instar 1.3.90 → 1.3.92

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -30,6 +30,23 @@ set -uo pipefail   # NOTE: -e intentionally omitted; field lookups for optional
 # Read hook input from stdin
 HOOK_INPUT=$(cat)
 
+# ── Anchor to the agent home, NOT the session's CWD ───────────────────
+# All state paths below are relative (.instar/autonomous/<topic>.local.md, the
+# registry, the legacy file). The Stop hook inherits the session's working
+# directory — and a session working inside a git worktree (~/.instar/agents/
+# <name>/.worktrees/<slug>) would resolve those paths against the WORKTREE,
+# which has no autonomous state, so the hook sees "no active job" and lets the
+# session exit — silently stranding the autonomous loop. Anchor to the agent
+# home (where this hook is installed) so the paths resolve regardless of CWD.
+# (Root cause of the 2026-05-29 strand: CWD was a worktree.)
+# Anchor to CLAUDE_PROJECT_DIR — Claude Code always sets it for hooks to the
+# agent home (the hook itself is wired as `${CLAUDE_PROJECT_DIR}/.claude/...`).
+# Guard on its `.instar` so a misconfigured value can't send us somewhere wrong;
+# when unset (e.g. an isolated test harness) we stay in the caller's CWD.
+if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]] && [[ -d "${CLAUDE_PROJECT_DIR}/.instar" ]]; then
+  cd "$CLAUDE_PROJECT_DIR" || true
+fi
+
 REGISTRY_FILE=".instar/topic-session-registry.json"
 RECOVERY_AUDIT=".instar/autonomous-recovery.jsonl"
 LEGACY_STATE=".instar/autonomous-state.local.md"

package/dashboard/index.html

@@ -801,6 +801,18 @@
     /* Page intro — one-sentence grounding right under the title so terms like
        "it" / "the system" later in the page have a clear referent. */
     .ph-intro { font-size: 17px; color: var(--text); line-height: 1.55; margin: 0; max-width: 720px; }
+    /* ── Machines tab (Multi-Machine Session Pool §L2) — reuses .ph-root calm type ── */
+    .machine-card { border: 1px solid var(--border, #2a2a2a); border-radius: 10px; padding: 14px 16px; margin-bottom: 12px; max-width: 720px; background: var(--panel-bg, transparent); }
+    .machine-head { display: flex; align-items: center; gap: 10px; }
+    .machine-dot { display: inline-block; width: 10px; height: 10px; border-radius: 50%; flex: 0 0 auto; }
+    .machine-dot.ok { background: var(--accent); }       /* online */
+    .machine-dot.warn { background: #f59e0b; }            /* clock out of sync — paused */
+    .machine-dot.off { background: var(--text-dim); }     /* offline */
+    .machine-nick { font-size: 19px; font-weight: 600; color: var(--text-bright); background: transparent; border: 1px solid transparent; border-radius: 6px; padding: 3px 6px; min-width: 120px; }
+    .machine-nick:hover { border-color: var(--border, #2a2a2a); }
+    .machine-nick:focus { border-color: var(--accent); outline: none; background: rgba(255,255,255,0.03); }
+    .machine-badge { font-size: 12px; font-weight: 600; color: var(--accent); border: 1px solid var(--accent-dim); border-radius: 999px; padding: 2px 9px; }
+    .machine-meta { font-size: 15px; color: var(--text-dim); line-height: 1.55; margin-top: 6px; }
     /* Status color tokens — calm, never alarming. The dot is a scan-aid:
        glance the collapsed list, see which problems are still being worked
        on (amber), cause known (blue), or worked out (green). */
@@ -2624,6 +2636,7 @@
           <button class="tab" data-tab="threadline" onclick="switchTab('threadline')">Threadline</button>
           <button class="tab" data-tab="evidence" onclick="switchTab('evidence')">Evidence</button>
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
+          <button class="tab" data-tab="machines" onclick="switchTab('machines')">Machines</button>
         </nav>
       </div>
       <div class="vital-signs" id="vitalSigns">
@@ -3136,6 +3149,21 @@
       </details>
     </div>
 
+    <!-- machines tab (Multi-Machine Session Pool §L2) -->
+    <div id="machinesPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:baseline">
+        <h2 class="ph-title">Machines</h2>
+        <div id="machinesStamp" class="ph-stamp" aria-live="polite"></div>
+      </div>
+      <p class="ph-intro">Every computer this agent is set up on. Each one gets a friendly name you can change — and once it has a name, you can tell the agent "move this conversation to the mini" and it knows which machine you mean. The agent shares its conversations across these machines so it can handle more at once.</p>
