instar 1.3.906 → 1.3.908

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8pDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA47oBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4qDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgupBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -510,6 +510,19 @@ let _refreshPoolHeartbeat = () => { };
 // §6) so `GET /pool/machine-coherence` can read the sentinel constructed deep in
 // the mesh peer-presence wiring. Null when the guard is dark (route 503s).
 let _machineCoherenceSentinel = null;
+// Module-level handle for the single-machine failover-gap detector (increment 2)
+// so `GET /pool/failover-gap` can read the detector constructed deep in the mesh
+// peer-presence wiring. Null when the guard is dark (route 503s).
+let _singleMachineFailoverGap = null;
+// Module-level handle for the missing-login-session detector (increment 2) so
+// `GET /pool/missing-login` can read the detector constructed deep in the mesh
+// peer-presence wiring. Null when the guard is dark (route 503s).
+let _missingLoginSession = null;
+// Module-level handle for the SessionPoolFailoverRunner driver (§Rollout, Track H)
+// so `GET /session-pool/failover-runner` can read its status(). Null when the
+// runner is dark (dev-gated) — the route 503s. Constructed inside the rollout-gate
+// boot block next to the E2E result store + StageAdvancer.
+let _sessionPoolFailoverRunnerDriver = null;
 // The store the unconditional boot sweep opened when the queue will run this
 // boot — adopted by the engine construction (one open handle, single-writer).
 let _sweptInboundStore = null;
@@ -12012,7 +12025,7 @@ export async function startServer(options) {
         // Subscription & Auth Standard). Always instantiated; ships DARK because an
         // empty pool is a pure no-op (no background loop, no cost) until an operator
         // enrolls an account. Stores each account's login LOCATION, never tokens.
-        const { SubscriptionPool } = await import('../core/SubscriptionPool.js');
+        const { SubscriptionPool, requiresOwnerRelogin } = await import('../core/SubscriptionPool.js');
         const subscriptionPool = new SubscriptionPool({ stateDir: config.stateDir });
         if (subscriptionPool.size() > 0) {
             console.log(pc.green(`  Subscription pool: ${subscriptionPool.size()} account(s) registered`));
@@ -16794,8 +16807,8 @@ export async function startServer(options) {
         }
         // ── QuotaAwareScheduler (Subscription & Auth Standard P1.3) ──
         // Telegram-specific (createAttentionItem + subscription-pool wiring).
-        if (telegram) {
-            const telegramRef = telegram; // narrow for closure
+        if (telegram || _slackAdapter) {
+            const telegramRef = telegram; // optional notification surface only
             // Selects the optimal account + enforces the continuity guarantee: on
             // quota pressure it resumes the session under another account (via the
             // SessionRefresh account-swap path), never letting it die. Auto-trigger
@@ -16816,7 +16829,19 @@ export async function startServer(options) {
                             const k = antiThrashKnobsGetter();
                             return { thresholdPct: k.thresholdPct, targetHeadroomPct: k.targetHeadroomPct, minImprovementPct: k.minImprovementPct };
                         },
-                        resolveCurrentAccountId: (sessionName) => state.listSessions({ status: 'running' }).find((s) => s.tmuxSession === sessionName)?.subscriptionAccountId ?? null,
+                        resolveEffectiveAccountId: async (sessionName, sourceWasUntagged, sourceTrigger) => {
+                            const tagged = state.listSessions({ status: 'running' })
+                                .find((s) => s.tmuxSession === sessionName)?.subscriptionAccountId ?? null;
+                            if (!sourceWasUntagged || tagged)
+                                return tagged;
+                            if (sourceTrigger === 'login-loss') {
+                                const realHome = sessionManager.configHomeForSession(sessionName);
+                                if (!realHome)
+                                    return null;
+                                return subscriptionPool.list().find((a) => a.configHome === realHome)?.id ?? null;
+                            }
+                            return (await inUseAccountResolver.resolve(subscriptionPool.list())).activeAccountId;
+                        },
                         onReactiveExecuted: (a) => _swapAntiThrashEngine?.recordReactiveExecuted(a),
                         onReactiveFailed: (a) => _swapAntiThrashEngine?.recordExecFailure({
                             session: a.session,
@@ -16845,7 +16870,7 @@ export async function startServer(options) {
                     // anti-thrash observation layer can classify failures (§3.1/§3.6).
                     return r.ok ? { ok: true } : { ok: false, code: r.code };
                 },
-                onNoAlternate: (sessionName, exhaustedAccountId) => {
+                onNoAlternate: telegramRef ? (sessionName, exhaustedAccountId) => {
                     void telegramRef.createAttentionItem({
                         id: `subpool-no-alternate-${exhaustedAccountId}`,
                         title: 'Subscription pool — no alternate account to swap to',
@@ -16854,7 +16879,7 @@ export async function startServer(options) {
                         priority: 'HIGH',
                         sourceContext: 'subscription-pool:no-alternate',
                     }).catch(() => { });
-                },
+                } : undefined,
                 logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
             });
             // DARK auto-trigger: only when explicitly enabled does a rate-limit
@@ -16912,11 +16937,19 @@ export async function startServer(options) {
                         // Only claude-code sessions ride the claude-account pool (legacy
                         // records with no framework default to claude-code).
                         .filter((s) => s.framework === undefined || s.framework === 'claude-code')
-                        .map((s) => ({
-                        sessionName: s.tmuxSession,
-                        accountId: s.subscriptionAccountId ?? null,
-                        startedAt: s.startedAt,
-                    })),
+                        .map((s) => {
+                        const realHome = sessionManager.configHomeForSession(s.tmuxSession);
+                        const loginLossAccountId = realHome
+                            ? subscriptionPool.list().find((a) => a.configHome === realHome && requiresOwnerRelogin(a))?.id ?? null
+                            : null;
+                        return {
+                            sessionName: s.tmuxSession,
+                            accountId: s.subscriptionAccountId ?? null,
+                            loginLossAccountId,
+                            startedAt: s.startedAt,
+                            refreshable: _sessionRefresh?.canRefreshSession(s.tmuxSession) ?? false,
+                        };
+                    }),
                     resolveDefaultAccountId: async () => (await inUseAccountResolver.resolve(subscriptionPool.list())).activeAccountId,
                     swap: (a) => _quotaAwareScheduler
                         ? _quotaAwareScheduler.onQuotaPressure(a)
@@ -16934,6 +16967,10 @@ export async function startServer(options) {
                     antiThrash: _swapAntiThrashEngine
                         ? { engine: _swapAntiThrashEngine, getKnobs: antiThrashKnobsGetter }
                         : undefined,
+                    loginLoss: {
+                        enabled: resolveDevAgentGate(proactiveCfg.loginLoss?.enabled, config),
+                        dryRun: proactiveCfg.loginLoss?.dryRun !== false,
+                    },
                     // §4 — the in-flight work gate (proactive arm: defer, ceiling-drop).
                     // The monitor owns the deferral lifecycle; the gate is stateless.
                     workGate: _swapWorkGate
@@ -20377,6 +20414,18 @@ export async function startServer(options) {
                     // Mutual SSH phase 1: the signed HTTP mesh is the bootstrap carrier;
                     // the resulting proof itself traverses the restricted SSH subsystem.
                     // Hard-dark on fleet, dry-run first on the development agent.
+                    const peerExecutionEnabled = resolveDevAgentGate(config.multiMachine?.peerExecution?.enabled, config);
+                    if (!peerExecutionEnabled) {
+                        try {
+                            const { PeerAuthorizedKeys } = await import('../core/PeerAuthorizedKeys.js');
+                            new PeerAuthorizedKeys(os.homedir(), false).revokeUnknown(config.projectName, new Set());
+                        }
+                        catch (error) {
+                            // @silent-fallback-ok — disabled-feature cleanup failure is loud;
+                            // no runtime starts and no readiness success can mask stale access.
+                            console.warn(`[peer-execution] disabled-grant cleanup blocked: ${error instanceof Error ? error.message : String(error)}`);
+                        }
+                    }
                     if (resolveDevAgentGate(config.multiMachine?.mutualSsh?.enabled, config)) {
                         try {
                             const sshMod = await import('../core/MutualSshRuntime.js');
@@ -20399,6 +20448,18 @@ export async function startServer(options) {
                                 ?? privateHosts.find(host => /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(host))
                                 ?? '127.0.0.1';
                             const bindPort = portMod.allocatePort(`${config.projectName}-mutual-ssh`, 42000, 49000);
+                            const standingHostKey = (() => {
+                                if (!peerExecutionEnabled)
+                                    return null;
+                                try {
+                                    return fs.readFileSync('/etc/ssh/ssh_host_ed25519_key.pub', 'utf8').trim();
+                                }
+                                catch {
+                                    // @silent-fallback-ok — absence is a named standing endpoint
+                                    // readiness blocker; never substitute an unpinned host key.
