instar 1.3.91 → 1.3.93

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -30,6 +30,23 @@ set -uo pipefail   # NOTE: -e intentionally omitted; field lookups for optional
 # Read hook input from stdin
 HOOK_INPUT=$(cat)
 
+# ── Anchor to the agent home, NOT the session's CWD ───────────────────
+# All state paths below are relative (.instar/autonomous/<topic>.local.md, the
+# registry, the legacy file). The Stop hook inherits the session's working
+# directory — and a session working inside a git worktree (~/.instar/agents/
+# <name>/.worktrees/<slug>) would resolve those paths against the WORKTREE,
+# which has no autonomous state, so the hook sees "no active job" and lets the
+# session exit — silently stranding the autonomous loop. Anchor to the agent
+# home (where this hook is installed) so the paths resolve regardless of CWD.
+# (Root cause of the 2026-05-29 strand: CWD was a worktree.)
+# Anchor to CLAUDE_PROJECT_DIR — Claude Code always sets it for hooks to the
+# agent home (the hook itself is wired as `${CLAUDE_PROJECT_DIR}/.claude/...`).
+# Guard on its `.instar` so a misconfigured value can't send us somewhere wrong;
+# when unset (e.g. an isolated test harness) we stay in the caller's CWD.
+if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]] && [[ -d "${CLAUDE_PROJECT_DIR}/.instar" ]]; then
+  cd "$CLAUDE_PROJECT_DIR" || true
+fi
+
 REGISTRY_FILE=".instar/topic-session-registry.json"
 RECOVERY_AUDIT=".instar/autonomous-recovery.jsonl"
 LEGACY_STATE=".instar/autonomous-state.local.md"

package/dashboard/index.html

@@ -801,6 +801,18 @@
     /* Page intro — one-sentence grounding right under the title so terms like
        "it" / "the system" later in the page have a clear referent. */
     .ph-intro { font-size: 17px; color: var(--text); line-height: 1.55; margin: 0; max-width: 720px; }
+    /* ── Machines tab (Multi-Machine Session Pool §L2) — reuses .ph-root calm type ── */
+    .machine-card { border: 1px solid var(--border, #2a2a2a); border-radius: 10px; padding: 14px 16px; margin-bottom: 12px; max-width: 720px; background: var(--panel-bg, transparent); }
+    .machine-head { display: flex; align-items: center; gap: 10px; }
+    .machine-dot { display: inline-block; width: 10px; height: 10px; border-radius: 50%; flex: 0 0 auto; }
+    .machine-dot.ok { background: var(--accent); }       /* online */
+    .machine-dot.warn { background: #f59e0b; }            /* clock out of sync — paused */
+    .machine-dot.off { background: var(--text-dim); }     /* offline */
+    .machine-nick { font-size: 19px; font-weight: 600; color: var(--text-bright); background: transparent; border: 1px solid transparent; border-radius: 6px; padding: 3px 6px; min-width: 120px; }
+    .machine-nick:hover { border-color: var(--border, #2a2a2a); }
+    .machine-nick:focus { border-color: var(--accent); outline: none; background: rgba(255,255,255,0.03); }
+    .machine-badge { font-size: 12px; font-weight: 600; color: var(--accent); border: 1px solid var(--accent-dim); border-radius: 999px; padding: 2px 9px; }
+    .machine-meta { font-size: 15px; color: var(--text-dim); line-height: 1.55; margin-top: 6px; }
     /* Status color tokens — calm, never alarming. The dot is a scan-aid:
        glance the collapsed list, see which problems are still being worked
        on (amber), cause known (blue), or worked out (green). */
@@ -2624,6 +2636,7 @@
           <button class="tab" data-tab="threadline" onclick="switchTab('threadline')">Threadline</button>
           <button class="tab" data-tab="evidence" onclick="switchTab('evidence')">Evidence</button>
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
+          <button class="tab" data-tab="machines" onclick="switchTab('machines')">Machines</button>
         </nav>
       </div>
       <div class="vital-signs" id="vitalSigns">
@@ -3136,6 +3149,21 @@
       </details>
     </div>
 
+    <!-- machines tab (Multi-Machine Session Pool §L2) -->
+    <div id="machinesPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:baseline">
+        <h2 class="ph-title">Machines</h2>
+        <div id="machinesStamp" class="ph-stamp" aria-live="polite"></div>
+      </div>
+      <p class="ph-intro">Every computer this agent is set up on. Each one gets a friendly name you can change — and once it has a name, you can tell the agent "move this conversation to the mini" and it knows which machine you mean. The agent shares its conversations across these machines so it can handle more at once.</p>