+      <div id="machinesHeadline" class="ph-headline-wrap" aria-live="polite"></div>
+      <section class="ph-section">
+        <h3 class="ph-h">The machines</h3>
+        <p class="ph-h-sub">Click a name to rename it. The "dispatcher" is the one machine currently handing out new conversations.</p>
+        <div id="machinesList"></div>
+      </section>
+    </div>
+
     <div id="evidenceTab" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:center">
         <h2 style="margin:0">Evidence</h2>
@@ -4375,6 +4403,13 @@
         onActivate: () => { if (typeof startProcessHealth === 'function') startProcessHealth(); },
         onDeactivate: () => { if (typeof stopProcessHealth === 'function') stopProcessHealth(); },
       },
+      {
+        id: 'machines',
+        panels: ['machinesPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof startMachines === 'function') startMachines(); },
+        onDeactivate: () => { if (typeof stopMachines === 'function') stopMachines(); },
+      },
       {
         id: 'secrets',
         panels: ['secretsPanel'],
@@ -4530,6 +4565,79 @@
       return resp.json();
     }
 
+    // ── Machines Tab (Multi-Machine Session Pool §L2) ─────────────────
+    let __machinesTimer = null;
+    function startMachines() { loadMachines(); if (!__machinesTimer) __machinesTimer = setInterval(loadMachines, 15000); }
+    function stopMachines() { if (__machinesTimer) { clearInterval(__machinesTimer); __machinesTimer = null; } }
+    function machineSpecLine(hw) {
+      if (!hw) return 'specs not reported yet';
+      const chip = (hw.cpuModel && hw.cpuModel !== 'unknown') ? hw.cpuModel : ((hw.platform || '') + (hw.arch ? ' ' + hw.arch : '')).trim();
+      const cores = hw.cpuCores ? hw.cpuCores + ' cores' : '';
+      const ram = hw.totalMemBytes ? Math.round(hw.totalMemBytes / 1073741824) + ' GB' : '';
+      return [chip, cores, ram].filter(Boolean).join(' · ') || 'specs not reported yet';
+    }
+    function machineBusyWord(m) {
+      if (m.loadAvg == null) return '';
+      if (m.loadAvg < 1) return 'idle';
+      if (m.loadAvg < 4) return 'working';
+      return 'busy';
+    }
+    function renderMachineCard(m, routerHolder) {
+      const online = !!m.online;
+      const dot = !online ? 'off' : (m.clockSkewStatus === 'suspect-clock-removed' ? 'warn' : 'ok');
+      const statusWord = !online ? 'offline' : (m.clockSkewStatus === 'suspect-clock-removed' ? 'clock out of sync — paused for new conversations' : 'online');
+      const isRouter = !!(routerHolder && m.machineId === routerHolder);
+      const nick = m.nickname || m.machineId;
+      const busy = machineBusyWord(m);
+      const sessions = (m.activeSessionCount != null) ? (m.activeSessionCount + (m.maxSessions ? '/' + m.maxSessions : '') + ' conversation' + (m.activeSessionCount === 1 ? '' : 's')) : '';
+      const tail = [statusWord, busy, sessions].filter(Boolean).map(s => escapeHtml(s)).join(' · ');
+      return '<div class="machine-card">' +
+        '<div class="machine-head">' +
+          '<span class="machine-dot ' + dot + '" title="' + escapeHtml(statusWord) + '"></span>' +
+          '<input class="machine-nick" value="' + escapeHtml(nick) + '" data-mid="' + escapeHtml(m.machineId) + '" ' +
+            'onkeydown="if(event.key===\'Enter\'){this.blur();}" onblur="saveMachineNickname(this)" aria-label="machine nickname" />' +
+          (isRouter ? '<span class="machine-badge">dispatcher</span>' : '') +
+        '</div>' +
+        '<div class="machine-meta">' + escapeHtml(machineSpecLine(m.hardware)) + '</div>' +
+        '<div class="machine-meta">' + tail + '</div>' +
+      '</div>';
+    }
+    async function saveMachineNickname(input) {
+      const mid = input.getAttribute('data-mid');
+      const nickname = input.value.trim();
+      try {
+        await apiFetch('/pool/machines/' + encodeURIComponent(mid), {
+          method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nickname }),
+        });
+        loadMachines();
+      } catch (e) {
+        const hl = document.getElementById('machinesHeadline');
+        if (hl) hl.innerHTML = '<div class="ph-headline">Couldn\'t rename that machine: ' + escapeHtml(e.message) + '</div>';
+      }
+    }
+    async function loadMachines() {
+      const stamp = document.getElementById('machinesStamp');
+      const list = document.getElementById('machinesList');
+      const headline = document.getElementById('machinesHeadline');
+      if (!list) return;
+      try {
+        const data = await apiFetch('/pool');
+        if (stamp) stamp.textContent = new Date().toLocaleTimeString();
+        if (!data.enabled) {
+          if (headline) headline.innerHTML = '<div class="ph-headline">Running on a single machine right now — nothing to spread across yet.</div>';
+          list.innerHTML = '';
+          return;
+        }
+        const machines = data.machines || [];
+        const onlineCount = machines.filter(m => m.online).length;
+        if (headline) headline.innerHTML = '<div class="ph-headline">' + onlineCount + ' of ' + machines.length + ' machine' + (machines.length === 1 ? '' : 's') + ' online</div>';
+        const routerHolder = data.router && data.router.holder;
+        list.innerHTML = machines.length ? machines.map(m => renderMachineCard(m, routerHolder)).join('') : '<div class="machine-meta">No machines paired yet.</div>';
+      } catch (e) {
+        if (headline) headline.innerHTML = '<div class="ph-headline">Couldn\'t load machines: ' + escapeHtml(e.message) + '</div>';
+      }
+    }
+
     // ── Tokens Tab ──────────────────────────────────────────────────
     function fmtTokens(n) {
       if (n == null) return '0';

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAksDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAghOtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAksDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqtOtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -5245,6 +5245,13 @@ export async function startServer(options) {
         sessionManager.on('rateLimitedAtIdle', (sessionName) => {
             rateLimitSentinel.report(sessionName, 'idle-error');
         });
+        // Generic transient API errors (500/502/503, timeout, connection drop) ride the
+        // SAME backoff→verify→escalate lifecycle as throttles, with a faster backoff
+        // schedule (they usually clear in seconds). Generalizing the proven recovery to
+        // the whole transient-API class is the 2026-05-29 future-proofing ask (topic 13481).
+        sessionManager.on('apiErrorAtIdle', (sessionName) => {
+            rateLimitSentinel.report(sessionName, 'idle-error', { errorClass: 'transient-api' });
+        });
         if (rlsCfg.enabled !== false) {
             console.log(pc.green('  RateLimitSentinel enabled (server-throttle backoff + check-ins)'));
         }
@@ -8160,7 +8167,213 @@ export async function startServer(options) {
                 }
             }
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        // ── Multi-Machine Session Pool registry (§L2) — live MachineCapacity view for GET /pool ──
+        // Always instantiated (cheap); the feature stays dark behind the sessionPool stage gate.
+        // Self-attests hardware + records a self-heartbeat so GET /pool + the Machines tab show
+        // this machine online with its specs; peer liveness is fed from MachineHeartbeat.
+        let machinePoolRegistry;
+        try {
+            const poolMod = await import('../core/MachinePoolRegistry.js');
+            const osMod = await import('node:os');
+            const poolIdMgr = coordinator?.managers?.identityManager;
+            if (poolIdMgr) {
+                const failoverThresholdMs = (config.multiMachine?.failoverTimeoutMinutes ?? 15) * 60_000;
+                const clockSkewToleranceMs = config.multiMachine?.sessionPool?.clockSkewToleranceMs ?? 300_000;
+                machinePoolRegistry = new poolMod.MachinePoolRegistry({
+                    listMachines: () => poolIdMgr.getActiveMachines().map(({ machineId, entry }) => ({
+                        machineId,
+                        nickname: entry.nickname,
+                        hardware: entry.hardware,
+                    })),
+                    clockSkewToleranceMs,
+                    failoverThresholdMs,
+                    logger: (m) => console.log(pc.dim(`  [pool] ${m}`)),
+                });
+                const poolSelfId = machineHeartbeat?.config?.machineId ??
