instar 1.3.800 → 1.3.802

package/dashboard/index.html

@@ -229,6 +229,18 @@
       background: #3a2a1b;
       color: #fbbf24;
     }
+    /* Genuine cross-machine duplicate (CMT-1936 part c): the SAME conversation
+       has a live session on 2+ machines at once — the real incoherency, loud
+       and red. (The same recurring job on each machine is benign and never
+       gets this badge.) */
+    .duplicate-badge {
+      padding: 1px 6px;
+      border-radius: 4px;
+      font-size: 10px;
+      font-weight: 700;
+      background: #4e1b1b;
+      color: #f87171;
+    }
     /* A session running on ANOTHER machine — now clickable; selecting it
        streams its terminal here via the cross-machine relay (§2.2). The badge
        already names the machine, so a slightly dimmed row is enough hint. */
@@ -4016,6 +4028,11 @@
     // per-machine empty-state strip. Populated only when the pool is enabled with
     // 2+ machines — single-machine agents never see the strip (strict no-op).
     let poolMachinesView = [];
+    // Session-listing hygiene (CMT-1936 part c): names of sessions the server
+    // flagged as GENUINE cross-machine duplicates (the SAME conversation live on
+    // >=2 machines at once). Same recurring job on each machine is benign and is
+    // never flagged. Fed by pool.duplicateTopics from /sessions?scope=pool.
+    let poolDuplicateSessionNames = new Set();
     let selfMachineNickname = null;
     let activeSession = null;
     let activeMachineId = null; // non-null when the active session streams from a peer (§2.2)
@@ -4370,6 +4387,7 @@
             <span class="model-badge ${model}">${model}</span>
             <span class="platform-badge ${platform}" title="${platformLabel}">${platformIcon}</span>
             ${session.machineNickname ? `<span class="machine-badge" title="Machine this session runs on">${escapeHtml(session.machineNickname)}</span>` : ''}
+            ${(session.duplicateTopic === true || poolDuplicateSessionNames.has(session.name)) ? `<span class="duplicate-badge" title="Genuine cross-machine duplicate: this conversation has a live session on more than one machine at once">⚠ duplicate</span>` : ''}
             <span>${elapsed}</span>
           </div>
           ${telemetryHtml}
@@ -4977,6 +4995,13 @@
         poolMachinesView = (j.pool && j.pool.enabled && Array.isArray(j.pool.machines) && j.pool.machines.length >= 2)
           ? j.pool.machines
           : [];
+        // Genuine cross-machine duplicates (server-computed): collect the flagged
+        // session NAMES so both local (WS-fed) and remote tiles can badge — the
+        // local row never carries the flag itself (it arrives via WebSocket).
+        poolDuplicateSessionNames = new Set(
+          (j.pool && Array.isArray(j.pool.duplicateTopics) ? j.pool.duplicateTopics : [])
+            .flatMap(d => Array.isArray(d.sessions) ? d.sessions : [])
+        );
         renderSessionList();
       } catch { /* best-effort — peers may be offline; next tick retries */ }
     }

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAgmDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAonBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAivmBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAgmDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAonBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuzmBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -16745,6 +16745,60 @@ export async function startServer(options) {
             });
         }
         // ── OrphanedWorkSentinel (the silent-uncommitted-death backstop) ──────────
+        // ── SelfActionGovernor (unified-self-action-backpressure Increment B) ──
+        // ONE in-process admission chokepoint every registered self-triggered
+        // action rides (age-kill, external-hog kill, proactive swap, beacon
+        // notify/liveness). Ships OBSERVE-ONLY on every class, fleet-wide (FD1):
+        // admit() records would-deny verdicts and always allows; the per-class
+        // enforce flip is the operator's later action. INIT-ONCE process-global
+        // anchor; emergencyDisable is read LIVE (PATCH /config applies with no
+        // restart). Construction is guarded — a failure leaves the module-level
+        // governor uninitialized (disabled-passthrough admits), never a dead boot.
+        let _selfActionGovernor;
+        try {
+            const { initSelfActionGovernor } = await import('../monitoring/selfaction/governor.js');
+            _selfActionGovernor = initSelfActionGovernor({
+                stateDir: config.stateDir,
+                readEmergencyDisable: () => liveConfig.get('intelligence.selfActionGovernor.emergencyDisable', config.intelligence?.selfActionGovernor?.emergencyDisable ?? false) === true,
+                readClassesConfig: () => liveConfig.get('intelligence.selfActionGovernor.classes', (config.intelligence?.selfActionGovernor?.classes ?? undefined)),
+                // Census discipline (spec SC6-1): governor-owned, sampled OFF the hot
+                // path (the governor's own slow tick), INDEPENDENT of any governed
+                // controller's candidate enumeration — the STATE-store read, never the
+                // reaper's own listRunningSessions.
+                readCensus: () => ({
+                    value: state.listSessions({ status: 'running' }).length,
+                    asOf: Date.now(),
+                    confidence: 'high',
+                }),
+                configuredSessionCap: () => config.sessions?.maxSessions,
+                // FD9 level gate input: the REGISTERED machine count (not online peers).
+                registeredMachineCount: () => Math.max(1, machinePoolRegistry?.getCapacities().length ?? 1),
+                emitAttention: (item) => {
+                    void telegram?.createAttentionItem({
+                        id: item.id,
+                        title: item.title,
+                        summary: item.body.slice(0, 160),
+                        description: item.body,
+                        category: 'self-action-governor',
+                        priority: item.priority,
+                        sourceContext: item.sourceContext,
+                    });
+                },
+            });
+            guardRegistry.register('intelligence.selfActionGovernor.enabled', () => _selfActionGovernor.guardRuntimeStatus());
+            console.log(pc.dim('  SelfActionGovernor initialized (observe-only — unified self-action backpressure)'));
+        }
+        catch (err) {
+            console.error('[self-action-governor] init failed (admits pass through this boot):', err instanceof Error ? err.message : String(err));
+            _selfActionGovernor = undefined;
+            DegradationReporter.getInstance().report({
+                feature: 'SelfActionGovernor',
+                primary: 'self-action admission chokepoint (observe-only would-deny measurement)',
+                fallback: 'governor uninitialized for this boot — every admit resolves disabled-passthrough (allow)',
+                reason: `init failed: ${err instanceof Error ? err.message : String(err)}`,
+                impact: 'Self-action would-deny telemetry is not collected this boot; the retrofitted emit paths behave exactly as before (observe mode never blocks anyway).',
+            });
+        }
         // Detects agent worktrees with uncommitted work whose owning session is dead
         // + settled, records them durably, and raises ONE deduped agent-health notice
         // — the case the PromiseBeacon escalation ladder can't see (nothing registered
@@ -17506,7 +17560,15 @@ export async function startServer(options) {
                                 ...(() => {
                                     try {
                                         return {
-                                            coherenceAdvert: buildCoherenceAdvert({ boot: config, liveGet: (path, fallback) => liveConfig.get(path, fallback) }, { instarVersion: ProcessIntegrity.getInstance()?.runningVersion ?? 'unknown', beatSeq: _coherenceBeatSeq++ }),
+                                            coherenceAdvert: buildCoherenceAdvert({
+                                                boot: config,
+                                                liveGet: (path, fallback) => liveConfig.get(path, fallback),
+                                                // unified-self-action-backpressure INT7-1: the mode
+                                                // rows read `demoted` from governor RUNTIME state —
+                                                // a config-only read would advertise `enforce` on a
+                                                // runtime-demoted machine and defeat the skew alarm.
+                                                governorClassMode: (controllerId) => _selfActionGovernor?.getClassMode(controllerId) ?? 'observe',
+                                            }, { instarVersion: ProcessIntegrity.getInstance()?.runningVersion ?? 'unknown', beatSeq: _coherenceBeatSeq++ }),
                                         };
                                     }
                                     catch {