+      <div id="machinesHeadline" class="ph-headline-wrap" aria-live="polite"></div>
+      <section class="ph-section">
+        <h3 class="ph-h">The machines</h3>
+        <p class="ph-h-sub">Click a name to rename it. The "dispatcher" is the one machine currently handing out new conversations.</p>
+        <div id="machinesList"></div>
+      </section>
+    </div>
+
     <div id="evidenceTab" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:center">
         <h2 style="margin:0">Evidence</h2>
@@ -4375,6 +4403,13 @@
         onActivate: () => { if (typeof startProcessHealth === 'function') startProcessHealth(); },
         onDeactivate: () => { if (typeof stopProcessHealth === 'function') stopProcessHealth(); },
       },
+      {
+        id: 'machines',
+        panels: ['machinesPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof startMachines === 'function') startMachines(); },
+        onDeactivate: () => { if (typeof stopMachines === 'function') stopMachines(); },
+      },
       {
         id: 'secrets',
         panels: ['secretsPanel'],
@@ -4530,6 +4565,79 @@
       return resp.json();
     }
 
+    // ── Machines Tab (Multi-Machine Session Pool §L2) ─────────────────
+    let __machinesTimer = null;
+    function startMachines() { loadMachines(); if (!__machinesTimer) __machinesTimer = setInterval(loadMachines, 15000); }
+    function stopMachines() { if (__machinesTimer) { clearInterval(__machinesTimer); __machinesTimer = null; } }
+    function machineSpecLine(hw) {
+      if (!hw) return 'specs not reported yet';
+      const chip = (hw.cpuModel && hw.cpuModel !== 'unknown') ? hw.cpuModel : ((hw.platform || '') + (hw.arch ? ' ' + hw.arch : '')).trim();
+      const cores = hw.cpuCores ? hw.cpuCores + ' cores' : '';
+      const ram = hw.totalMemBytes ? Math.round(hw.totalMemBytes / 1073741824) + ' GB' : '';
+      return [chip, cores, ram].filter(Boolean).join(' · ') || 'specs not reported yet';
+    }
+    function machineBusyWord(m) {
+      if (m.loadAvg == null) return '';
+      if (m.loadAvg < 1) return 'idle';
+      if (m.loadAvg < 4) return 'working';
+      return 'busy';
+    }
+    function renderMachineCard(m, routerHolder) {
+      const online = !!m.online;
+      const dot = !online ? 'off' : (m.clockSkewStatus === 'suspect-clock-removed' ? 'warn' : 'ok');
+      const statusWord = !online ? 'offline' : (m.clockSkewStatus === 'suspect-clock-removed' ? 'clock out of sync — paused for new conversations' : 'online');
+      const isRouter = !!(routerHolder && m.machineId === routerHolder);
+      const nick = m.nickname || m.machineId;
+      const busy = machineBusyWord(m);
+      const sessions = (m.activeSessionCount != null) ? (m.activeSessionCount + (m.maxSessions ? '/' + m.maxSessions : '') + ' conversation' + (m.activeSessionCount === 1 ? '' : 's')) : '';
+      const tail = [statusWord, busy, sessions].filter(Boolean).map(s => escapeHtml(s)).join(' · ');
+      return '<div class="machine-card">' +
+        '<div class="machine-head">' +
+          '<span class="machine-dot ' + dot + '" title="' + escapeHtml(statusWord) + '"></span>' +
+          '<input class="machine-nick" value="' + escapeHtml(nick) + '" data-mid="' + escapeHtml(m.machineId) + '" ' +
+            'onkeydown="if(event.key===\'Enter\'){this.blur();}" onblur="saveMachineNickname(this)" aria-label="machine nickname" />' +
+          (isRouter ? '<span class="machine-badge">dispatcher</span>' : '') +
+        '</div>' +
+        '<div class="machine-meta">' + escapeHtml(machineSpecLine(m.hardware)) + '</div>' +
+        '<div class="machine-meta">' + tail + '</div>' +
+      '</div>';
+    }
+    async function saveMachineNickname(input) {
+      const mid = input.getAttribute('data-mid');
+      const nickname = input.value.trim();
+      try {
+        await apiFetch('/pool/machines/' + encodeURIComponent(mid), {
+          method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nickname }),
+        });
+        loadMachines();
+      } catch (e) {
+        const hl = document.getElementById('machinesHeadline');
+        if (hl) hl.innerHTML = '<div class="ph-headline">Couldn\'t rename that machine: ' + escapeHtml(e.message) + '</div>';
+      }
+    }
+    async function loadMachines() {
+      const stamp = document.getElementById('machinesStamp');
+      const list = document.getElementById('machinesList');
+      const headline = document.getElementById('machinesHeadline');
+      if (!list) return;
+      try {
+        const data = await apiFetch('/pool');
+        if (stamp) stamp.textContent = new Date().toLocaleTimeString();
+        if (!data.enabled) {
+          if (headline) headline.innerHTML = '<div class="ph-headline">Running on a single machine right now — nothing to spread across yet.</div>';
+          list.innerHTML = '';
+          return;
+        }
+        const machines = data.machines || [];
+        const onlineCount = machines.filter(m => m.online).length;
+        if (headline) headline.innerHTML = '<div class="ph-headline">' + onlineCount + ' of ' + machines.length + ' machine' + (machines.length === 1 ? '' : 's') + ' online</div>';
+        const routerHolder = data.router && data.router.holder;
+        list.innerHTML = machines.length ? machines.map(m => renderMachineCard(m, routerHolder)).join('') : '<div class="machine-meta">No machines paired yet.</div>';
+      } catch (e) {
+        if (headline) headline.innerHTML = '<div class="ph-headline">Couldn\'t load machines: ' + escapeHtml(e.message) + '</div>';
+      }
+    }
+
     // ── Tokens Tab ──────────────────────────────────────────────────
     function fmtTokens(n) {
       if (n == null) return '0';

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAksDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuhOtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAquDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8yOtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -298,6 +298,15 @@ let _fixDeps = null;
 // Module-level reference for session resume mapping.
 // Set once in startServer() and used by spawnSessionForTopic/respawnSessionForTopic.
 let _topicResumeMap = null;
+// ── Multi-Machine Session Pool (§L4) activation refs ──────────────────────
+// The SessionRouter is constructed in startServer()'s mesh block, but the inbound
+// dispatch handler that consults it is defined ABOVE startServer — so the router is
+// shared via this module-level ref (the same pattern as _orphanReaper/_topicResumeMap).
+// `_sessionPoolStage()` reads the live rollout stage; the inbound interception only
+// routes through the pool when it returns a non-'dark' stage, so DARK (the default)
+// is byte-identical to today's always-local dispatch. Set once in startServer().
+let _sessionRouter = null;
+let _sessionPoolStage = () => 'dark';
 /** Per-topic framework override (claude-code | codex-cli). Populated from
  *  `config.topicFrameworks` at server boot. Boot-immutable; runtime
  *  mutations go through `_topicFrameworksStore` instead so they persist
@@ -1156,6 +1165,31 @@ getHubDeps) {
         const pipeline = messageToPipeline(msg, storedTopicName);
         // Route message to corresponding session
         const targetSession = telegram.getSessionForTopic(topicId);
+        // ── Multi-Machine Session Pool (§L4): route through the pool when active ──
+        // When the rollout stage is past 'dark', consult the SessionRouter: it may
+        // forward this topic's message to the machine that OWNS the session (over the
+        // mesh) instead of handling it locally. DARK (the default) skips this block
+        // entirely → byte-identical to single-machine dispatch. Any error falls back
+        // to the local path below (fail-safe). The live-transfer behavior is gated by
+        // the staged rollout (StageAdvancer); shadow records ownership but stays local.
+        if (_sessionRouter && _sessionPoolStage() !== 'dark') {
+            try {
+                const outcome = await _sessionRouter.route({
+                    sessionKey: String(topicId),
+                    messageId: String(msg.id),
+                    payload: text,
+                });
+                if (outcome.action === 'forwarded' || outcome.action === 'duplicate') {
+                    console.log(`[session-pool] topic ${topicId} handled by owner ${outcome.owner ?? '?'} (${outcome.action}) — not dispatching locally`);
+                    return;
+                }
+                // 'handled-locally' / 'spawned'(self) / 'owner-dead-replaced' / 'queued' /
+                // 'placement-blocked' → fall through to the existing local dispatch below.
+            }
+            catch (err) {
+                console.warn(`[session-pool] route error for topic ${topicId} — falling back to local dispatch: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         if (targetSession) {
             // Session is mapped — check if it's alive, inject or respawn
             if (sessionManager.isSessionAlive(targetSession)) {
@@ -8167,7 +8201,309 @@ export async function startServer(options) {
                 }
             }
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        // ── Multi-Machine Session Pool registry (§L2) — live MachineCapacity view for GET /pool ──
+        // Always instantiated (cheap); the feature stays dark behind the sessionPool stage gate.
+        // Self-attests hardware + records a self-heartbeat so GET /pool + the Machines tab show
+        // this machine online with its specs; peer liveness is fed from MachineHeartbeat.
+        let machinePoolRegistry;
+        try {
+            const poolMod = await import('../core/MachinePoolRegistry.js');
+            const osMod = await import('node:os');
+            const poolIdMgr = coordinator?.managers?.identityManager;
+            if (poolIdMgr) {
+                const failoverThresholdMs = (config.multiMachine?.failoverTimeoutMinutes ?? 15) * 60_000;
+                const clockSkewToleranceMs = config.multiMachine?.sessionPool?.clockSkewToleranceMs ?? 300_000;
+                machinePoolRegistry = new poolMod.MachinePoolRegistry({
+                    listMachines: () => poolIdMgr.getActiveMachines().map(({ machineId, entry }) => ({
+                        machineId,
+                        nickname: entry.nickname,
+                        hardware: entry.hardware,
+                    })),
+                    clockSkewToleranceMs,
+                    failoverThresholdMs,
+                    logger: (m) => console.log(pc.dim(`  [pool] ${m}`)),
+                });
+                const poolSelfId = machineHeartbeat?.config?.machineId ??
+                    (poolIdMgr.hasIdentity() ? poolIdMgr.loadIdentity().machineId : null);
+                if (poolSelfId) {
+                    try {
+                        poolIdMgr.recordSelfHardware(poolSelfId, poolMod.captureHardware());
+                    }
+                    catch { /* best-effort hardware self-attest */ }
+                    const refreshPool = () => {
+                        try {
+                            machinePoolRegistry.recordHeartbeat({
+                                machineId: poolSelfId,
+                                selfReportedLastSeen: new Date().toISOString(),
+                                loadAvg: osMod.loadavg()[0],
+                            });
+                            const hbApi = machineHeartbeat?.api;
+                            if (hbApi) {
+                                for (const r of hbApi.listAll()) {
+                                    if (r.machineId !== poolSelfId) {
+                                        machinePoolRegistry.recordHeartbeat({ machineId: r.machineId, selfReportedLastSeen: r.lastHeartbeatAt });
+                                    }
+                                }
+                            }
+                        }
+                        catch { /* best-effort pool refresh */ }
+                    };
+                    refreshPool();
+                    const poolTimer = setInterval(refreshPool, 30_000);
+                    if (typeof poolTimer.unref === 'function')
+                        poolTimer.unref();
+                }
+            }
+        }
+        catch (err) {
+            console.log(pc.dim(`  [pool] registry not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        // ── MeshRpc dispatcher (§L0) + SessionOwnership registry (§L3) ──
+        // Built when there's a machine identity. The ownership registry (L3) feeds
+        // the dispatcher's RBAC (ownerOf/placementTargetOf) + the place/claim/
+        // transfer/release handlers; read-class handlers (capacity/session-status)
+        // are live too. Single-machine uses the in-memory store; the cross-machine
+        // git-backed store swaps in for the Track-H proof (the registry is store-agnostic).
+        let meshRpcDispatcher;
+        let sessionOwnershipRegistry;
+        try {
+            const meshMod = await import('../core/MeshRpc.js');
+            const idMod = await import('../core/MachineIdentity.js');
+            const meshIdMgr = coordinator?.managers?.identityManager;
+            const meshSelfId = machineHeartbeat?.config?.machineId
+                ?? (meshIdMgr?.hasIdentity() ? meshIdMgr.loadIdentity().machineId : null);
+            if (meshIdMgr && meshSelfId) {
+                const meshClockToleranceMs = config.multiMachine?.sessionPool?.meshRpcClockToleranceMs ?? 30000;
+                const seenMeshNonces = new Map(); // `${sender}:${nonce}` → ts, age-pruned
+                const meshPruneMs = Math.max(meshClockToleranceMs * 4, 120_000);
+                // SessionOwnership registry (§L3) — in-memory store (single-machine correct;
+                // git-backed cross-machine store is the Track-H swap). Per-session nonce set.
+                const ownMod = await import('../core/SessionOwnershipRegistry.js');
+                const seenOwnNonces = new Set();
+                sessionOwnershipRegistry = new ownMod.SessionOwnershipRegistry({
+                    store: new ownMod.InMemorySessionOwnershipStore(),
+                    seenNonce: (k) => seenOwnNonces.has(k),
+                    recordNonce: (k) => seenOwnNonces.add(k),
+                    logger: (m) => console.log(pc.dim(`  ${m}`)),
+                });
+                const ownReg = sessionOwnershipRegistry;
+                // The §L3 ownership commands, routed from MeshRpc to the registry CAS.
+                const ownAction = (cmd, sender, env) => {
+                    if (cmd.type === 'place')
+                        return ownReg.cas({ type: 'place', machineId: cmd.machine }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'claim')
+                        return ownReg.cas({ type: 'claim', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'transfer')
+                        return ownReg.cas({ type: 'transfer', to: cmd.target }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    if (cmd.type === 'release')
+                        return ownReg.cas({ type: 'release', machineId: sender }, { sessionKey: cmd.session, sender, nonce: env.nonce });
+                    return { ok: false, reason: 'unsupported' };
+                };
+                // The §L4 owner-side deliverMessage receive handler (shared factory — same
+                // code path the tests exercise). Durable-receipt-before-processing with
+                // idempotent dedupe on messageId + the stale-ownership fence. Returns the
+                // deliverMessageAck the router waits on before advancing the platform offset.
+                // (Local processing hand-off to SessionManager is the Track-H staged
+                // activation; the durable receipt + ACK is the complete dark-phase contract.)
+                const deliverMod = await import('../core/DeliverMessageHandler.js');
+                const deliverSeenFallback = new Set(); // used only if the SQLite ledger is unavailable
+                const deliverMessageHandler = deliverMod.createDeliverMessageHandler({
+                    ownerEpochOf: (s) => ownReg.read(s)?.ownershipEpoch ?? null,
+                    recordReceipt: (messageId, session) => {
+                        if (messageLedger)
+                            return messageLedger.record(messageId, { platform: 'mesh', topic: session }).firstSeen;
+                        if (deliverSeenFallback.has(messageId))
+                            return false;
+                        deliverSeenFallback.add(messageId);
+                        return true;
+                    },
+                    // Owner-side bridge (§L4 handoff): a forwarded message landed → spawn/resume
+                    // the local session for the topic so the conversation continues on THIS machine.
+                    // Only fires for a FIRST-seen forwarded deliverMessage (the ledger dedupes
+                    // redeliveries), and a deliverMessage only arrives from a router peer — but we
+                    // double-gate on stage!=='dark' to be safe. Fire-and-forget: the durable receipt
+                    // is already recorded + ACKed before this runs.