+                    (poolIdMgr.hasIdentity() ? poolIdMgr.loadIdentity().machineId : null);
+                if (poolSelfId) {
+                    try {
+                        poolIdMgr.recordSelfHardware(poolSelfId, poolMod.captureHardware());
+                    }
+                    catch { /* best-effort hardware self-attest */ }
+                    const refreshPool = () => {
+                        try {
+                            machinePoolRegistry.recordHeartbeat({
+                                machineId: poolSelfId,
+                                selfReportedLastSeen: new Date().toISOString(),
+                                loadAvg: osMod.loadavg()[0],
+                            });
+                            const hbApi = machineHeartbeat?.api;
+                            if (hbApi) {
+                                for (const r of hbApi.listAll()) {
+                                    if (r.machineId !== poolSelfId) {
+                                        machinePoolRegistry.recordHeartbeat({ machineId: r.machineId, selfReportedLastSeen: r.lastHeartbeatAt });
+                                    }
+                                }
+                            }
+                        }
+                        catch { /* best-effort pool refresh */ }
+                    };
+                    refreshPool();
+                    const poolTimer = setInterval(refreshPool, 30_000);
+                    if (typeof poolTimer.unref === 'function')
+                        poolTimer.unref();
+                }
+            }
+        }
+        catch (err) {
+            console.log(pc.dim(`  [pool] registry not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        // ── MeshRpc dispatcher (§L0) + SessionOwnership registry (§L3) ──
+        // Built when there's a machine identity. The ownership registry (L3) feeds
+        // the dispatcher's RBAC (ownerOf/placementTargetOf) + the place/claim/
+        // transfer/release handlers; read-class handlers (capacity/session-status)
+        // are live too. Single-machine uses the in-memory store; the cross-machine
+        // git-backed store swaps in for the Track-H proof (the registry is store-agnostic).
+        let meshRpcDispatcher;
+        let sessionOwnershipRegistry;
+        try {
+            const meshMod = await import('../core/MeshRpc.js');
+            const idMod = await import('../core/MachineIdentity.js');
+            const meshIdMgr = coordinator?.managers?.identityManager;
+            const meshSelfId = machineHeartbeat?.config?.machineId
+                ?? (meshIdMgr?.hasIdentity() ? meshIdMgr.loadIdentity().machineId : null);
+            if (meshIdMgr && meshSelfId) {
+                const meshClockToleranceMs = config.multiMachine?.sessionPool?.meshRpcClockToleranceMs ?? 30000;
+                const seenMeshNonces = new Map(); // `${sender}:${nonce}` → ts, age-pruned
+                const meshPruneMs = Math.max(meshClockToleranceMs * 4, 120_000);
+                // SessionOwnership registry (§L3) — in-memory store (single-machine correct;
+                // git-backed cross-machine store is the Track-H swap). Per-session nonce set.
+                const ownMod = await import('../core/SessionOwnershipRegistry.js');
+                const seenOwnNonces = new Set();
+                sessionOwnershipRegistry = new ownMod.SessionOwnershipRegistry({
+                    store: new ownMod.InMemorySessionOwnershipStore(),
+                    seenNonce: (k) => seenOwnNonces.has(k),
+                    recordNonce: (k) => seenOwnNonces.add(k),
+                    logger: (m) => console.log(pc.dim(`  ${m}`)),
+                });
+                const ownReg = sessionOwnershipRegistry;
+                // The §L3 ownership commands, routed from MeshRpc to the registry CAS.
+                const ownAction = (cmd, sender, env) => {
+                    if (cmd.type === 'place')
+                        return ownReg.cas({ type: 'place', machineId: cmd.machine }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'claim')
+                        return ownReg.cas({ type: 'claim', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'transfer')
+                        return ownReg.cas({ type: 'transfer', to: cmd.target }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'release')
+                        return ownReg.cas({ type: 'release', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    return { ok: false, reason: 'unsupported' };
+                };
+                // The §L4 owner-side deliverMessage receive handler (shared factory — same
+                // code path the tests exercise). Durable-receipt-before-processing with
+                // idempotent dedupe on messageId + the stale-ownership fence. Returns the
+                // deliverMessageAck the router waits on before advancing the platform offset.
+                // (Local processing hand-off to SessionManager is the Track-H staged
+                // activation; the durable receipt + ACK is the complete dark-phase contract.)
+                const deliverMod = await import('../core/DeliverMessageHandler.js');
+                const deliverSeenFallback = new Set(); // used only if the SQLite ledger is unavailable
+                const deliverMessageHandler = deliverMod.createDeliverMessageHandler({
+                    ownerEpochOf: (s) => ownReg.read(s)?.ownershipEpoch ?? null,
+                    recordReceipt: (messageId, session) => {
+                        if (messageLedger)
+                            return messageLedger.record(messageId, { platform: 'mesh', topic: session }).firstSeen;
+                        if (deliverSeenFallback.has(messageId))
+                            return false;
+                        deliverSeenFallback.add(messageId);
+                        return true;
+                    },
+                });
+                meshRpcDispatcher = new meshMod.MeshRpcDispatcher({
+                    verify: {
+                        selfMachineId: meshSelfId,
+                        verify: (canonical, signature, sender) => {
+                            const pem = meshIdMgr.getSigningPublicKeyPem(sender);
+                            if (!pem)
+                                return false;
+                            try {
+                                return idMod.verify(canonical, signature, pem);
+                            }
+                            catch {
+                                return false;
+                            }
+                        },
+                        isRegisteredPeer: (s) => meshIdMgr.isMachineActive(s),
+                        seenNonce: (s, n) => seenMeshNonces.has(`${s}:${n}`),
+                        now: () => Date.now(),
+                        clockToleranceMs: meshClockToleranceMs,
+                    },
+                    rbac: {
+                        routerHolder: () => coordinator?.getSyncStatus().leaseHolder ?? null,
+                        ownerOf: (s) => ownReg.ownerOf(s),
+                        placementTargetOf: (s) => ownReg.placementTargetOf(s),
+                    },
+                    recordNonce: (s, n) => {
+                        const t = Date.now();
+                        seenMeshNonces.set(`${s}:${n}`, t);
+                        if (seenMeshNonces.size > 5000) {
+                            for (const [k, v] of seenMeshNonces)
+                                if (t - v > meshPruneMs)
+                                    seenMeshNonces.delete(k);
+                        }
+                    },
+                    handlers: {
+                        'capacity-report': () => machinePoolRegistry?.getCapacities() ?? [],
+                        'session-status': () => machinePoolRegistry?.getCapacity(meshSelfId) ?? { machineId: meshSelfId },
+                        place: ownAction,
+                        claim: ownAction,
+                        transfer: ownAction,
+                        release: ownAction,
+                        deliverMessage: deliverMessageHandler,
+                    },
+                    logger: (m) => console.log(pc.dim(`  ${m}`)),
+                });
+            }
+        }
+        catch (err) {
+            console.log(pc.dim(`  [mesh-rpc] dispatcher not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        // ── Rollout gate (§Rollout): signed E2E result store + StageAdvancer ──────────
+        // The E2E result store backs GET /session-pool/e2e-results (observable gate state);
+        // StageAdvancer is the SOLE writer of multiMachine.sessionPool.stage (it passes the
+        // stageWriteGuard token; any other write throws stage-write-not-permitted). Always
+        // instantiated (cheap); inert until the pool activates past 'dark'.
+        let sessionPoolE2EResultStore;
+        try {
+            const e2eMod = await import('../core/SessionPoolE2EResultStore.js');
+            const stageMod = await import('../core/StageAdvancer.js');
+            const guardMod = await import('../config/stageWriteGuard.js');
+            const crypto = await import('node:crypto');
+            // HMAC over the agent's authToken — tamper-evident without a separate keystore.
+            const hmacKey = String(config.authToken ?? 'instar-session-pool-e2e');
+            const hmac = (c) => crypto.createHmac('sha256', hmacKey).update(c).digest('hex');
+            sessionPoolE2EResultStore = new e2eMod.SessionPoolE2EResultStore({
+                filePath: path.join(config.stateDir, 'session-pool-e2e-results.json'),
+                sign: hmac,
+                verifySig: (c, s) => {
+                    try {
+                        const exp = hmac(c);
+                        return s.length === exp.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(exp));
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            // StageAdvancer: the sole stage writer. Held for the rollout job/route to drive;
+            // constructed here so the write path (liveConfig + token) is wired in one place.
+            void new stageMod.StageAdvancer({
+                resultStore: sessionPoolE2EResultStore,
+                currentCommitSha: () => process.env.INSTAR_COMMIT_SHA ?? process.env.GITHUB_SHA ?? 'unknown',
+                readStage: () => liveConfig.get('multiMachine.sessionPool.stage', 'dark'),
+                writeStageConfig: (s) => liveConfig.set(guardMod.STAGE_CONFIG_PATH, s, { stageWriteToken: guardMod.STAGE_WRITE_TOKEN }),
+                audit: (event, detail) => console.log(pc.dim(`  [stage-advancer] ${event} ${JSON.stringify(detail)}`)),
+            });
+        }
+        catch (err) {
+            console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, sessionOwnershipRegistry, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
         // died mid-relay-episode, the persisted tunnel.json carries
         // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE