instar 1.3.748 → 1.3.749

package/dist/monitoring/MachineCoherenceSentinel.d.ts

@@ -0,0 +1,240 @@
+/**
+ * MachineCoherenceSentinel — the machine-coherence guard's evaluator core
+ * (machine-coherence-guard §3.3/§3.4; roadmap 4.1, F4/P0-1).
+ *
+ * A pure-core, tick-driven, signal-only sentinel in the `checkPoolFlagCoherence`
+ * shape: it compares, across every ONLINE machine in the pool, the §3.2 advert
+ * dimensions (version / resolved flags / protocol / manifest generation) and —
+ * when the pool diverges — will raise ONE deduped, episode-scoped attention item
+ * from exactly ONE elected machine. It never blocks, equalizes, or restarts
+ * anything.
+ *
+ * INCREMENT STATUS (C₁ is landing in sub-units — see the side-effects artifact):
+ *   - LANDED here: config resolution (spec §7 keys, code-side defaults,
+ *     `enabled` OMITTED from ConfigDefaults → resolveDevAgentGate, the #1001
+ *     anti-mechanism), the tick loop's early no-op gates (single-machine strict
+ *     no-op BEFORE any state is touched), the per-tick peer-classification pass
+ *     (composing the pure C₀ helpers), the §3.4 election over live candidates,
+ *     the M11 comparison-universe honesty accounting, and the §6 status
+ *     snapshot shape.
+ *   - NOT YET here (Session B): dimension comparison + confirmation counters
+ *     (R2-L3 consecutive rule, M6 update-wave suppression, N8 warm-up
+ *     accounting beyond the tick gate), the §4 episode state machine + the ONE
+ *     attention item + §4.2.1 fix flow, the alarm-marker attach into
+ *     refreshPool's advert, jsonl transitions, and the status route.
+ *
+ * Fail toward silence (§3.3): any evaluator error → no emit this tick, an
+ * error counter on the status snapshot. A guard that can flood on its own
+ * malfunction re-creates the disease it treats.
+ *
+ * Supervision tier (N6): Tier 0 — fully deterministic; no LLM call anywhere.
+ * Signal-vs-authority: PURE SIGNAL (dev-gated dark; dry-run first even on dev).
+ */
+import type { MachineCapacity } from '../core/types.js';
+import { type SkewRow } from './machineCoherenceEvaluate.js';
+import { type EpisodeEffect } from './machineCoherenceEpisodeManager.js';
+/** Resolved config (spec §7 — every knob carries its shipped default in code). */
+export interface MachineCoherenceResolvedConfig {
+    enabled: boolean;
+    dryRun: boolean;
+    flagConfirmTicks: number;
+    versionSkewGraceMs: number;
+    resolveTicks: number;
+    escalateAfterMs: number;
+    advertStaleMs: number;
+    warmupTicks: number;
+    reopenWindowMs: number;
+    maxEpisodeItemsPerDay: number;
+    suspendedEpisodeExpiryMs: number;
+    raiserTakeoverTicks: number;
+    flappingLatchReopens: number;
+    episodeAppendBudget: number;
+    episodeAppendWindowMs: number;
+    fixVerifyTicks: number;
+}
+/**
+ * Resolve the guard's config from the full agent config object. `enabled` is
+ * DELIBERATELY absent from ConfigDefaults — resolveDevAgentGate decides (LIVE
+ * on a development agent, DARK on the fleet; an explicit value always wins —
+ * the #1001 anti-mechanism). `dryRun` defaults TRUE even on dev (dry-run
+ * FIRST: evaluator runs, counters record would-raise, NO item).
+ */
+export declare function resolveMachineCoherenceConfig(config: Record<string, unknown>): MachineCoherenceResolvedConfig;
+/** The guard's own posture, derived from resolved config (feeds candidacy). */
+export declare function selfPostureOf(cfg: Pick<MachineCoherenceResolvedConfig, 'enabled' | 'dryRun'>): 'live' | 'dry-run' | 'dark';
+export interface MachineCoherenceSentinelDeps {
+    /** The pool view (self + peers) — `machinePoolRegistry.getCapacities()`. */
+    listCapacities: () => MachineCapacity[];
+    /** This machine's id (null before pool identity is established). */
+    selfMachineId: () => string | null;
+    /** The serving-lease holder's machine id, or null when unknown/none. */
+    leaseHolderMachineId: () => string | null;
+    /** Wall clock — injectable for tests. */
+    now?: () => number;
+    /** The per-agent state root (`<agent>/.instar`). When provided, the sentinel
+     *  owns a durable EpisodeManager (§4 episode machinery); when absent (pure
+     *  unit tests), the sentinel runs classification + confirmation only. */
+    stateDir?: () => string | null;
+    /** machineId → operator-facing nickname (registry display label). */
+    nicknameOf?: (machineId: string) => string;
+}
+/** The §6 status snapshot (the future `GET /pool/machine-coherence` body core). */
+export interface MachineCoherenceStatus {
+    enabled: boolean;
+    dryRun: boolean;
+    lastTickAt: string | null;
+    machinesRegisteredOnline: number;
+    machinesCompared: number;
+    peerClassifications: {
+        compared: number;
+        unknown: number;
+        advertStale: number;
+        advertRejected: number;
+    };
+    raiser: {
+        machineId: string | null;
+        isSelf: boolean;
+        candidates: string[];
+    };
+    /** The open episode (§4), or null when none / the durable machinery is unwired.
+     *  `pendingFix` carries the §4.2.1 proposal awaiting operator approval (or null). */
+    openEpisode: {
+        episodeId: string;
+        rows: number;
+        suspended: boolean;
+        itemRaisedAt: string | null;
+        pendingFix: {
+            state: import('./machineCoherenceEpisode.js').PendingFixState;
+            key: string;
+            targetMachineId: string;
+            targetValue: string;
+            proposalHash: string;
+        } | null;
+    } | null;
+    /** Episode lifecycle counters (§4.5) — present only when the machinery is wired. */
+    episodeCounters?: import('./machineCoherenceEpisodeManager.js').EpisodeManagerCounters;
+    /**
+     * `skewsConfirmed` is CUMULATIVE (a counter of confirmation transitions, not a
+     * live gauge). `confirmedRows`/`pendingRows` are the live gauges — how many
+     * distinct skew rows are currently confirmed vs still accruing consecutive
+     * ticks. `errors` is fail-toward-silence tick errors.
+     */
+    counters: {
+        ticks: number;
+        skewsConfirmed: number;
+        confirmedRows: number;
+        pendingRows: number;
+        errors: number;
+    };
+}
+export declare class MachineCoherenceSentinel {
+    private readonly deps;
+    private readonly cfg;
+    private lastTickAtMs;
+    private ticks;
+    private errors;
+    /** Post-boot warm-up accounting (N8): ticks completed since construction. */
+    private ticksSinceBoot;
+    private lastClassified;
+    private lastRegisteredOnline;
+    private lastRaiser;
+    private lastCandidates;
+    /** §3.3 confirmation engine: per-row consecutive-tick + grace-clock state. */
+    private rowState;
+    /** The row identities present LAST tick (R2-L3 consecutive detection). */
+    private lastTickRowIds;
+    /** Cumulative count of confirmation transitions (never decremented). */
+    private skewsConfirmed;
+    /** The §4 episode machinery (constructed only when a stateDir is provided). */
+    private episode?;
+    /** Effects the last tick produced, awaiting execution by the caller (server). */
+    private pendingEffects;
+    constructor(deps: MachineCoherenceSentinelDeps, cfg: MachineCoherenceResolvedConfig);
+    /**
+     * Drain the effects the last reconcile produced (raise/append/resolve). The
+     * caller (server) executes them against the telegram adapter, keeping the
+     * sentinel Tier-0 and its tick synchronous. Empty on a dark/no-episode agent.
+     */
+    drainPendingEffects(): EpisodeEffect[];
+    /** Passthrough for the conversational reply path (b3): the durable "leave it" ack. */
+    setOperatorAck(ack: boolean): void;
+    /**
+     * Operator "fix it" approval passthrough (§4.2.1-i). The caller (conversational
+     * reply path) has verified the sender is the topic's VERIFIED operator (Know
+     * Your Principal) and passes `verifiedOperator`; `proposalHash` is the display-
+     * integrity authority. Returns the transition + any effects (an `execute-fix`
+     * for the divergent==raiser case) the caller executes immediately. A dark/
+     * unwired guard is a no-op refusal.
+     */
+    approveFix(args: {
+        proposalHash: string;
+        verifiedOperator: boolean;
+        now?: number;
+    }): {
+        result: {
+            ok: boolean;
+            reason?: string;
+            state?: string;
+        };
+        effects: EpisodeEffect[];
+    };
+    /**
+     * Whether this tick is still inside the N8 post-boot warm-up window:
+     * `MachinePoolRegistry` is in-memory, so a local restart wipes every peer's
+     * advert until the next 30s pull — for `warmupTicks` after boot,
+     * `unknown`/`advert-stale` classifications must count toward NOTHING (no
+     * confirmation progress, no version-class grace clock). The classification
+     * itself still runs (the status snapshot stays honest); the CONSUMERS of
+     * warm-up (confirmation counters, Session B) read this flag.
+     */
+    inWarmup(): boolean;
+    /**
+     * One evaluator tick (rides the existing 30s peerPresenceTick — no timer of
+     * its own). Runs only when the guard resolves live or dry-run; the caller
+     * owns the gate (a dark guard never constructs/ticks the sentinel). Fails
+     * toward silence: any error increments the error counter and emits nothing.
+     */
+    tick(): void;
+    /**
+     * §3.3 confirmation engine (R2-L3 consecutive rule + M6 update-wave
+     * suppression). Runs over the CURRENTLY-`compared` machines (self included —
+     * self records its own advert every beat), turns the raw per-tick divergences
+     * into confirmed rows, and never raises anything (the episode/alarm machinery
+     * is Session B). Pure state transitions; the caller owns fail-toward-silence.
+     *
+     * The consecutive rule (R2-L3): a row's confirmation counts ONLY ticks in which
+     * the row's identity (which encodes every participant's clamped value) is
+     * present. Because a participant dropping out (offline / unknown / advert-stale)
+     * either vanishes the identity or changes it, the old identity leaves
+     * `currentIds`, its counter is dropped, and a re-appearance starts fresh at 1 —
+     * one flapping reading can never accumulate toward confirmation.
+     *
+     * M6 update-wave suppression: FLAG rows are suppressed while ANY version skew
+     * exists among the compared machines (a differing version OR an open patch-only
+     * grace window — an update that changes a flag's resolved default would else
+     * alarm HIGH mid-wave and auto-resolve). Once every version agrees, residual
+     * flag skew confirms normally.
+     */
+    private updateConfirmation;
+    /** The currently-confirmed skew rows (C₁b-ii — Session B's episode machinery
+     *  consumes these; the status route exposes their count). Pure read. */
+    confirmedSkewRows(): SkewRow[];
+    /** The rows still accruing consecutive ticks (divergent, not yet confirmed). */
+    pendingSkewRows(): SkewRow[];
+    /**
+     * The GuardRegistry runtime getter (GUARD-POSTURE-ENDPOINT-SPEC §2.1): a
+     * synchronous in-memory read the /guards endpoint snapshots per request.
+     * `expectRuntime:true` on the GUARD_MANIFEST entry requires the C₁b server-boot
+     * wiring to register THIS at boot. `enabled`/`dryRun` come from the resolved
+     * config; `lastTickAt` drives the on-stale grading (a constructed-but-never-
+     * ticking guard reads stale, never "on"). Pure — never mutates.
+     */
+    guardStatus(): {
+        enabled: boolean;
+        dryRun: boolean;
+        lastTickAt: number;
+    };
+    /** The §6 status snapshot (pure read — never mutates). */
+    status(): MachineCoherenceStatus;
+}
+//# sourceMappingURL=MachineCoherenceSentinel.d.ts.map

package/dist/monitoring/MachineCoherenceSentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineCoherenceSentinel.d.ts","sourceRoot":"","sources":["../../src/monitoring/MachineCoherenceSentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,EAKL,KAAK,OAAO,EAEb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAkC,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAczG,kFAAkF;AAClF,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,8BAA8B,CA2B7G;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,8BAA8B,EAAE,SAAS,GAAG,QAAQ,CAAC,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAE1H;AAED,MAAM,WAAW,4BAA4B;IAC3C,4EAA4E;IAC5E,cAAc,EAAE,MAAM,eAAe,EAAE,CAAC;IACxC,oEAAoE;IACpE,aAAa,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACnC,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;6EAEyE;IACzE,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5E;yFACqF;IACrF,WAAW,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACjF,UAAU,EAAE;YAAE,KAAK,EAAE,OAAO,8BAA8B,EAAE,eAAe,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACvK,GAAG,IAAI,CAAC;IACT,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,qCAAqC,EAAE,sBAAsB,CAAC;IACvF;;;;;OAKG;IACH,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjH;AAED,qBAAa,wBAAwB;IAsBjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAtBtB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IACnB,6EAA6E;IAC7E,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,cAAc,CAAgB;IACtC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAsC;IACtD,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAqB;IAC3C,wEAAwE;IACxE,OAAO,CAAC,cAAc,CAAK;IAC3B,+EAA+E;IAC/E,OAAO,CAAC,OAAO,CAAC,CAAiC;IACjD,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;gBAG1B,IAAI,EAAE,4BAA4B,EAClC,GAAG,EAAE,8BAA8B;IAMtD;;;;OAIG;IACH,mBAAmB,IAAI,aAAa,EAAE;IAMtC,sFAAsF;IACtF,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAIlC;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE;IAK3K;;;;;;;;OAQG;IACH,QAAQ,IAAI,OAAO;IAInB;;;;;OAKG;IACH,IAAI,IAAI,IAAI;IA+DZ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kBAAkB;IAgD1B;4EACwE;IACxE,iBAAiB,IAAI,OAAO,EAAE;IAI9B,gFAAgF;IAChF,eAAe,IAAI,OAAO,EAAE;IAI5B;;;;;;;OAOG;IACH,WAAW,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAIxE,0DAA0D;IAC1D,MAAM,IAAI,sBAAsB;CAkCjC"}

package/dist/monitoring/MachineCoherenceSentinel.js

@@ -0,0 +1,336 @@
+/**
+ * MachineCoherenceSentinel — the machine-coherence guard's evaluator core
+ * (machine-coherence-guard §3.3/§3.4; roadmap 4.1, F4/P0-1).
+ *
+ * A pure-core, tick-driven, signal-only sentinel in the `checkPoolFlagCoherence`
+ * shape: it compares, across every ONLINE machine in the pool, the §3.2 advert
+ * dimensions (version / resolved flags / protocol / manifest generation) and —
+ * when the pool diverges — will raise ONE deduped, episode-scoped attention item
+ * from exactly ONE elected machine. It never blocks, equalizes, or restarts
+ * anything.