+                    onAccepted: (cmd) => {
+                        if (_sessionPoolStage() === 'dark' || !telegram)
+                            return;
+                        const tg = telegram;
+                        const topicId = Number(cmd.session);
+                        if (!Number.isFinite(topicId))
+                            return;
+                        const text = typeof cmd.payload === 'string'
+                            ? cmd.payload
+                            : (cmd.payload && typeof cmd.payload === 'object' && 'text' in cmd.payload)
+                                ? String(cmd.payload.text)
+                                : undefined;
+                        const sessionName = tg.getSessionForTopic(topicId) ?? `topic-${topicId}`;
+                        void spawnSessionForTopic(sessionManager, tg, sessionName, topicId, text, undefined, undefined)
+                            .then((name) => {
+                            tg.registerTopicSession(topicId, name, sessionName);
+                            console.log(pc.green(`  [session-pool] owner-side resume for forwarded topic ${topicId} → ${name}`));
+                        })
+                            .catch((err) => console.warn(`  [session-pool] owner-side resume failed for topic ${topicId}: ${err instanceof Error ? err.message : String(err)}`));
+                    },
+                });
+                meshRpcDispatcher = new meshMod.MeshRpcDispatcher({
+                    verify: {
+                        selfMachineId: meshSelfId,
+                        verify: (canonical, signature, sender) => {
+                            const pem = meshIdMgr.getSigningPublicKeyPem(sender);
+                            if (!pem)
+                                return false;
+                            try {
+                                return idMod.verify(canonical, signature, pem);
+                            }
+                            catch {
+                                return false;
+                            }
+                        },
+                        isRegisteredPeer: (s) => meshIdMgr.isMachineActive(s),
+                        seenNonce: (s, n) => seenMeshNonces.has(`${s}:${n}`),
+                        now: () => Date.now(),
+                        clockToleranceMs: meshClockToleranceMs,
+                    },
+                    rbac: {
+                        routerHolder: () => coordinator?.getSyncStatus().leaseHolder ?? null,
+                        ownerOf: (s) => ownReg.ownerOf(s),
+                        placementTargetOf: (s) => ownReg.placementTargetOf(s),
+                    },
+                    recordNonce: (s, n) => {
+                        const t = Date.now();
+                        seenMeshNonces.set(`${s}:${n}`, t);
+                        if (seenMeshNonces.size > 5000) {
+                            for (const [k, v] of seenMeshNonces)
+                                if (t - v > meshPruneMs)
+                                    seenMeshNonces.delete(k);
+                        }
+                    },
+                    handlers: {
+                        'capacity-report': () => machinePoolRegistry?.getCapacities() ?? [],
+                        'session-status': () => machinePoolRegistry?.getCapacity(meshSelfId) ?? { machineId: meshSelfId },
+                        place: ownAction,
+                        claim: ownAction,
+                        transfer: ownAction,
+                        release: ownAction,
+                        deliverMessage: deliverMessageHandler,
+                    },
+                    logger: (m) => console.log(pc.dim(`  ${m}`)),
+                });
+                // ── L4 SessionRouter (activation transport) — shared via _sessionRouter ──
+                // Constructed with the real registry/ownership/placement + the outbound
+                // MeshRpcClient so it can reach peers. INERT until the rollout stage advances
+                // past 'dark': the inbound dispatch interception only consults it when
+                // _sessionPoolStage() !== 'dark'. Single-machine → placement keeps everything local.
+                try {
+                    const routerMod = await import('../core/SessionRouter.js');
+                    const placeMod = await import('../core/PlacementExecutor.js');
+                    const clientMod = await import('../core/MeshRpcClient.js');
+                    let routerNonce = 0;
+                    const meshClient = new clientMod.MeshRpcClient({
+                        selfMachineId: meshSelfId,
+                        sign: (c) => idMod.sign(c, localSigningKeyPem),
+                        nonce: () => `${meshSelfId}:r:${Date.now()}:${++routerNonce}`,
+                        now: () => Date.now(),
+                    });
+                    const peerUrl = (machineId) => meshIdMgr.getActiveMachines().find((m) => m.machineId === machineId)?.entry.lastKnownUrl ?? null;
+                    _sessionRouter = new routerMod.SessionRouter({
+                        selfMachineId: meshSelfId,
+                        placement: new placeMod.PlacementExecutor(),
+                        machineRegistry: () => machinePoolRegistry?.getCapacities() ?? [],
+                        resolveOwnership: (sk) => {
+                            const r = ownReg.read(sk);
+                            if (!r)
+                                return { owner: null, epoch: 0, status: null };
+                            const status = r.status === 'released' ? null : r.status;
+                            return { owner: ownReg.ownerOf(sk), epoch: r.ownershipEpoch, status, target: ownReg.placementTargetOf(sk) ?? undefined };
+                        },
+                        isMachineAlive: (m) => m === meshSelfId || (machinePoolRegistry?.getCapacity(m)?.online ?? false),
+                        casClaimOwnership: (sk, machineId) => {
+                            const r = ownReg.cas({ type: 'place', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:c:${++routerNonce}` });
+                            return { ok: r.ok, epoch: ownReg.read(sk)?.ownershipEpoch ?? 0 };
+                        },
+                        deliverMessage: async (target, env) => {
+                            const url = peerUrl(target);
+                            if (!url)
+                                throw new Error(`no peer url for ${target}`);
+                            const res = await meshClient.send({ machineId: target, url }, { type: 'deliverMessage', session: env.sessionKey, messageId: env.messageId, payload: env.payload, ownershipEpoch: env.ownershipEpoch }, env.ownershipEpoch);
+                            if (res.ok && res.result && typeof res.result === 'object' && 'accepted' in res.result) {
+                                return res.result;
+                            }
+                            throw new Error(`deliverMessage rejected: ${res.status} ${res.reason ?? ''}`);
+                        },
+                        spawnOnMachine: async (machineId, msg) => {
+                            const url = peerUrl(machineId);
+                            if (!url)
+                                throw new Error(`no peer url for ${machineId}`);
+                            await meshClient.send({ machineId, url }, { type: 'deliverMessage', session: msg.sessionKey, messageId: msg.messageId, payload: msg.payload, ownershipEpoch: 0 }, 0);
+                        },
+                        handleLocally: async () => { },
+                        queueMessage: () => { },
+                        raiseAttention: (title, body) => console.log(pc.dim(`  [session-router] attention: ${title} — ${body}`)),
+                        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+                        log: (line) => console.log(pc.dim(`  [session-router] ${line}`)),
+                    });
+                    _sessionPoolStage = () => {
+                        try {
+                            const fallback = (config.multiMachine?.sessionPool ?? {});
+                            const live = liveConfig.get('multiMachine.sessionPool', fallback);
+                            return live?.enabled && live?.stage ? String(live.stage) : 'dark';
+                        }
+                        catch {
+                            return 'dark';
+                        }
+                    };
+                    console.log(pc.green('  SessionRouter wired (L4) — inert until rollout stage advances past dark'));
+                }
+                catch (err) {
+                    console.log(pc.dim(`  [session-router] not wired: ${err instanceof Error ? err.message : String(err)}`));
+                }
+            }
+        }
+        catch (err) {
+            console.log(pc.dim(`  [mesh-rpc] dispatcher not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        // ── Rollout gate (§Rollout): signed E2E result store + StageAdvancer ──────────
+        // The E2E result store backs GET /session-pool/e2e-results (observable gate state);
+        // StageAdvancer is the SOLE writer of multiMachine.sessionPool.stage (it passes the
+        // stageWriteGuard token; any other write throws stage-write-not-permitted). Always
+        // instantiated (cheap); inert until the pool activates past 'dark'.
+        let sessionPoolE2EResultStore;
+        try {
+            const e2eMod = await import('../core/SessionPoolE2EResultStore.js');
+            const stageMod = await import('../core/StageAdvancer.js');
+            const guardMod = await import('../config/stageWriteGuard.js');
+            const crypto = await import('node:crypto');
+            // HMAC over the agent's authToken — tamper-evident without a separate keystore.
+            const hmacKey = String(config.authToken ?? 'instar-session-pool-e2e');
+            const hmac = (c) => crypto.createHmac('sha256', hmacKey).update(c).digest('hex');
+            sessionPoolE2EResultStore = new e2eMod.SessionPoolE2EResultStore({
+                filePath: path.join(config.stateDir, 'session-pool-e2e-results.json'),
+                sign: hmac,
+                verifySig: (c, s) => {
+                    try {
+                        const exp = hmac(c);
+                        return s.length === exp.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(exp));
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            // StageAdvancer: the sole stage writer. Held for the rollout job/route to drive;
+            // constructed here so the write path (liveConfig + token) is wired in one place.
+            void new stageMod.StageAdvancer({
+                resultStore: sessionPoolE2EResultStore,
+                currentCommitSha: () => process.env.INSTAR_COMMIT_SHA ?? process.env.GITHUB_SHA ?? 'unknown',
+                readStage: () => liveConfig.get('multiMachine.sessionPool.stage', 'dark'),
+                writeStageConfig: (s) => liveConfig.set(guardMod.STAGE_CONFIG_PATH, s, { stageWriteToken: guardMod.STAGE_WRITE_TOKEN }),
+                audit: (event, detail) => console.log(pc.dim(`  [stage-advancer] ${event} ${JSON.stringify(detail)}`)),
+            });
+        }
+        catch (err) {
+            console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, sessionOwnershipRegistry, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
         // died mid-relay-episode, the persisted tunnel.json carries
         // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE