => {
                     if (!_sessionRefresh)
                         return false;
@@ -15050,8 +15285,13 @@ export async function startServer(options) {
                         reason: o.reason,
                         configHome: o.configHome,
                         accountId: o.accountId,
+                        // I11: callerClass set ONLY server-internally — the scheduler is
+                        // the one caller that knows its lane (proactive funnel vs reactive).
+                        callerClass: o.callerClass,
                     });
-                    return r.ok;
+                    // Object form: surfaces the structured refusal code so the
+                    // anti-thrash observation layer can classify failures (§3.1/§3.6).
+                    return r.ok ? { ok: true } : { ok: false, code: r.code };
                 },
                 onNoAlternate: (sessionName, exhaustedAccountId) => {
                     void telegramRef.createAttentionItem({
@@ -15133,6 +15373,18 @@ export async function startServer(options) {
                     maxSwapsPerCycle: proactiveCfg.maxSwapsPerCycle,
                     cooldownMs: proactiveCfg.cooldownMs,
                     tickMs: proactiveCfg.tickMs,
+                    // swap-continuity-antithrash §3 — the brake engine at the proactive
+                    // DECISION chokepoint. Knobs read LIVE per tick (§7.1). dryRun keeps
+                    // the legacy decision path byte-identical while the engine logs
+                    // would-refuse shadow rows (the rung-2 soak).
+                    antiThrash: _swapAntiThrashEngine
+                        ? { engine: _swapAntiThrashEngine, getKnobs: antiThrashKnobsGetter }
+                        : undefined,
+                    // §4 — the in-flight work gate (proactive arm: defer, ceiling-drop).
+                    // The monitor owns the deferral lifecycle; the gate is stateless.
+                    workGate: _swapWorkGate
+                        ? { probe: (s) => _swapWorkGate.probe(s), getContinuity: swapContinuityKnobs }
+                        : undefined,
                     logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
                 });
                 _proactiveSwapMonitor.start();
@@ -19977,7 +20229,7 @@ export async function startServer(options) {
         const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: m.nickname ?? m.machineId, url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.
         _agentServerRef = server;