+                                    return null;
+                                }
+                            })();
                             const peers = () => meshIdMgr.getActiveMachines()
                                 .filter(row => row.machineId !== meshSelfId)
                                 .map(row => ({
@@ -20414,6 +20475,19 @@ export async function startServer(options) {
                                 selfMachineFingerprint: machineFingerprint(selfPem),
                                 observerBootId: `${meshSelfId}:${process.pid}:${Date.now()}`,
                                 bindHost, bindPort, dryRun: config.multiMachine?.mutualSsh?.dryRun !== false,
+                                peerExecution: peerExecutionEnabled ? {
+                                    // The SSH daemon resolves AuthorizedKeysFile beneath the
+                                    // account home; never write a system/global sshd path.
+                                    agentHome: os.homedir(),
+                                    dryRun: config.multiMachine?.peerExecution?.dryRun !== false,
+                                    requiredForReadiness: config.multiMachine?.peerExecution?.requiredForReadiness !== false,
+                                } : undefined,
+                                localStandingSsh: peerExecutionEnabled && standingHostKey && bindHost !== '127.0.0.1' ? {
+                                    host: bindHost,
+                                    port: config.multiMachine?.peerExecution?.port ?? 22,
+                                    username: os.userInfo().username,
+                                    hostPublicKey: standingHostKey,
+                                } : undefined,
                                 requiredForReadiness: config.multiMachine?.mutualSsh?.requiredForEmployeeRole === true,
                                 freshnessMs: config.multiMachine?.mutualSsh?.freshnessMs,
                                 cadenceMs: config.multiMachine?.mutualSsh?.cadenceMs,
@@ -20452,6 +20526,11 @@ export async function startServer(options) {
                                 enabled: true, dryRun: config.multiMachine?.mutualSsh?.dryRun !== false,
                                 status: mutualSshRuntime?.status() ?? null,
                             }));
+                            guardRegistry.register('multiMachine.peerExecution.enabled', () => ({
+                                enabled: resolveDevAgentGate(config.multiMachine?.peerExecution?.enabled, config),
+                                dryRun: config.multiMachine?.peerExecution?.dryRun !== false,
+                                status: mutualSshRuntime?.status() ?? null,
+                            }));
                         }
                         catch (err) {
                             // @silent-fallback-ok — the feature fails closed and surfaces its
@@ -21985,6 +22064,111 @@ export async function startServer(options) {
                         // — the monitoring sentinel must never crash server boot.
                         console.error('  MachineCoherenceGuard wiring failed (non-fatal):', e instanceof Error ? e.message : String(e));
                     }
+                    // ── Single-Machine Failover-Gap Detector (increment 2 — pure SIGNAL) ──
+                    // Surfaces the "no failover target for active autonomous work" gap BEFORE
+                    // it bites (the 2026-07-22 Codey overnight loss): single-machine (no online
+                    // mesh peer) WHILE active autonomous runs → ONE deduped HIGH attention item.
+                    // Rides THIS 30s peerPresenceTick; SIGNAL-ONLY (never blocks/provisions/kills).
+                    // Dev-gated dark on the fleet (`enabled` OMITTED → resolveDevAgentGate), dry-
+                    // run FIRST even on dev (computes + counts would-raise, raises nothing).
+                    // Constructed ONLY when the gate resolves enabled — a dark guard is never
+                    // constructed (route 503s, no tick); single-machine-with-no-work is a strict
+                    // no-op inside tick(). Own try/catch: a wiring failure is logged non-fatal.
+                    try {
+                        const smfgMod = await import('../monitoring/singleMachineFailoverGapWiring.js');
+                        const smfgDetMod = await import('../monitoring/SingleMachineFailoverGapDetector.js');
+                        const { getByPath: smfgGetByPath } = await import('../core/machineCoherenceManifest.js');
+                        const { activeAutonomousJobs: smfgActiveJobs } = await import('../core/AutonomousSessions.js');
+                        const smfgCfg = smfgDetMod.resolveSingleMachineFailoverGapConfig(smfgGetByPath(config, 'monitoring.singleMachineFailoverGap'), (explicit) => resolveDevAgentGate(explicit, config));
+                        if (smfgCfg.enabled) {
+                            const smfgDetector = smfgMod.makeSingleMachineFailoverGapDetector({
+                                enabled: () => smfgCfg.enabled,
+                                dryRun: () => smfgCfg.dryRun,
+                                getCapacities: () => machinePoolRegistry?.getCapacities() ?? [],
+                                selfMachineId: () => meshSelfId ?? null,
+                                // "configured" = a multiMachine block exists at all (peer-offline vs
+                                // not-configured only changes the message text, never the gap verdict).
+                                multiMachineEnabled: () => !!config.multiMachine,
+                                getActiveAutonomousRunCount: () => config.stateDir ? smfgActiveJobs(config.stateDir).length : 0,
+                                createAttentionItem: (item) => {
+                                    // fire-and-forget into the real attention queue; a Telegram fault
+                                    // must never crash the shared presence tick (fail toward silence).
+                                    void telegram?.createAttentionItem(item)?.catch?.(() => { });
+                                },
+                            });
+                            // expectRuntime:true on the GUARD_MANIFEST entry — register the
+                            // synchronous runtime getter so /guards grades the guard's posture
+                            // (enabled/dryRun + real lastTickAt liveness from status()).
+                            guardRegistry.register('monitoring.singleMachineFailoverGap.enabled', () => {
+                                const s = smfgDetector.status();
+                                return { enabled: s.enabled, dryRun: s.dryRun, lastTickAt: s.lastTickAt ? Date.parse(s.lastTickAt) : 0 };
+                            });
+                            _singleMachineFailoverGap = smfgDetector; // expose to GET /pool/failover-gap
+                            console.log(pc.dim(`  SingleMachineFailoverGap: enabled dryRun=${smfgCfg.dryRun} (no-failover-target detector — pure signal)`));
+                        }
+                    }
+                    catch (e) {
+                        // @silent-fallback-ok — optional dev-gated, pure-signal feature: a wiring
+                        // failure is logged (console.error, NOT silent) and is non-fatal BY DESIGN.
+                        console.error('  SingleMachineFailoverGap wiring failed (non-fatal):', e instanceof Error ? e.message : String(e));
+                    }
+                    // ── Missing-Login-Session Detector (increment 2 — pure SIGNAL) ──
+                    // Surfaces the "a live session is running on an account whose local login
+                    // has gone missing" gap BEFORE the session walls silently (the 2026-07-22
+                    // justin-gmail silent auth-death): a running session bound to an account
+                    // whose subscription-pool identity drift is `owner-relogin-required` /
+                    // `missing-local-login` → ONE deduped HIGH attention item naming the account.
+                    // Rides THIS 30s peerPresenceTick; SIGNAL-ONLY (never swaps/relogins/kills).
+                    // Dev-gated dark on the fleet (`enabled` OMITTED → resolveDevAgentGate), dry-
+                    // run FIRST even on dev (computes + counts would-raise, raises nothing).
+                    // Constructed ONLY when the gate resolves enabled — a dark guard is never
+                    // constructed (route 503s, no tick); no-drift-under-a-session is a strict
+                    // no-op inside tick(). Own try/catch: a wiring failure is logged non-fatal.
+                    try {
+                        const mlsMod = await import('../monitoring/missingLoginSessionWiring.js');
+                        const mlsDetMod = await import('../monitoring/MissingLoginSessionDetector.js');
+                        const { getByPath: mlsGetByPath } = await import('../core/machineCoherenceManifest.js');
+                        const mlsCfg = mlsDetMod.resolveMissingLoginSessionConfig(mlsGetByPath(config, 'monitoring.missingLoginSession'), (explicit) => resolveDevAgentGate(explicit, config));
+                        if (mlsCfg.enabled) {
+                            const mlsDetector = mlsMod.makeMissingLoginSessionDetector({
+                                enabled: () => mlsCfg.enabled,
+                                dryRun: () => mlsCfg.dryRun,
+                                // Raw subscription-pool accounts (identity-drift flags → missing-login);
+                                // a pool of zero accounts (single-account agent) is a strict no-op.
+                                getPoolAccounts: () => subscriptionPool.list(),
+                                // Running sessions + each one's REAL login slot (its live
+                                // CLAUDE_CONFIG_DIR, resolved from tmux). This is the config home
+                                // the session is ACTUALLY on — NOT its recorded subscriptionAccountId,
+                                // which diverges from the real slot under identity drift (the gap this
+                                // guard exists for). A session whose config home is unresolvable
+                                // contributes configHome:undefined and is skipped by the factory (never
+                                // a guessed slot). configHomeForSession fails toward silence internally.
+                                getRunningSessions: () => sessionManager.listRunningSessions().map((s) => ({
+                                    sessionName: s.tmuxSession,
+                                    configHome: sessionManager.configHomeForSession(s.tmuxSession),
+                                })),
+                                createAttentionItem: (item) => {
+                                    // fire-and-forget into the real attention queue; a Telegram fault
+                                    // must never crash the shared presence tick (fail toward silence).
+                                    void telegram?.createAttentionItem(item)?.catch?.(() => { });
+                                },
+                            });
+                            // expectRuntime:true on the GUARD_MANIFEST entry — register the
+                            // synchronous runtime getter so /guards grades the guard's posture
+                            // (enabled/dryRun + real lastTickAt liveness from status()).
+                            guardRegistry.register('monitoring.missingLoginSession.enabled', () => {
+                                const s = mlsDetector.status();
+                                return { enabled: s.enabled, dryRun: s.dryRun, lastTickAt: s.lastTickAt ? Date.parse(s.lastTickAt) : 0 };
+                            });
+                            _missingLoginSession = mlsDetector; // expose to GET /pool/missing-login
+                            console.log(pc.dim(`  MissingLoginSession: enabled dryRun=${mlsCfg.dryRun} (missing-login-under-a-session detector — pure signal)`));
+                        }
+                    }
+                    catch (e) {
+                        // @silent-fallback-ok — optional dev-gated, pure-signal feature: a wiring
+                        // failure is logged (console.error, NOT silent) and is non-fatal BY DESIGN.
+                        console.error('  MissingLoginSession wiring failed (non-fatal):', e instanceof Error ? e.message : String(e));
+                    }
                     // Drain + execute the machine-coherence episode effects (§4) the last
                     // reconcile produced (raise/append/resolve). Async + best-effort — a
                     // Telegram fault never crashes the shared presence tick (fail toward
@@ -22073,6 +22257,20 @@ export async function startServer(options) {
                             catch { /* @silent-fallback-ok: §3.3 the evaluator tick fails toward silence by design — a sentinel fault must never crash the shared 30s presence tick; the next reconcile re-derives from durable episode state */ }
                             executeMachineCoherenceEffects(machineCoherenceSentinel, telegram);
                         }
+                        // Single-machine failover-gap detector rider (increment 2): one pure-
+                        // signal evaluation per tick. Fails toward silence — a detector fault
+                        // must never crash the shared 30s presence tick.
+                        try {
+                            _singleMachineFailoverGap?.tick();
+                        }
+                        catch { /* @silent-fallback-ok: fails toward silence */ }
+                        // Missing-login-session detector rider (increment 2): one pure-signal
+                        // evaluation per tick. Fails toward silence — a detector fault must
+                        // never crash the shared 30s presence tick.
+                        try {
+                            _missingLoginSession?.tick();
+                        }
+                        catch { /* @silent-fallback-ok: fails toward silence */ }
                     };
                     const peerPresenceTimer = setInterval(peerPresenceTick, 30_000);
                     if (typeof peerPresenceTimer.unref === 'function')
@@ -22400,7 +22598,7 @@ export async function startServer(options) {
                         return s.length === exp.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(exp));
                     }
                     catch {
-                        return false;
+                        return false; /* @silent-fallback-ok: HMAC verify fails closed — a malformed/short input is treated as an invalid signature, never accepted */
                     }
                 },
             });
@@ -22428,15 +22626,143 @@ export async function startServer(options) {
                 writeStageConfig: (s) => liveConfig.set(guardMod.STAGE_CONFIG_PATH, s, { stageWriteToken: guardMod.STAGE_WRITE_TOKEN }),
                 audit: (event, detail) => console.log(pc.dim(`  [stage-advancer] ${event} ${JSON.stringify(detail)}`)),
             });
+            // ── SessionPoolFailoverRunner (§Rollout, Track H) — the in-agent PRODUCER of
+            // a real failover-E2E green so a DEPLOYED dev agent can promote its own
+            // sessionPool stage instead of sitting at 'shadow' forever. Dev-gated dark
+            // (enabled OMITTED → resolveDevAgentGate) + dryRun-first: while dryRun holds
+            // the recorded verdict lands in a SIDE store the StageAdvancer never reads,
+            // so nothing promotes until a deliberate dryRun:false. Constructed here so it
+            // shares the E2E result store + boot commit SHA + the slow reconcile tick.
+            const fromMod = await import('../core/sessionPoolFailoverRunnerConfig.js');
+            const failoverRunnerCfg = fromMod.resolveSessionPoolFailoverRunnerConfig(config.multiMachine?.sessionPool?.failoverRunner, (explicit) => resolveDevAgentGate(explicit, config));
+            if (failoverRunnerCfg.enabled) {
+                // The dry-run SIDE store: a separate signed file the promotion path
+                // (StageAdvancer/driver) NEVER reads, so a would-record green captured
+                // during the soak can never wrongly promote the stage.
+                const failoverDryRunStore = new e2eMod.SessionPoolE2EResultStore({
+                    filePath: path.join(config.stateDir, 'session-pool-failover-runner-dryrun.json'),
+                    sign: hmac,
+                    verifySig: (c, s) => {
+                        try {
+                            const exp = hmac(c);
+                            return s.length === exp.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(exp));
+                        }
+                        catch {
+                            return false; /* @silent-fallback-ok: HMAC verify fails closed — a malformed/short input is treated as an invalid signature, never accepted */
+                        }
+                    },
+                });
+                // The REAL bounded subprocess runner. Resolves the instar SOURCE root (the
+                // agent's own checkout) — a deployed agent with no source/vitest yields
+                // ranToCompletion:false → the check throws → the runner records NOTHING
+                // (honest degrade, never a fabricated verdict). The spawn is fully bounded
+                // (kill on timeout) and its output is streamed to a durable evidence log.
+                const cp = await import('node:child_process');
+                const failoverLogPath = path.join(config.stateDir, 'logs', 'session-pool-failover-runner.log');
+                const runProcess = (args) => new Promise((resolve) => {
+                    // Candidate source roots, most-specific first: an explicit env override,
+                    // then this build's package root (dist/../..), then cwd. The first that
+                    // carries BOTH node_modules/.bin/vitest AND the test file wins.
+                    const candidates = [
+                        process.env.INSTAR_SOURCE_ROOT,
+                        path.resolve(__dirname, '..', '..'),
+                        process.cwd(),
+                    ].filter((c) => typeof c === 'string' && c.length > 0);
+                    let sourceRoot = null;
+                    for (const c of candidates) {
+                        try {
+                            if (fs.existsSync(path.join(c, 'node_modules', '.bin', 'vitest')) && fs.existsSync(path.join(c, args.testPath))) {
+                                sourceRoot = c;
+                                break;
+                            }
+                        }
+                        catch { /* @silent-fallback-ok — probe next candidate */ }
+                    }
+                    if (!sourceRoot) {
+                        // No source/vitest resolvable → NOT a failover verdict; the check
+                        // contract makes this THROW so the runner records nothing.
+                        resolve({ ranToCompletion: false, exitCode: null, evidenceRef: `no-source: vitest+${args.testPath} not resolvable (checkout absent)` });
+                        return;
+                    }
+                    const vitestBin = path.join(sourceRoot, 'node_modules', '.bin', 'vitest');
+                    let logFd = null;
+                    try {
+                        fs.mkdirSync(path.dirname(failoverLogPath), { recursive: true });
+                        logFd = fs.openSync(failoverLogPath, 'a');
+                    }
+                    catch {
+                        logFd = null; /* @silent-fallback-ok — evidence log optional */
+                    }
+                    const evidenceRef = `${failoverLogPath}@${new Date().toISOString()}`;
+                    let settled = false;
+                    const done = (r) => {
+                        if (settled)
+                            return;
+                        settled = true;
+                        if (logFd !== null) {
+                            try {
+                                fs.closeSync(logFd);
+                            }
+                            catch { /* @silent-fallback-ok */ }
+                        }
+                        resolve(r);
+                    };
+                    try {
+                        const child = cp.spawn(vitestBin, ['run', args.testPath, '--reporter=dot'], {
+                            cwd: sourceRoot,
+                            stdio: ['ignore', logFd ?? 'ignore', logFd ?? 'ignore'],
+                            env: { ...process.env },
+                        });
+                        const killTimer = setTimeout(() => {
+                            try {
+                                child.kill('SIGKILL');
+                            }
+                            catch { /* @silent-fallback-ok */ }
+                            done({ ranToCompletion: false, exitCode: null, evidenceRef: `${evidenceRef} (timeout ${args.timeoutMs}ms)` });
+                        }, args.timeoutMs);
+                        if (killTimer.unref)
+                            killTimer.unref();
+                        child.on('error', () => { clearTimeout(killTimer); done({ ranToCompletion: false, exitCode: null, evidenceRef: `${evidenceRef} (spawn-error)` }); });
+                        child.on('close', (code) => { clearTimeout(killTimer); done({ ranToCompletion: true, exitCode: code, evidenceRef }); });
+                    }
+                    catch {
+                        // @silent-fallback-ok — a spawn throw is an infra failure, NOT a
+                        // failover verdict; ranToCompletion:false → the check throws → nothing recorded.
+                        done({ ranToCompletion: false, exitCode: null, evidenceRef: `${evidenceRef} (spawn-threw)` });
+                    }
+                });
+                _sessionPoolFailoverRunnerDriver = fromMod.buildSessionPoolFailoverRunnerDriver({
+                    config: failoverRunnerCfg,
+                    resultStore: sessionPoolE2EResultStore,
+                    dryRunResultStore: failoverDryRunStore,
+                    runProcess,
+                    currentCommitSha: () => bootCommitSha || 'unknown',
+                    // The shadow→live-transfer failover is proven at the 'shadow' stage index
+                    // (0), which StageAdvancer.advanceTo('live-transfer') reads.
+                    provenStage: () => 0,
+                    audit: (event, detail) => console.log(pc.dim(`  [failover-runner] ${event} ${JSON.stringify(detail)}`)),
+                });
+                if (_sessionPoolFailoverRunnerDriver) {
+                    console.log(pc.green(`  SessionPoolFailoverRunner enabled (${failoverRunnerCfg.dryRun ? 'dry-run — records to SIDE store' : 'LIVE — records to promotion store'}; cadence ${failoverRunnerCfg.tickIntervalMs}ms)`));
+                }
+            }
             // Revert-ONLY reconcile tick (§Rollout): reconcile() can solely DEMOTE a live
             // stage when the CURRENT commit's Tier-3 E2E goes red — it never advances.
             // Promotion (advanceTo) stays operator-triggered via the rollout route/job.
-            // Cheap + inert while stage is 'dark' (reconcile() no-ops at the floor).
+            // Cheap + inert while stage is 'dark' (reconcile() no-ops at the floor). The
+            // failover runner's maybeTick() rides the SAME slow tick — it self-throttles
+            // to its own (far slower) tickIntervalMs, so it is NOT a hot loop here.
             const stageReconcileTimer = setInterval(() => {
                 try {
                     stageAdvancer.reconcile();
                 }
                 catch { /* @silent-fallback-ok — retried next tick */ }
+                // Fire-and-forget: the driver owns the in-flight guard + cadence gate; a
+                // heavy E2E subprocess must never block the timer. Fail toward silence.
+                try {
+                    void _sessionPoolFailoverRunnerDriver?.maybeTick();
+                }
+                catch { /* @silent-fallback-ok — retried next tick */ }
             }, 60_000);
             if (stageReconcileTimer.unref)
                 stageReconcileTimer.unref();
@@ -22799,7 +23125,7 @@ export async function startServer(options) {
         const server = new AgentServer({ config, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: m.nickname ?? m.machineId, url: m.lastKnownUrl }));
             } if (peers.length === 0)
-                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+                return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         if (_stateSyncStoresResolved?.classReview?.enabled && replicatedPeerStreamReader) {
             const { CLASS_REVIEW_STORE_KEY, classReviewFromOriginRecord } = await import('../core/ClassReviewReplicatedStore.js');
             const reader = replicatedPeerStreamReader;