instar 1.3.905 → 1.3.907

package/dist/monitoring/MissingLoginSessionDetector.d.ts

@@ -0,0 +1,159 @@
+/**
+ * MissingLoginSessionDetector — signal-only guard that surfaces the
+ * "a live session is running on an account whose login has gone missing" gap
+ * BEFORE the session dies silently.
+ *
+ * The failure it closes (2026-07-22, the justin-gmail silent auth-death): a live
+ * autonomous session was running on an account whose LOCAL LOGIN went missing
+ * (the subscription pool flagged `identityDrift.repairState ===
+ * 'owner-relogin-required'`, `actualAccountId === 'missing-local-login'`) while
+ * that account still had ~92% of its quota free. The session coasted on a cached
+ * credential, then — once that credential expired — every turn began failing on
+ * auth and the session went SILENT for ~2.5 hours. NOTHING alerted the operator;
+ * they had to notice the silence themselves and re-login by hand. The drift WAS
+ * detected by the pool, but it was never raised as an alert, and the reactive
+ * standby classifier only fires when the user sends a message (which, for hours,
+ * they did not).
+ *
+ * This detector makes that gap loud + PROACTIVE: when a live session is bound to
+ * an account whose login is missing, it raises ONE deduped attention item naming
+ * the account and that a re-login is needed. It is SIGNAL-ONLY — it never swaps
+ * accounts, never re-logins, never touches a session. It only tells the operator
+ * (and future-me) that a running session is about to wall on a missing login.
+ *
+ * Why it is distinct from the existing surfaces (not a duplicate):
+ *   - The subscription pool DETECTS the drift, but raises no alert on it.
+ *   - The honest-standby StuckSignatureClassifier can name an auth failure, but
+ *     only reactively — when the user messages. A heads-down run with no inbound
+ *     message falls through it (exactly what happened). This fires proactively.
+ *   - It correlates two facts the others don't join: "login is gone" AND "a live
+ *     session depends on that account right now" — drift alone is not urgent;
+ *     drift under a live session is.
+ *
+ * Pure + injected: every environment read is a callback, so this module unit
+ * tests with zero real managers and no I/O.
+ */
+/** An account whose LOCAL login has gone missing (re-login required to recover). */
+export interface MissingLoginAccount {
+    accountId: string;
+    /** The login "slot" (config home) the account serves from — how a session is matched to it. */
+    configHome: string;
+}
+/** A live session and the login slot (config home) it is currently running on. */
+export interface LiveSessionBinding {
+    sessionName: string;
+    configHome: string;
+    /** Optional topic id, purely for the operator-facing message (never load-bearing). */
+    topicId?: number | null;
+}
+/** The attention item this detector emits (shape kept minimal + transport-agnostic). */
+export interface MissingLoginAttention {
+    title: string;
+    body: string;
+    priority: 'high';
+    /** Stable per-episode key so repeated ticks coalesce to ONE item. */
+    dedupKey: string;
+    source: 'missing-login-session';
+}
+export interface MissingLoginSessionDetectorDeps {
+    /** Dark gate. When false the detector is a strict no-op (never reads, never raises). */
+    enabled: () => boolean;
+    /**
+     * Observe-only mode. When true the detector computes the verdict and audits a
+     * would-raise, but does NOT raise the attention item (the graduated-rollout
+     * dry-run rung).
+     */
+    dryRun: () => boolean;
+    /** Accounts whose local login is currently missing (owner-relogin-required). */
+    getMissingLoginAccounts: () => MissingLoginAccount[];
+    /** The live sessions and which login slot (config home) each runs on. */
+    getLiveSessions: () => LiveSessionBinding[];
+    /** Raise a deduped attention item. Only called on a genuine gap when not in dryRun. */
+    raiseAttention: (item: MissingLoginAttention) => void;
+    /** Optional structured audit sink (every transition, including no-ops with a reason). */
+    audit?: (event: string, detail: Record<string, unknown>) => void;
+}
+/** One affected pairing: a missing-login account with the live sessions depending on it. */
+export interface StrandedSession {
+    accountId: string;
+    sessionNames: string[];
+}
+export interface MissingLoginTickResult {
+    ran: boolean;
+    /** True when at least one live session is running on a missing-login account. */
+    gapDetected: boolean;
+    /** The affected account→sessions pairings (empty when no gap). */
+    stranded: StrandedSession[];
+    /** Whether an attention item was actually raised (false in dryRun even on a gap). */
+    raised: boolean;
+}
+/** The resolved, typed config the detector runs with. */
+export interface MissingLoginSessionResolvedConfig {
+    /** Dev-agent gate: live on a development agent, dark on the fleet (unless set). */
+    enabled: boolean;
+    /** Dry-run first even on a dev agent: compute + audit, but do NOT raise. */
+    dryRun: boolean;
+}
+/** The raw config block shape (all optional — everything defaults). */
+export interface MissingLoginSessionConfigBlock {
+    enabled?: boolean;
+    dryRun?: boolean;
+}
+/**
+ * Resolve `monitoring.missingLoginSession` against the dev-agent gate.
+ * `resolveEnabled` is the injected `resolveDevAgentGate(explicit, config)` result
+ * (kept as a param so this module stays free of a hard import — the server wiring
+ * passes the real gate). `dryRun` defaults TRUE (the graduated-rollout first rung).
+ */
+export declare function resolveMissingLoginSessionConfig(block: MissingLoginSessionConfigBlock | undefined, resolveEnabled: (explicit: boolean | undefined) => boolean): MissingLoginSessionResolvedConfig;
+/** The guard-posture grade for `GET /guards`: dark ▸ dry-run ▸ live. */
+export declare function guardStatusFor(cfg: MissingLoginSessionResolvedConfig): 'dark' | 'dry-run' | 'live';
+/** The `status()` snapshot (the future `GET /pool/missing-login` body core). */
+export interface MissingLoginSessionStatus {
+    enabled: boolean;
+    dryRun: boolean;
+    lastTickAt: string | null;
+    /** The affected account→sessions pairings seen on the LAST tick. */
+    stranded: StrandedSession[];
+    counters: {
+        ticks: number;
+        raises: number;
+        wouldRaise: number;
+        errors: number;
+    };
+}
+/**
+ * The pure detector. One `tick()` = one evaluation. It raises at most one
+ * (deduped) aggregate attention item per episode; the attention layer's own
+ * dedup collapses repeated ticks so a persistent gap never floods.
+ */
+export declare class MissingLoginSessionDetector {
+    private readonly deps;
+    private readonly now;
+    private ticks;
+    private raises;
+    private wouldRaise;
+    private errors;
+    private lastTickAtMs;
+    private lastStranded;
+    constructor(deps: MissingLoginSessionDetectorDeps, now?: () => number);
+    /**
+     * One evaluation. Rides an existing shared timer (no timer of its own). Fails
+     * toward silence: any internal error increments the error counter and emits
+     * nothing — the shared tick must never crash. A dark guard is a strict no-op.
+     */
+    tick(): MissingLoginTickResult;
+    /** The read-surface snapshot (feeds the future GET route). */
+    status(): MissingLoginSessionStatus;
+    private audit;
+}
+/**
+ * Pure correlation: for each missing-login account, collect the live sessions
+ * bound to its login slot (config home). Only accounts with ≥1 dependent live
+ * session are stranded (drift alone, with no session on it, is not a gap).
+ */
+export declare function computeStranded(missing: MissingLoginAccount[], sessions: LiveSessionBinding[]): StrandedSession[];
+/** Build the operator-facing attention item for a confirmed gap. Plain language, no jargon. */
+export declare function buildAttention(stranded: StrandedSession[]): MissingLoginAttention;
+export declare const MISSING_LOGIN_SESSION_DEDUP_KEY = "missing-login-session";
+//# sourceMappingURL=MissingLoginSessionDetector.d.ts.map

package/dist/monitoring/MissingLoginSessionDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MissingLoginSessionDetector.d.ts","sourceRoot":"","sources":["../../src/monitoring/MissingLoginSessionDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,+BAA+B;IAC9C,wFAAwF;IACxF,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB;;;;OAIG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,gFAAgF;IAChF,uBAAuB,EAAE,MAAM,mBAAmB,EAAE,CAAC;IACrD,yEAAyE;IACzE,eAAe,EAAE,MAAM,kBAAkB,EAAE,CAAC;IAC5C,uFAAuF;IACvF,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;IACtD,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,OAAO,CAAC;IACb,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD,yDAAyD;AACzD,MAAM,WAAW,iCAAiC;IAChD,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,uEAAuE;AACvE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,8BAA8B,GAAG,SAAS,EACjD,cAAc,EAAE,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,OAAO,GACzD,iCAAiC,CAMnC;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,EAAE,iCAAiC,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAElG;AAED,gFAAgF;AAChF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED;;;;GAIG;AACH,qBAAa,2BAA2B;IASpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAyB;gBAG1B,IAAI,EAAE,+BAA+B,EACrC,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACH,IAAI,IAAI,sBAAsB;IAuC9B,8DAA8D;IAC9D,MAAM,IAAI,yBAAyB;IAUnC,OAAO,CAAC,KAAK;CAOd;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,EAAE,EAC9B,QAAQ,EAAE,kBAAkB,EAAE,GAC7B,eAAe,EAAE,CAWnB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,qBAAqB,CAiBjF;AAED,eAAO,MAAM,+BAA+B,0BAAY,CAAC"}

package/dist/monitoring/MissingLoginSessionDetector.js

@@ -0,0 +1,166 @@
+/**
+ * MissingLoginSessionDetector — signal-only guard that surfaces the
+ * "a live session is running on an account whose login has gone missing" gap
+ * BEFORE the session dies silently.
+ *
+ * The failure it closes (2026-07-22, the justin-gmail silent auth-death): a live
+ * autonomous session was running on an account whose LOCAL LOGIN went missing
+ * (the subscription pool flagged `identityDrift.repairState ===
+ * 'owner-relogin-required'`, `actualAccountId === 'missing-local-login'`) while
+ * that account still had ~92% of its quota free. The session coasted on a cached
+ * credential, then — once that credential expired — every turn began failing on
+ * auth and the session went SILENT for ~2.5 hours. NOTHING alerted the operator;
+ * they had to notice the silence themselves and re-login by hand. The drift WAS
+ * detected by the pool, but it was never raised as an alert, and the reactive
+ * standby classifier only fires when the user sends a message (which, for hours,
+ * they did not).
+ *
+ * This detector makes that gap loud + PROACTIVE: when a live session is bound to
+ * an account whose login is missing, it raises ONE deduped attention item naming
+ * the account and that a re-login is needed. It is SIGNAL-ONLY — it never swaps
+ * accounts, never re-logins, never touches a session. It only tells the operator
+ * (and future-me) that a running session is about to wall on a missing login.
+ *
+ * Why it is distinct from the existing surfaces (not a duplicate):
+ *   - The subscription pool DETECTS the drift, but raises no alert on it.
+ *   - The honest-standby StuckSignatureClassifier can name an auth failure, but
+ *     only reactively — when the user messages. A heads-down run with no inbound
+ *     message falls through it (exactly what happened). This fires proactively.
+ *   - It correlates two facts the others don't join: "login is gone" AND "a live
+ *     session depends on that account right now" — drift alone is not urgent;
+ *     drift under a live session is.
+ *
+ * Pure + injected: every environment read is a callback, so this module unit
+ * tests with zero real managers and no I/O.
+ */
+const DEDUP_KEY = 'missing-login-session';
+/**
+ * Resolve `monitoring.missingLoginSession` against the dev-agent gate.
+ * `resolveEnabled` is the injected `resolveDevAgentGate(explicit, config)` result
+ * (kept as a param so this module stays free of a hard import — the server wiring
+ * passes the real gate). `dryRun` defaults TRUE (the graduated-rollout first rung).
+ */
+export function resolveMissingLoginSessionConfig(block, resolveEnabled) {
+    const b = block ?? {};
+    return {
+        enabled: resolveEnabled(typeof b.enabled === 'boolean' ? b.enabled : undefined),
+        dryRun: typeof b.dryRun === 'boolean' ? b.dryRun : true,
+    };
+}
+/** The guard-posture grade for `GET /guards`: dark ▸ dry-run ▸ live. */
+export function guardStatusFor(cfg) {
+    return cfg.enabled ? (cfg.dryRun ? 'dry-run' : 'live') : 'dark';
+}
+/**
+ * The pure detector. One `tick()` = one evaluation. It raises at most one
+ * (deduped) aggregate attention item per episode; the attention layer's own
+ * dedup collapses repeated ticks so a persistent gap never floods.
+ */
+export class MissingLoginSessionDetector {
+    deps;
+    now;
+    ticks = 0;
+    raises = 0;
+    wouldRaise = 0;
+    errors = 0;
+    lastTickAtMs = 0;
+    lastStranded = [];
+    constructor(deps, now = Date.now) {
+        this.deps = deps;
+        this.now = now;
+    }
+    /**
+     * One evaluation. Rides an existing shared timer (no timer of its own). Fails
+     * toward silence: any internal error increments the error counter and emits
+     * nothing — the shared tick must never crash. A dark guard is a strict no-op.
+     */
+    tick() {
+        if (!this.deps.enabled()) {
+            return { ran: false, gapDetected: false, stranded: [], raised: false };
+        }
+        this.ticks += 1;
+        this.lastTickAtMs = this.now();
+        try {
+            const missing = this.deps.getMissingLoginAccounts();
+            const sessions = this.deps.getLiveSessions();
+            const stranded = computeStranded(missing, sessions);
+            this.lastStranded = stranded;
+            if (stranded.length === 0) {
+                this.audit('no-gap', {
+                    missingLoginAccounts: missing.length,
+                    liveSessions: sessions.length,
+                });
+                return { ran: true, gapDetected: false, stranded: [], raised: false };
+            }
+            if (this.deps.dryRun()) {
+                this.wouldRaise += 1;
+                this.audit('would-raise', { stranded });
+                return { ran: true, gapDetected: true, stranded, raised: false };
+            }
+            this.deps.raiseAttention(buildAttention(stranded));
+            this.raises += 1;
+            this.audit('raised', { stranded });
+            return { ran: true, gapDetected: true, stranded, raised: true };
+        }
+        catch (err) {
+            this.errors += 1;
+            this.audit('tick-error', { error: err instanceof Error ? err.message : String(err) });
+            return { ran: true, gapDetected: false, stranded: [], raised: false };
+        }
+    }
+    /** The read-surface snapshot (feeds the future GET route). */
+    status() {
+        return {
+            enabled: this.deps.enabled(),
+            dryRun: this.deps.dryRun(),
+            lastTickAt: this.lastTickAtMs ? new Date(this.lastTickAtMs).toISOString() : null,
+            stranded: this.lastStranded,
+            counters: { ticks: this.ticks, raises: this.raises, wouldRaise: this.wouldRaise, errors: this.errors },
+        };
+    }
+    audit(event, detail) {
+        try {
+            this.deps.audit?.(event, detail);
+        }
+        catch {
+            /* audit is best-effort — never let it break the tick */
+        }
+    }
+}
+/**
+ * Pure correlation: for each missing-login account, collect the live sessions
+ * bound to its login slot (config home). Only accounts with ≥1 dependent live
+ * session are stranded (drift alone, with no session on it, is not a gap).
+ */
+export function computeStranded(missing, sessions) {
+    const out = [];
+    for (const acct of missing) {
+        const names = sessions
+            .filter((s) => s.configHome && s.configHome === acct.configHome)
+            .map((s) => s.sessionName);
+        if (names.length > 0) {
+            out.push({ accountId: acct.accountId, sessionNames: names });
+        }
+    }
+    return out;
+}
+/** Build the operator-facing attention item for a confirmed gap. Plain language, no jargon. */
+export function buildAttention(stranded) {
+    const totalSessions = stranded.reduce((n, s) => n + s.sessionNames.length, 0);
+    const sessionWord = totalSessions === 1 ? 'session' : 'sessions';
+    const acctList = stranded.map((s) => s.accountId).join(', ');
+    const acctWord = stranded.length === 1 ? 'account' : 'accounts';
+    const body = `${totalSessions} live ${sessionWord} ${totalSessions === 1 ? 'is' : 'are'} running on ${acctWord} ` +
+        `whose login has gone missing (${acctList}). The session works only until its cached credential ` +
+        `expires — then every turn fails on authentication and it goes silent with no error to you. ` +
+        `Re-login to that account now to keep it from going dark.`;
+    return {
+        title: 'A live session is running on a missing login',
+        body,
+        priority: 'high',
+        dedupKey: DEDUP_KEY,
+        source: 'missing-login-session',
+    };
+}
+export const MISSING_LOGIN_SESSION_DEDUP_KEY = DEDUP_KEY;
+//# sourceMappingURL=MissingLoginSessionDetector.js.map

package/dist/monitoring/MissingLoginSessionDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MissingLoginSessionDetector.js","sourceRoot":"","sources":["../../src/monitoring/MissingLoginSessionDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8DH,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAkB1C;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAiD,EACjD,cAA0D;IAE1D,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;IACtB,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAsC;IACnE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IASnB;IACA;IATX,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,CAAC,CAAC;IACX,UAAU,GAAG,CAAC,CAAC;IACf,MAAM,GAAG,CAAC,CAAC;IACX,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAsB,EAAE,CAAC;IAE7C,YACmB,IAAqC,EACrC,MAAoB,IAAI,CAAC,GAAG;QAD5B,SAAI,GAAJ,IAAI,CAAiC;QACrC,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAE7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;YAE7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;oBACnB,oBAAoB,EAAE,OAAO,CAAC,MAAM;oBACpC,YAAY,EAAE,QAAQ,CAAC,MAAM;iBAC9B,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACxE,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAChF,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SACvG,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAa,EAAE,MAA+B;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA8B,EAC9B,QAA8B;IAE9B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;aAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,QAA2B;IACxD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,MAAM,IAAI,GACR,GAAG,aAAa,SAAS,WAAW,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,QAAQ,GAAG;QACpG,iCAAiC,QAAQ,wDAAwD;QACjG,6FAA6F;QAC7F,0DAA0D,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,8CAA8C;QACrD,IAAI;QACJ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,uBAAuB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC"}

package/dist/monitoring/SingleMachineFailoverGapDetector.d.ts

@@ -0,0 +1,144 @@
+/**
+ * SingleMachineFailoverGapDetector — signal-only guard that surfaces the
+ * "no failover target" gap BEFORE it bites.
+ *
+ * The failure it closes (2026-07-22, the Codey overnight loss): an agent was
+ * running autonomous work single-machine, its one machine's session stopped
+ * overnight, and NOTHING took over — because there was no second machine
+ * registered to fail over TO. The gap was invisible until a human noticed the
+ * next morning. Nothing structural surfaced "you have active autonomous work
+ * and no failover target".
+ *
+ * This detector makes that gap loud: when this agent is single-machine (no
+ * online mesh peer) WHILE it has active autonomous runs, it raises ONE deduped
+ * attention item. It is SIGNAL-ONLY — it never blocks, never provisions a peer,
+ * never touches a session. It only tells the operator (and future-me) that the
+ * running autonomous work has no takeover if this machine goes down.
+ *
+ * ── Honesty: two distinct gap modes ──
+ *   not-configured : multiMachine is OFF entirely — no peer was ever registered.
+ *   peer-offline   : multiMachine is ON but every peer is currently offline —
+ *                    the failover target exists but is down right now.
+ * Both are a real gap when autonomous work is active (no takeover either way);
+ * the message names which so the operator knows whether to ADD a machine or
+ * REVIVE one.
+ *
+ * Pure + injected: every environment read is a callback, so this module unit
+ * tests with zero real managers and no I/O.
+ */
+export type FailoverGapMode = 'not-configured' | 'peer-offline';
+/** A snapshot of this agent's mesh membership, as this machine sees it. */
+export interface MeshMembership {
+    /** true iff multiMachine is configured/enabled on this agent at all. */
+    multiMachineEnabled: boolean;
+    /** Count of OTHER machines currently online in this agent's pool (excludes self). */
+    onlinePeerCount: number;
+}
+/** The attention item this detector emits (shape kept minimal + transport-agnostic). */
+export interface FailoverGapAttention {
+    title: string;
+    body: string;
+    priority: 'high';
+    /** Stable per-episode key so repeated ticks coalesce to ONE item. */
+    dedupKey: string;
+    source: 'single-machine-failover-gap';
+}
+export interface SingleMachineFailoverGapDetectorDeps {
+    /** Dark gate. When false the detector is a strict no-op (never reads, never raises). */
+    enabled: () => boolean;
+    /**
+     * Observe-only mode. When true the detector computes the verdict and audits a
+     * would-raise, but does NOT raise the attention item (the graduated-rollout
+     * dry-run rung).
+     */
+    dryRun: () => boolean;
+    /** This agent's current mesh membership (single-machine ⇔ onlinePeerCount === 0). */
+    getMeshMembership: () => MeshMembership;
+    /** How many autonomous runs are active right now (the work that needs a failover target). */
+    getActiveAutonomousRunCount: () => number;
+    /** Raise a deduped attention item. Only called on a genuine gap when not in dryRun. */
+    raiseAttention: (item: FailoverGapAttention) => void;
+    /** Optional structured audit sink (every transition, including no-ops with a reason). */
+    audit?: (event: string, detail: Record<string, unknown>) => void;
+}
+export interface FailoverGapTickResult {
+    ran: boolean;
+    /** True when this agent is single-machine WITH active autonomous work. */
+    gapDetected: boolean;
+    /** Which mode of gap (only meaningful when gapDetected). */
+    mode: FailoverGapMode | null;
+    /** How many autonomous runs are exposed by the gap. */
+    atRiskRunCount: number;
+    /** Whether an attention item was actually raised (false in dryRun even on a gap). */
+    raised: boolean;
+}
+/** The resolved, typed config the detector runs with. */
+export interface SingleMachineFailoverGapResolvedConfig {
+    /** Dev-agent gate: live on a development agent, dark on the fleet (unless set). */
+    enabled: boolean;
+    /** Dry-run first even on a dev agent: compute + audit, but do NOT raise. */
+    dryRun: boolean;
+}
+/** The raw config block shape (all optional — everything defaults). */
+export interface SingleMachineFailoverGapConfigBlock {
+    enabled?: boolean;
+    dryRun?: boolean;
+}
+/**
+ * Resolve `monitoring.singleMachineFailoverGap` against the dev-agent gate.
+ * `resolveEnabled` is the injected `resolveDevAgentGate(explicit, config)` result
+ * (kept as a param so this module stays free of a hard import — the server wiring
+ * passes the real gate). `dryRun` defaults TRUE (the graduated-rollout first rung).
+ */
+export declare function resolveSingleMachineFailoverGapConfig(block: SingleMachineFailoverGapConfigBlock | undefined, resolveEnabled: (explicit: boolean | undefined) => boolean): SingleMachineFailoverGapResolvedConfig;
+/** The guard-posture grade for `GET /guards`: dark ▸ dry-run ▸ live. */
+export declare function guardStatusFor(cfg: SingleMachineFailoverGapResolvedConfig): 'dark' | 'dry-run' | 'live';
+/** The `status()` snapshot (the future `GET /pool/failover-gap` body core). */
+export interface SingleMachineFailoverGapStatus {
+    enabled: boolean;
+    dryRun: boolean;
+    lastTickAt: string | null;
+    /** True when the LAST tick saw this agent single-machine (no online peer). */
+    singleMachine: boolean;
+    /** Active autonomous runs seen on the LAST tick. */
+    activeAutonomousRunCount: number;
+    /** The current gap mode, or null when no gap is open. */
+    openGapMode: FailoverGapMode | null;
+    counters: {
+        ticks: number;
+        raises: number;
+        wouldRaise: number;
+        errors: number;
+    };
+}
+/**
+ * The pure detector. One `tick()` = one evaluation. It raises at most one
+ * (deduped) attention item per gap episode; the attention layer's own dedup
+ * collapses repeated ticks so a persistent gap never floods.
+ */
+export declare class SingleMachineFailoverGapDetector {
+    private readonly deps;
+    private readonly now;
+    private ticks;
+    private raises;
+    private wouldRaise;
+    private errors;
+    private lastTickAtMs;
+    private lastSingleMachine;
+    private lastActiveRunCount;
+    private openGapMode;
+    constructor(deps: SingleMachineFailoverGapDetectorDeps, now?: () => number);
+    /**
+     * One evaluation. Rides an existing shared timer (no timer of its own). Fails
+     * toward silence: any internal error increments the error counter and emits
+     * nothing — the shared tick must never crash. A dark guard is a strict no-op.
+     */
+    tick(): FailoverGapTickResult;
+    /** The read-surface snapshot (feeds the future GET route). */
+    status(): SingleMachineFailoverGapStatus;
+    private audit;
+}
+/** Build the operator-facing attention item for a confirmed gap. Plain language, no jargon. */
+export declare function buildAttention(mode: FailoverGapMode, atRiskRunCount: number): FailoverGapAttention;
+export declare const SINGLE_MACHINE_FAILOVER_GAP_DEDUP_KEY = "single-machine-failover-gap";
+//# sourceMappingURL=SingleMachineFailoverGapDetector.d.ts.map

package/dist/monitoring/SingleMachineFailoverGapDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SingleMachineFailoverGapDetector.d.ts","sourceRoot":"","sources":["../../src/monitoring/SingleMachineFailoverGapDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qFAAqF;IACrF,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,MAAM,WAAW,oCAAoC;IACnD,wFAAwF;IACxF,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB;;;;OAIG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,cAAc,CAAC;IACxC,6FAA6F;IAC7F,2BAA2B,EAAE,MAAM,MAAM,CAAC;IAC1C,uFAAuF;IACvF,cAAc,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACrD,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,WAAW,EAAE,OAAO,CAAC;IACrB,4DAA4D;IAC5D,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD,yDAAyD;AACzD,MAAM,WAAW,sCAAsC;IACrD,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,uEAAuE;AACvE,MAAM,WAAW,mCAAmC;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,mCAAmC,GAAG,SAAS,EACtD,cAAc,EAAE,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,OAAO,GACzD,sCAAsC,CAMxC;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,EAAE,sCAAsC,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAEvG;AAED,+EAA+E;AAC/E,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,oDAAoD;IACpD,wBAAwB,EAAE,MAAM,CAAC;IACjC,yDAAyD;IACzD,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED;;;;GAIG;AACH,qBAAa,gCAAgC;IAWzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAXtB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAgC;gBAGhC,IAAI,EAAE,oCAAoC,EAC1C,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACH,IAAI,IAAI,qBAAqB;IA8C7B,8DAA8D;IAC9D,MAAM,IAAI,8BAA8B;IAYxC,OAAO,CAAC,KAAK;CAOd;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,GAAG,oBAAoB,CAiBlG;AAED,eAAO,MAAM,qCAAqC,gCAAY,CAAC"}

package/dist/monitoring/SingleMachineFailoverGapDetector.js

@@ -0,0 +1,152 @@
+/**
+ * SingleMachineFailoverGapDetector — signal-only guard that surfaces the
+ * "no failover target" gap BEFORE it bites.
+ *
+ * The failure it closes (2026-07-22, the Codey overnight loss): an agent was
+ * running autonomous work single-machine, its one machine's session stopped
+ * overnight, and NOTHING took over — because there was no second machine
+ * registered to fail over TO. The gap was invisible until a human noticed the
+ * next morning. Nothing structural surfaced "you have active autonomous work
+ * and no failover target".
+ *
+ * This detector makes that gap loud: when this agent is single-machine (no
+ * online mesh peer) WHILE it has active autonomous runs, it raises ONE deduped
+ * attention item. It is SIGNAL-ONLY — it never blocks, never provisions a peer,
+ * never touches a session. It only tells the operator (and future-me) that the
+ * running autonomous work has no takeover if this machine goes down.
+ *
+ * ── Honesty: two distinct gap modes ──
+ *   not-configured : multiMachine is OFF entirely — no peer was ever registered.
+ *   peer-offline   : multiMachine is ON but every peer is currently offline —
+ *                    the failover target exists but is down right now.
+ * Both are a real gap when autonomous work is active (no takeover either way);
+ * the message names which so the operator knows whether to ADD a machine or
+ * REVIVE one.
+ *
+ * Pure + injected: every environment read is a callback, so this module unit
+ * tests with zero real managers and no I/O.
+ */
+const DEDUP_KEY = 'single-machine-failover-gap';
+/**
+ * Resolve `monitoring.singleMachineFailoverGap` against the dev-agent gate.
+ * `resolveEnabled` is the injected `resolveDevAgentGate(explicit, config)` result
+ * (kept as a param so this module stays free of a hard import — the server wiring
+ * passes the real gate). `dryRun` defaults TRUE (the graduated-rollout first rung).
+ */
+export function resolveSingleMachineFailoverGapConfig(block, resolveEnabled) {
+    const b = block ?? {};
+    return {
+        enabled: resolveEnabled(typeof b.enabled === 'boolean' ? b.enabled : undefined),
+        dryRun: typeof b.dryRun === 'boolean' ? b.dryRun : true,
+    };
+}
+/** The guard-posture grade for `GET /guards`: dark ▸ dry-run ▸ live. */
+export function guardStatusFor(cfg) {
+    return cfg.enabled ? (cfg.dryRun ? 'dry-run' : 'live') : 'dark';
+}
+/**
+ * The pure detector. One `tick()` = one evaluation. It raises at most one
+ * (deduped) attention item per gap episode; the attention layer's own dedup
+ * collapses repeated ticks so a persistent gap never floods.
+ */
+export class SingleMachineFailoverGapDetector {
+    deps;
+    now;
+    ticks = 0;
+    raises = 0;
+    wouldRaise = 0;
+    errors = 0;
+    lastTickAtMs = 0;
+    lastSingleMachine = false;
+    lastActiveRunCount = 0;
+    openGapMode = null;
+    constructor(deps, now = Date.now) {
+        this.deps = deps;
+        this.now = now;
+    }
+    /**
+     * One evaluation. Rides an existing shared timer (no timer of its own). Fails
+     * toward silence: any internal error increments the error counter and emits
+     * nothing — the shared tick must never crash. A dark guard is a strict no-op.
+     */
+    tick() {
+        if (!this.deps.enabled()) {
+            return { ran: false, gapDetected: false, mode: null, atRiskRunCount: 0, raised: false };
+        }
+        this.ticks += 1;
+        this.lastTickAtMs = this.now();
+        try {
+            const membership = this.deps.getMeshMembership();
+            const atRiskRunCount = this.deps.getActiveAutonomousRunCount();
+            this.lastSingleMachine = membership.onlinePeerCount <= 0;
+            this.lastActiveRunCount = atRiskRunCount;
+            const hasWorkNeedingFailover = atRiskRunCount > 0;
+            const gapDetected = this.lastSingleMachine && hasWorkNeedingFailover;
+            if (!gapDetected) {
+                this.openGapMode = null;
+                this.audit('no-gap', {
+                    onlinePeerCount: membership.onlinePeerCount,
+                    multiMachineEnabled: membership.multiMachineEnabled,
+                    atRiskRunCount,
+                });
+                return { ran: true, gapDetected: false, mode: null, atRiskRunCount, raised: false };
+            }
+            const mode = membership.multiMachineEnabled ? 'peer-offline' : 'not-configured';
+            this.openGapMode = mode;
+            if (this.deps.dryRun()) {
+                this.wouldRaise += 1;
+                this.audit('would-raise', { mode, atRiskRunCount });
+                return { ran: true, gapDetected: true, mode, atRiskRunCount, raised: false };
+            }
+            this.deps.raiseAttention(buildAttention(mode, atRiskRunCount));
+            this.raises += 1;
+            this.audit('raised', { mode, atRiskRunCount });
+            return { ran: true, gapDetected: true, mode, atRiskRunCount, raised: true };
+        }
+        catch (err) {
+            this.errors += 1;
+            this.audit('tick-error', { error: err instanceof Error ? err.message : String(err) });
+            return { ran: true, gapDetected: false, mode: null, atRiskRunCount: 0, raised: false };
+        }
+    }
+    /** The read-surface snapshot (feeds the future GET route). */
+    status() {
+        return {
+            enabled: this.deps.enabled(),
+            dryRun: this.deps.dryRun(),
+            lastTickAt: this.lastTickAtMs ? new Date(this.lastTickAtMs).toISOString() : null,
+            singleMachine: this.lastSingleMachine,
+            activeAutonomousRunCount: this.lastActiveRunCount,
+            openGapMode: this.openGapMode,
+            counters: { ticks: this.ticks, raises: this.raises, wouldRaise: this.wouldRaise, errors: this.errors },
+        };
+    }
+    audit(event, detail) {
+        try {
+            this.deps.audit?.(event, detail);
+        }
+        catch {
+            /* audit is best-effort — never let it break the tick */
+        }
+    }
+}
+/** Build the operator-facing attention item for a confirmed gap. Plain language, no jargon. */
+export function buildAttention(mode, atRiskRunCount) {
+    const runWord = atRiskRunCount === 1 ? 'autonomous run' : 'autonomous runs';
+    const body = mode === 'not-configured'
+        ? `${atRiskRunCount} ${runWord} are running on this machine with no second machine registered. ` +
+            `If this machine sleeps or the session stops, the work stops with nothing to take over. ` +
+            `Register a second machine so this agent has a failover target.`
+        : `${atRiskRunCount} ${runWord} are running, but every other machine in this agent's pool is ` +
+            `currently offline — so there is no failover target right now. Bring the other machine back ` +
+            `online, or the work has no takeover if this machine goes down.`;
+    return {
+        title: 'No failover target for active autonomous work',
+        body,
+        priority: 'high',
+        dedupKey: DEDUP_KEY,
+        source: 'single-machine-failover-gap',
+    };
+}
+export const SINGLE_MACHINE_FAILOVER_GAP_DEDUP_KEY = DEDUP_KEY;
+//# sourceMappingURL=SingleMachineFailoverGapDetector.js.map

package/dist/monitoring/SingleMachineFailoverGapDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SingleMachineFailoverGapDetector.js","sourceRoot":"","sources":["../../src/monitoring/SingleMachineFailoverGapDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAqDH,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAkBhD;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,KAAsD,EACtD,cAA0D;IAE1D,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;IACtB,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAA2C;IACxE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAgBD;;;;GAIG;AACH,MAAM,OAAO,gCAAgC;IAWxB;IACA;IAXX,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,CAAC,CAAC;IACX,UAAU,GAAG,CAAC,CAAC;IACf,MAAM,GAAG,CAAC,CAAC;IACX,YAAY,GAAG,CAAC,CAAC;IACjB,iBAAiB,GAAG,KAAK,CAAC;IAC1B,kBAAkB,GAAG,CAAC,CAAC;IACvB,WAAW,GAA2B,IAAI,CAAC;IAEnD,YACmB,IAA0C,EAC1C,MAAoB,IAAI,CAAC,GAAG;QAD5B,SAAI,GAAJ,IAAI,CAAsC;QAC1C,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC/D,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,eAAe,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,kBAAkB,GAAG,cAAc,CAAC;YAEzC,MAAM,sBAAsB,GAAG,cAAc,GAAG,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;YAErE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;oBACnB,eAAe,EAAE,UAAU,CAAC,eAAe;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;YAED,MAAM,IAAI,GAAoB,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACjG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAExB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACpD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAChF,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACrC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SACvG,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAa,EAAE,MAA+B;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,IAAqB,EAAE,cAAsB;IAC1E,MAAM,OAAO,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC5E,MAAM,IAAI,GACR,IAAI,KAAK,gBAAgB;QACvB,CAAC,CAAC,GAAG,cAAc,IAAI,OAAO,kEAAkE;YAC9F,yFAAyF;YACzF,gEAAgE;QAClE,CAAC,CAAC,GAAG,cAAc,IAAI,OAAO,gEAAgE;YAC5F,6FAA6F;YAC7F,gEAAgE,CAAC;IACvE,OAAO;QACL,KAAK,EAAE,+CAA+C;QACtD,IAAI;QACJ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,6BAA6B;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,SAAS,CAAC"}