+ *
+ * INCREMENT STATUS (C₁ is landing in sub-units — see the side-effects artifact):
+ *   - LANDED here: config resolution (spec §7 keys, code-side defaults,
+ *     `enabled` OMITTED from ConfigDefaults → resolveDevAgentGate, the #1001
+ *     anti-mechanism), the tick loop's early no-op gates (single-machine strict
+ *     no-op BEFORE any state is touched), the per-tick peer-classification pass
+ *     (composing the pure C₀ helpers), the §3.4 election over live candidates,
+ *     the M11 comparison-universe honesty accounting, and the §6 status
+ *     snapshot shape.
+ *   - NOT YET here (Session B): dimension comparison + confirmation counters
+ *     (R2-L3 consecutive rule, M6 update-wave suppression, N8 warm-up
+ *     accounting beyond the tick gate), the §4 episode state machine + the ONE
+ *     attention item + §4.2.1 fix flow, the alarm-marker attach into
+ *     refreshPool's advert, jsonl transitions, and the status route.
+ *
+ * Fail toward silence (§3.3): any evaluator error → no emit this tick, an
+ * error counter on the status snapshot. A guard that can flood on its own
+ * malfunction re-creates the disease it treats.
+ *
+ * Supervision tier (N6): Tier 0 — fully deterministic; no LLM call anywhere.
+ * Signal-vs-authority: PURE SIGNAL (dev-gated dark; dry-run first even on dev).
+ */
+import { resolveDevAgentGate } from '../core/devAgentGate.js';
+import { getByPath } from '../core/machineCoherenceManifest.js';
+import { classifyPeer, computeDivergentRows, electRaiser, } from './machineCoherenceEvaluate.js';
+import { MachineCoherenceEpisodeManager } from './machineCoherenceEpisodeManager.js';
+/**
+ * Resolve the guard's config from the full agent config object. `enabled` is
+ * DELIBERATELY absent from ConfigDefaults — resolveDevAgentGate decides (LIVE
+ * on a development agent, DARK on the fleet; an explicit value always wins —
+ * the #1001 anti-mechanism). `dryRun` defaults TRUE even on dev (dry-run
+ * FIRST: evaluator runs, counters record would-raise, NO item).
+ */
+export function resolveMachineCoherenceConfig(config) {
+    const block = (getByPath(config, 'monitoring.machineCoherence') ?? {});
+    const num = (key, fallback) => {
+        const v = block[key];
+        return typeof v === 'number' && Number.isFinite(v) ? v : fallback;
+    };
+    return {
+        enabled: resolveDevAgentGate(typeof block.enabled === 'boolean' ? block.enabled : undefined, config),
+        dryRun: typeof block.dryRun === 'boolean' ? block.dryRun : true,
+        flagConfirmTicks: num('flagConfirmTicks', 2),
+        versionSkewGraceMs: num('versionSkewGraceMs', 2_700_000), // 45 min
+        resolveTicks: num('resolveTicks', 3),
+        escalateAfterMs: num('escalateAfterMs', 86_400_000), // 24 h
+        advertStaleMs: num('advertStaleMs', 300_000), // 5 min (M5)
+        warmupTicks: num('warmupTicks', 4), // N8
+        reopenWindowMs: num('reopenWindowMs', 3_600_000), // 60 min (M2)
+        maxEpisodeItemsPerDay: num('maxEpisodeItemsPerDay', 3), // M2
+        suspendedEpisodeExpiryMs: num('suspendedEpisodeExpiryMs', 604_800_000), // 7 d (M1)
+        raiserTakeoverTicks: num('raiserTakeoverTicks', 10), // C1/R2-M1
+        flappingLatchReopens: num('flappingLatchReopens', 3), // R2-N4
+        episodeAppendBudget: num('episodeAppendBudget', 6), // R3-M5
+        episodeAppendWindowMs: num('episodeAppendWindowMs', 21_600_000), // 6 h (R3-M5)
+        fixVerifyTicks: num('fixVerifyTicks', 10), // R2-M3-v
+    };
+}
+/** The guard's own posture, derived from resolved config (feeds candidacy). */
+export function selfPostureOf(cfg) {
+    return cfg.enabled ? (cfg.dryRun ? 'dry-run' : 'live') : 'dark';
+}
+export class MachineCoherenceSentinel {
+    deps;
+    cfg;
+    lastTickAtMs = 0;
+    ticks = 0;
+    errors = 0;
+    /** Post-boot warm-up accounting (N8): ticks completed since construction. */
+    ticksSinceBoot = 0;
+    lastClassified = [];
+    lastRegisteredOnline = 0;
+    lastRaiser = null;
+    lastCandidates = [];
+    /** §3.3 confirmation engine: per-row consecutive-tick + grace-clock state. */
+    rowState = new Map();
+    /** The row identities present LAST tick (R2-L3 consecutive detection). */
+    lastTickRowIds = new Set();
+    /** Cumulative count of confirmation transitions (never decremented). */
+    skewsConfirmed = 0;
+    /** The §4 episode machinery (constructed only when a stateDir is provided). */
+    episode;
+    /** Effects the last tick produced, awaiting execution by the caller (server). */
+    pendingEffects = [];
+    constructor(deps, cfg) {
+        this.deps = deps;
+        this.cfg = cfg;
+        const dir = this.deps.stateDir?.() ?? null;
+        if (dir)
+            this.episode = new MachineCoherenceEpisodeManager(dir, cfg);
+    }
+    /**
+     * Drain the effects the last reconcile produced (raise/append/resolve). The
+     * caller (server) executes them against the telegram adapter, keeping the
+     * sentinel Tier-0 and its tick synchronous. Empty on a dark/no-episode agent.
+     */
+    drainPendingEffects() {
+        const out = this.pendingEffects;
+        this.pendingEffects = [];
+        return out;
+    }
+    /** Passthrough for the conversational reply path (b3): the durable "leave it" ack. */
+    setOperatorAck(ack) {
+        this.episode?.setOperatorAck(ack);
+    }
+    /**
+     * Operator "fix it" approval passthrough (§4.2.1-i). The caller (conversational
+     * reply path) has verified the sender is the topic's VERIFIED operator (Know
+     * Your Principal) and passes `verifiedOperator`; `proposalHash` is the display-
+     * integrity authority. Returns the transition + any effects (an `execute-fix`
+     * for the divergent==raiser case) the caller executes immediately. A dark/
+     * unwired guard is a no-op refusal.
+     */
+    approveFix(args) {
+        if (!this.episode)
+            return { result: { ok: false, reason: 'guard-not-active' }, effects: [] };
+        return this.episode.approveFix({ proposalHash: args.proposalHash, verifiedOperator: args.verifiedOperator, now: args.now ?? (this.deps.now ?? Date.now)() });
+    }
+    /**
+     * Whether this tick is still inside the N8 post-boot warm-up window:
+     * `MachinePoolRegistry` is in-memory, so a local restart wipes every peer's
+     * advert until the next 30s pull — for `warmupTicks` after boot,
+     * `unknown`/`advert-stale` classifications must count toward NOTHING (no
+     * confirmation progress, no version-class grace clock). The classification
+     * itself still runs (the status snapshot stays honest); the CONSUMERS of
+     * warm-up (confirmation counters, Session B) read this flag.
+     */
+    inWarmup() {
+        return this.ticksSinceBoot < this.cfg.warmupTicks;
+    }
+    /**
+     * One evaluator tick (rides the existing 30s peerPresenceTick — no timer of
+     * its own). Runs only when the guard resolves live or dry-run; the caller
+     * owns the gate (a dark guard never constructs/ticks the sentinel). Fails
+     * toward silence: any error increments the error counter and emits nothing.
+     */
+    tick() {
+        this.ticks += 1;
+        this.ticksSinceBoot += 1;
+        const nowMs = (this.deps.now ?? Date.now)();
+        this.lastTickAtMs = nowMs;
+        try {
+            const self = this.deps.selfMachineId();
+            const online = this.deps.listCapacities().filter((c) => c.online);
+            this.lastRegisteredOnline = online.length;
+            // Single-machine strict no-op (§3.3): the comparison set is {self} —
+            // short-circuit at fewer than 2 members BEFORE any state is touched.
+            if (online.length < 2 || self === null) {
+                this.lastClassified = [];
+                this.lastRaiser = null;
+                this.lastCandidates = [];
+                // Below 2 comparable members → no divergence is possible; the whole
+                // confirmation engine resets (R2-L3: every row's participants dropped).
+                this.rowState.clear();
+                this.lastTickRowIds = new Set();
+                return;
+            }
+            // Per-machine classification (M11 universe honesty: every ONLINE machine
+            // is accounted — one that cannot be compared classifies `unknown`/
+            // `advert-stale`/`advert-rejected`, surfaced, never silently coherent).
+            this.lastClassified = online.map((c) => classifyPeer(c, nowMs, this.cfg.advertStaleMs));
+            // §3.4 election: candidates are the machines whose guard posture reads
+            // 'live'. Self's posture is known LOCALLY (resolved config — authoritative
+            // over our own possibly-stale advert echo); peers' via their adverts.
+            const selfLive = selfPostureOf(this.cfg) === 'live';
+            const candidates = this.lastClassified
+                .filter((p) => (p.machineId === self ? selfLive : p.advert?.guard === 'live'))
+                .map((p) => p.machineId);
+            this.lastCandidates = candidates;
+            this.lastRaiser = electRaiser(candidates, this.deps.leaseHolderMachineId());
+            // ── §3.3 dimension comparison + confirmation counters (R2-L3, M6) ──
+            this.updateConfirmation(nowMs);
+            // ── §4 episode reconcile (when the durable machinery is wired) ──
+            if (this.episode && !this.inWarmup()) {
+                const online = new Set(this.lastClassified.map((p) => p.machineId));
+                const compared = new Set(this.lastClassified.filter((p) => p.cls === 'compared').map((p) => p.machineId));
+                const nick = this.deps.nicknameOf ?? ((m) => m);
+                const effects = this.episode.reconcile({
+                    confirmedRows: this.confirmedSkewRows(),
+                    comparedMachineIds: compared,
+                    onlineMachineIds: online,
+                    selfMachineId: self,
+                    raiserMachineId: this.lastRaiser,
+                    leaseHolderMachineId: this.deps.leaseHolderMachineId(),
+                    nicknameOf: nick,
+                    now: nowMs,
+                });
+                const expiries = this.episode.expireIfStale(nowMs, nick);
+                this.pendingEffects.push(...effects, ...expiries);
+            }
+        }
+        catch {
+            // Fail toward silence (§3.3): no emit, a visible error counter. The
+            // confirmation state is LEFT INTACT on an error tick (a transient pool-read
+            // fault must not fabricate a participant-drop reset); the next clean tick
+            // recomputes over fresh data.
+            this.errors += 1;
+        }
+    }
+    /**
+     * §3.3 confirmation engine (R2-L3 consecutive rule + M6 update-wave
+     * suppression). Runs over the CURRENTLY-`compared` machines (self included —
+     * self records its own advert every beat), turns the raw per-tick divergences
+     * into confirmed rows, and never raises anything (the episode/alarm machinery
+     * is Session B). Pure state transitions; the caller owns fail-toward-silence.
+     *
+     * The consecutive rule (R2-L3): a row's confirmation counts ONLY ticks in which
+     * the row's identity (which encodes every participant's clamped value) is
+     * present. Because a participant dropping out (offline / unknown / advert-stale)
+     * either vanishes the identity or changes it, the old identity leaves
+     * `currentIds`, its counter is dropped, and a re-appearance starts fresh at 1 —
+     * one flapping reading can never accumulate toward confirmation.
+     *
+     * M6 update-wave suppression: FLAG rows are suppressed while ANY version skew
+     * exists among the compared machines (a differing version OR an open patch-only
+     * grace window — an update that changes a flag's resolved default would else
+     * alarm HIGH mid-wave and auto-resolve). Once every version agrees, residual
+     * flag skew confirms normally.
+     */
+    updateConfirmation(nowMs) {
+        const compared = this.lastClassified
+            .filter((p) => p.cls === 'compared' && !!p.advert)
+            .map((p) => ({ machineId: p.machineId, advert: p.advert }));
+        let rows = computeDivergentRows(compared);
+        // M6: suppress FLAG rows while a version skew (differing version or open
+        // grace) is present among the compared machines.
+        const hasVersionSkew = new Set(compared.map((c) => c.advert.instarVersion)).size > 1;
+        if (hasVersionSkew)
+            rows = rows.filter((r) => r.dimension !== 'flag');
+        const currentIds = new Set(rows.map((r) => r.identity));
+        // Increment consecutive counters for rows present this tick; a row whose
+        // identity was NOT present last tick (re)starts at 1 with a fresh grace clock.
+        for (const r of rows) {
+            const existing = this.rowState.get(r.identity);
+            if (existing && this.lastTickRowIds.has(r.identity)) {
+                existing.consecutiveTicks += 1;
+                existing.row = r; // refresh the row snapshot (nicknames etc. are not in the identity)
+            }
+            else {
+                this.rowState.set(r.identity, { dimension: r.dimension, row: r, consecutiveTicks: 1, firstSeenAtMs: nowMs, confirmed: false });
+            }
+        }
+        // Drop rows that vanished this tick (R2-L3 reset — a participant left the set,
+        // the pair equalized, or M6 suppressed a flag row): their counter is gone.
+        for (const id of [...this.rowState.keys()]) {
+            if (!currentIds.has(id))
+                this.rowState.delete(id);
+        }
+        // Confirmation predicate per dimension.
+        for (const st of this.rowState.values()) {
+            if (st.confirmed)
+                continue;
+            const doConfirm = st.dimension === 'version' && st.row.versionSeverity === 'patch-only'
+                // Patch-only version skew: confirmed after versionSkewGraceMs of
+                // CONTINUOUS skew (a normal rolling update would else cry wolf).
+                ? nowMs - st.firstSeenAtMs >= this.cfg.versionSkewGraceMs
+                // flag / major-minor version / manifest-class / protocol: N consecutive ticks.
+                : st.consecutiveTicks >= this.cfg.flagConfirmTicks;
+            if (doConfirm) {
+                st.confirmed = true;
+                this.skewsConfirmed += 1;
+            }
+        }
+        this.lastTickRowIds = currentIds;
+    }
+    /** The currently-confirmed skew rows (C₁b-ii — Session B's episode machinery
+     *  consumes these; the status route exposes their count). Pure read. */
+    confirmedSkewRows() {
+        return [...this.rowState.values()].filter((s) => s.confirmed).map((s) => s.row);
+    }
+    /** The rows still accruing consecutive ticks (divergent, not yet confirmed). */
+    pendingSkewRows() {
+        return [...this.rowState.values()].filter((s) => !s.confirmed).map((s) => s.row);
+    }
+    /**
+     * The GuardRegistry runtime getter (GUARD-POSTURE-ENDPOINT-SPEC §2.1): a
+     * synchronous in-memory read the /guards endpoint snapshots per request.
+     * `expectRuntime:true` on the GUARD_MANIFEST entry requires the C₁b server-boot
+     * wiring to register THIS at boot. `enabled`/`dryRun` come from the resolved
+     * config; `lastTickAt` drives the on-stale grading (a constructed-but-never-
+     * ticking guard reads stale, never "on"). Pure — never mutates.
+     */
+    guardStatus() {
+        return { enabled: this.cfg.enabled, dryRun: this.cfg.dryRun, lastTickAt: this.lastTickAtMs };
+    }
+    /** The §6 status snapshot (pure read — never mutates). */
+    status() {
+        const counts = { compared: 0, unknown: 0, advertStale: 0, advertRejected: 0 };
+        for (const p of this.lastClassified) {
+            if (p.cls === 'compared')
+                counts.compared += 1;
+            else if (p.cls === 'unknown')
+                counts.unknown += 1;
+            else if (p.cls === 'advert-stale')
+                counts.advertStale += 1;
+            else
+                counts.advertRejected += 1;
+        }
+        const self = this.deps.selfMachineId();
+        // Self is always comparable (§3.3): a below-2 pool reports compared=1.
+        const machinesCompared = this.lastClassified.length === 0 ? (self !== null ? 1 : 0) : counts.compared;
+        return {
+            enabled: this.cfg.enabled,
+            dryRun: this.cfg.dryRun,
+            lastTickAt: this.lastTickAtMs ? new Date(this.lastTickAtMs).toISOString() : null,
+            machinesRegisteredOnline: this.lastRegisteredOnline,
+            machinesCompared,
+            peerClassifications: counts,
+            raiser: {
+                machineId: this.lastRaiser,
+                isSelf: this.lastRaiser !== null && this.lastRaiser === self,
+                candidates: [...this.lastCandidates],
+            },
+            openEpisode: this.episode?.status().openEpisode ?? null,
+            episodeCounters: this.episode?.status().counters,
+            counters: {
+                ticks: this.ticks,
+                skewsConfirmed: this.skewsConfirmed,
+                confirmedRows: this.confirmedSkewRows().length,
+                pendingRows: this.pendingSkewRows().length,
+                errors: this.errors,
+            },
+        };
+    }
+}
+//# sourceMappingURL=MachineCoherenceSentinel.js.map

package/dist/monitoring/MachineCoherenceSentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineCoherenceSentinel.js","sourceRoot":"","sources":["../../src/monitoring/MachineCoherenceSentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,WAAW,GAIZ,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,8BAA8B,EAAsB,MAAM,qCAAqC,CAAC;AAkCzG;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA+B;IAC3E,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,IAAI,EAAE,CAA4B,CAAC;IAClG,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAU,EAAE;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpE,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,mBAAmB,CAC1B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC9D,MAAwC,CACzC;QACD,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC/D,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC5C,kBAAkB,EAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAAE,SAAS;QACnE,YAAY,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QACpC,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,OAAO;QAC5D,aAAa,EAAE,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,aAAa;QAC3D,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK;QACzC,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,cAAc;QAChE,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,KAAK;QAC7D,wBAAwB,EAAE,GAAG,CAAC,0BAA0B,EAAE,WAAW,CAAC,EAAE,WAAW;QACnF,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,EAAE,WAAW;QAChE,oBAAoB,EAAE,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,QAAQ;QAC9D,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ;QAC5D,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,EAAE,UAAU,CAAC,EAAE,cAAc;QAC/E,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,UAAU;KACtD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAA+D;IAC3F,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AA6CD,MAAM,OAAO,wBAAwB;IAsBhB;IACA;IAtBX,YAAY,GAAG,CAAC,CAAC;IACjB,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,CAAC,CAAC;IACnB,6EAA6E;IACrE,cAAc,GAAG,CAAC,CAAC;IACnB,cAAc,GAAqB,EAAE,CAAC;IACtC,oBAAoB,GAAG,CAAC,CAAC;IACzB,UAAU,GAAkB,IAAI,CAAC;IACjC,cAAc,GAAa,EAAE,CAAC;IACtC,8EAA8E;IACtE,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,0EAA0E;IAClE,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,wEAAwE;IAChE,cAAc,GAAG,CAAC,CAAC;IAC3B,+EAA+E;IACvE,OAAO,CAAkC;IACjD,iFAAiF;IACzE,cAAc,GAAoB,EAAE,CAAC;IAE7C,YACmB,IAAkC,EAClC,GAAmC;QADnC,SAAI,GAAJ,IAAI,CAA8B;QAClC,QAAG,GAAH,GAAG,CAAgC;QAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;QAC3C,IAAI,GAAG;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,mBAAmB;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sFAAsF;IACtF,cAAc,CAAC,GAAY;QACzB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAuE;QAChF,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7F,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/J,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1C,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;gBACzB,oEAAoE;gBACpE,wEAAwE;gBACxE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACxF,uEAAuE;YACvE,2EAA2E;YAC3E,sEAAsE;YACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc;iBACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC;iBAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;YACjC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC5E,sEAAsE;YACtE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC/B,mEAAmE;YACnE,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBACrC,aAAa,EAAE,IAAI,CAAC,iBAAiB,EAAE;oBACvC,kBAAkB,EAAE,QAAQ;oBAC5B,gBAAgB,EAAE,MAAM;oBACxB,aAAa,EAAE,IAAI;oBACnB,eAAe,EAAE,IAAI,CAAC,UAAU;oBAChC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACtD,UAAU,EAAE,IAAI;oBAChB,GAAG,EAAE,KAAK;iBACX,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,4EAA4E;YAC5E,0EAA0E;YAC1E,8BAA8B;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,kBAAkB,CAAC,KAAa;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc;aACjC,MAAM,CAAC,CAAC,CAAC,EAA2E,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;aAC1H,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAE9D,IAAI,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1C,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACrF,IAAI,cAAc;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;QAEtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,yEAAyE;QACzE,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,gBAAgB,IAAI,CAAC,CAAC;gBAC/B,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,oEAAoE;YACxF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACjI,CAAC;QACH,CAAC;QACD,+EAA+E;QAC/E,2EAA2E;QAC3E,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,SAAS;gBAAE,SAAS;YAC3B,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,YAAY;gBACrF,iEAAiE;gBACjE,iEAAiE;gBACjE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBACzD,+EAA+E;gBAC/E,CAAC,CAAC,EAAE,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACrD,IAAI,SAAS,EAAE,CAAC;gBACd,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;IACnC,CAAC;IAED;4EACwE;IACxE,iBAAiB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,gFAAgF;IAChF,eAAe;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IACH,WAAW;QACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAC/F,CAAC;IAED,0DAA0D;IAC1D,MAAM;QACJ,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;gBAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;iBAC1C,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;iBAC7C,IAAI,CAAC,CAAC,GAAG,KAAK,cAAc;gBAAE,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;;gBACtD,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,uEAAuE;QACvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtG,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;YACzB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;YACvB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAChF,wBAAwB,EAAE,IAAI,CAAC,oBAAoB;YACnD,gBAAgB;YAChB,mBAAmB,EAAE,MAAM;YAC3B,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,MAAM,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;gBAC5D,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;aACrC;YACD,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,WAAW,IAAI,IAAI;YACvD,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,QAAQ;YAChD,QAAQ,EAAE;gBACR,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM;gBAC9C,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM;gBAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/monitoring/guardManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardManifest.d.ts","sourceRoot":"","sources":["../../src/monitoring/guardManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;qFAEiF;IACjF,cAAc,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;wEACoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;;2DAIuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB;4EACwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;wFACoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;qFACiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;oFAEgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,kBAAkB,EAuzB9C,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAiFvC,CAAC;AAEX,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAI/D;AAED,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,CAAC,CAIhD;AAED,wBAAgB,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,CAEjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,SAAS,kBAAkB,EAAmB,GACvD,MAAM,EAAE,CAgBV"}
+{"version":3,"file":"guardManifest.d.ts","sourceRoot":"","sources":["../../src/monitoring/guardManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;qFAEiF;IACjF,cAAc,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;wEACoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;;2DAIuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB;4EACwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;wFACoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;qFACiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;oFAEgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,kBAAkB,EAg1B9C,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,EAiFvC,CAAC;AAEX,qFAAqF;AACrF,wBAAgB,aAAa,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAI/D;AAED,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,CAAC,CAIhD;AAED,wBAAgB,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,CAEjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,SAAS,kBAAkB,EAAmB,GACvD,MAAM,EAAE,CAgBV"}

package/dist/monitoring/guardManifest.js

@@ -386,6 +386,31 @@ export const GUARD_MANIFEST = [
         component: 'AgentWorktreeReaper',
         description: 'Reclaims merged+clean+unused agent worktrees.',
     },
+    {
+        // Machine-coherence guard (machine-coherence-guard §6/§7, roadmap 4.1
+        // F4/P0-1). `enabled` is deliberately OMITTED from ConfigDefaults — the
+        // runtime resolves it through the developmentAgent dark-feature gate (dark
+        // on the fleet, live on a dev agent; dry-run first). defaultEnabled:false
+        // reflects the fleet default. expectRuntime:true — increment C₁b-i adds the
+        // server-boot construction + guardRegistry.register('monitoring.machineCoherence.enabled')
+        // callsite on the peerPresenceTick path, registered ONLY when the gate
+        // resolves enabled. The `missing` classification requires configEnabled===true
+        // (guardPostureView §precedence), so a dark fleet agent (gate → false) never
+        // constructs, never registers, and is never falsely graded `missing` — the
+        // ws13Reconcile/holdForStability expectRuntime:true precedent.
+        // NOT loadBearing (Frontloaded Decision D6): signal-only, no critical path
+        // consumes it yet, and loadBearing:true would raise G3 gap alarms on every
+        // fleet agent where the guard is deliberately dark.
+        key: 'monitoring.machineCoherence.enabled',
+        kind: 'config',
+        configPath: 'monitoring.machineCoherence.enabled',
+        defaultEnabled: false,
+        expectedTickMs: 30_000,
+        process: 'server',
+        expectRuntime: true,
+        component: 'MachineCoherenceSentinel',
+        description: 'Machine-coherence guard evaluator: compares version/resolved-flag/protocol/manifest across the agent\'s own ONLINE machines (the F4 skew class) and will raise ONE episode-scoped attention item from exactly ONE elected machine. Signal-only; MUTATES NOTHING.',
+    },
     {
         // `enabled` is deliberately OMITTED from ConfigDefaults — the runtime resolves
         // it through the developmentAgent dark-feature gate (dark on the fleet, live on