instar 1.3.92 → 1.3.94

package/dist/core/MeshUrlAdvertiser.d.ts

@@ -0,0 +1,50 @@
+/**
+ * MeshUrlAdvertiser — populate a machine's `lastKnownUrl` so cross-machine
+ * routing can actually reach it.
+ *
+ * THE BUG THIS FIXES (found via real-hardware dogfooding, 2026-05-29):
+ * the Multi-Machine Session Pool routes every cross-machine RPC (deliver /
+ * transfer / lease) to a peer by reading `registry.machines[id].lastKnownUrl`.
+ * But the only writer of that field — `MachineIdentityManager.updateMachineUrl`
+ * — had ZERO callers. So in production every peer's URL was null, the peer
+ * filters (`!!e.lastKnownUrl`) dropped every peer, and no session could ever be
+ * delivered or transferred across machines. The 3-tier tests missed it because
+ * they inject peers with mock URLs and never exercise the runtime "where does
+ * lastKnownUrl come from" path.
+ *
+ * A machine's reachable URL is its tunnel URL: a named tunnel's hostname is
+ * known from config; a quick tunnel's URL is only known once `tunnel.start()`
+ * resolves it. This module turns either into the value to advertise, and writes
+ * it into the registry entry — from where the existing git-backed registry sync
+ * (RegistrySyncDebouncer) propagates it to peers.
+ */
+export interface MeshTunnelConfig {
+    enabled?: boolean;
+    type?: string;
+    hostname?: string;
+}
+/**
+ * Resolve the URL this machine should advertise to the mesh.
+ *
+ * Preference order:
+ *  1. A concretely-resolved tunnel URL (quick tunnels only know it at runtime;
+ *     `tunnel.start()` returns it). This is authoritative when present.
+ *  2. A named tunnel's deterministic `https://<hostname>`.
+ *  3. null — no reachable URL (tunnel disabled / not configured). A machine
+ *     with no tunnel is genuinely not reachable cross-machine; advertising
+ *     nothing is correct (peers will skip it rather than route to a dead URL).
+ */
+export declare function resolveAdvertisedMeshUrl(tunnel: MeshTunnelConfig | undefined, resolvedTunnelUrl?: string | null): string | null;
+/** Minimal slice of MachineIdentityManager this module needs (keeps it testable). */
+export interface MeshUrlRecorder {
+    getMachineUrl(machineId: string): string | null;
+    updateMachineUrl(machineId: string, url: string): void;
+}
+/**
+ * Advertise this machine's reachable URL into its own registry entry so peers
+ * can route to it. Idempotent (no write when unchanged), and tolerant when the
+ * self entry isn't present yet (best-effort — boot ordering can race the
+ * registration). Returns true iff it wrote a new value.
+ */
+export declare function advertiseSelfMeshUrl(recorder: MeshUrlRecorder, selfMachineId: string, url: string | null, log?: (msg: string) => void): boolean;
+//# sourceMappingURL=MeshUrlAdvertiser.d.ts.map

package/dist/core/MeshUrlAdvertiser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MeshUrlAdvertiser.d.ts","sourceRoot":"","sources":["../../src/core/MeshUrlAdvertiser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CASf;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAWT"}

package/dist/core/MeshUrlAdvertiser.js

@@ -0,0 +1,64 @@
+/**
+ * MeshUrlAdvertiser — populate a machine's `lastKnownUrl` so cross-machine
+ * routing can actually reach it.
+ *
+ * THE BUG THIS FIXES (found via real-hardware dogfooding, 2026-05-29):
+ * the Multi-Machine Session Pool routes every cross-machine RPC (deliver /
+ * transfer / lease) to a peer by reading `registry.machines[id].lastKnownUrl`.
+ * But the only writer of that field — `MachineIdentityManager.updateMachineUrl`
+ * — had ZERO callers. So in production every peer's URL was null, the peer
+ * filters (`!!e.lastKnownUrl`) dropped every peer, and no session could ever be
+ * delivered or transferred across machines. The 3-tier tests missed it because
+ * they inject peers with mock URLs and never exercise the runtime "where does
+ * lastKnownUrl come from" path.
+ *
+ * A machine's reachable URL is its tunnel URL: a named tunnel's hostname is
+ * known from config; a quick tunnel's URL is only known once `tunnel.start()`
+ * resolves it. This module turns either into the value to advertise, and writes
+ * it into the registry entry — from where the existing git-backed registry sync
+ * (RegistrySyncDebouncer) propagates it to peers.
+ */
+/**
+ * Resolve the URL this machine should advertise to the mesh.
+ *
+ * Preference order:
+ *  1. A concretely-resolved tunnel URL (quick tunnels only know it at runtime;
+ *     `tunnel.start()` returns it). This is authoritative when present.
+ *  2. A named tunnel's deterministic `https://<hostname>`.
+ *  3. null — no reachable URL (tunnel disabled / not configured). A machine
+ *     with no tunnel is genuinely not reachable cross-machine; advertising
+ *     nothing is correct (peers will skip it rather than route to a dead URL).
+ */
+export function resolveAdvertisedMeshUrl(tunnel, resolvedTunnelUrl) {
+    if (resolvedTunnelUrl && /^https?:\/\/\S+$/.test(resolvedTunnelUrl.trim())) {
+        return resolvedTunnelUrl.trim().replace(/\/+$/, '');
+    }
+    if (tunnel?.enabled !== false && tunnel?.hostname && tunnel.hostname.trim()) {
+        const host = tunnel.hostname.trim().replace(/^https?:\/\//, '').replace(/\/+$/, '');
+        if (host)
+            return `https://${host}`;
+    }
+    return null;
+}
+/**
+ * Advertise this machine's reachable URL into its own registry entry so peers
+ * can route to it. Idempotent (no write when unchanged), and tolerant when the
+ * self entry isn't present yet (best-effort — boot ordering can race the
+ * registration). Returns true iff it wrote a new value.
+ */
+export function advertiseSelfMeshUrl(recorder, selfMachineId, url, log) {
+    if (!url || !selfMachineId)
+        return false;
+    try {
+        if (recorder.getMachineUrl(selfMachineId) === url)
+            return false; // idempotent
+        recorder.updateMachineUrl(selfMachineId, url);
+        log?.(`  Mesh: advertised self URL → ${url}`);
+        return true;
+    }
+    catch {
+        // Self entry not present yet — caller may retry on a later lifecycle event.
+        return false;
+    }
+}
+//# sourceMappingURL=MeshUrlAdvertiser.js.map

package/dist/core/MeshUrlAdvertiser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MeshUrlAdvertiser.js","sourceRoot":"","sources":["../../src/core/MeshUrlAdvertiser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAoC,EACpC,iBAAiC;IAEjC,IAAI,iBAAiB,IAAI,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI;YAAE,OAAO,WAAW,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,aAAqB,EACrB,GAAkB,EAClB,GAA2B;IAE3B,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,aAAa;QAC9E,QAAQ,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC9C,GAAG,EAAE,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.92",
+  "version": "1.3.94",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-29T16:08:56.086Z",
-  "instarVersion": "1.3.92",
+  "generatedAt": "2026-05-29T17:44:10.981Z",
+  "instarVersion": "1.3.94",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.92.md

@@ -1,63 +1,27 @@
-# Instar Upgrade Guide — NEXT
+# Upgrade Guide — vNEXT
 
-> In-flight shipment notes for the **Multi-Machine Session Pool** (active-active,
-> per-session placement + transfer). Built track-by-track behind a dark stage
-> gate; this guide grows as tracks land and becomes the versioned guide at the
-> release cut. Spec: docs/specs/MULTI-MACHINE-SESSION-POOL-SPEC.md (approved).
+<!-- bump: patch -->
 
 ## What Changed
 
-**Multi-Machine Session Pool — foundation (Track A: Router-Leader Lease).** The
-groundwork for one agent identity running across several machines, all awake at
-once, with each conversation placed on the best-fit machine and transferable
-between machines. This shipment lands the foundation and ships **dark** (the
-entire layer is inert unless explicitly enabled and its rollout stage advanced):
-
-- **Clock-jump-proof router lease.** The machine that holds the "who's in charge"
-  lease now judges its own lease expiry on a **monotonic clock** instead of the
-  wall clock. A wall-clock jump — an NTP correction, a VM pause/resume, a
-  sleep/wake, or a CPU-starvation timer slip — can no longer fool a partitioned
-  machine into thinking it still holds the lease (or into giving it up early).
-  This is the lease-substrate-robustness hardening that the whole session pool
-  rests on, and it directly answers the SleepWakeDetector CPU-starvation lesson.
-- **Router role.** The existing leader lease is now also addressable as the
-  "router" role (the machine that dispatches conversations to machines). On a
-  single machine this is a no-op — it is its own router.
-- **Dark config block.** A new `multiMachine.sessionPool` config block ships
-  turned off (`enabled: false`, `stage: 'dark'`, `dryRun: true`). Existing
-  agents receive these dark defaults automatically on update.
-
-**Track B (part 1: machine nicknames).** Every machine the agent is installed on
-now gets a friendly, auto-assigned **nickname** (e.g. "Mac Mini", "Justins Macbook
-Pro") — the handle you'll use to say "run this on the mini" / "move this to <name>".
-Nicknames are unique within the pool, editable, and derived deterministically from
-the machine's hostname. Still dark (the Machines dashboard tab + the placement
-commands that consume nicknames land in the next part of Track B).
+The Multi-Machine Session Pool gains its activation wiring (still DARK): the SessionRouter
+is now constructed at boot and consulted on the inbound message path — but ONLY when the
+rollout stage is advanced past 'dark'. A single-machine, un-activated agent behaves exactly
+as before (the interception is gated off on three independent conditions and fails safe to
+local dispatch).
 
 ## What to Tell Your User
 
-Nothing changes for you yet — this ships turned off. When the full feature is
-ready, your agent will be able to spread conversations across all the machines
-it's installed on (and you'll get a Machines tab in the dashboard to name them
-and move conversations between them by nickname). For now, this update just makes
-the under-the-hood "who's in charge" machinery immune to clock jumps, which makes
-everything steadier. A one-machine agent behaves exactly as before.
+Nothing changes yet — this is the plumbing that lets the session pool actually move
+conversations between machines once it's staged on. It stays off until explicitly activated.
 
 ## Summary of New Capabilities
 
-- Monotonic, clock-jump-proof self-fence for the router/leader lease
-  (`LeaseCoordinator`).
-- `MultiMachineCoordinator.isRouter()` — router-role accessor (alias of
-  `holdsLease()`).
-- `multiMachine.sessionPool` dark config block (`enabled`/`stage`/`dryRun`) with
-  migration parity for existing agents.
+| Area | Capability |
+| --- | --- |
+| Multi-machine | The inbound dispatch can route a topic's message to the machine that owns the session (gated; dark by default). |
 
 ## Evidence
 
-- Tier-1 unit tests: monotonic self-fence (incl. the backward-wall-clock-jump
-  immunity proof and the mid-tick `holdsLease` fence), real-monotonic default
-  wiring integrity, `isRouter()`, and the dark config defaults + migration parity
-  (adds-into-existing-multiMachine, no-clobber, inert, idempotent).
-- 155 tests green across the lease/config/coordinator/seamlessness cluster after
-  the change; tsc clean. Full suite runs in CI.
-- Side-effects review: upgrades/side-effects/session-pool-track-a-router-lease.md
+- `tests/unit/session-pool-activation-wiring.test.ts` pins the safety invariants: gated on a
+  non-dark stage, fail-safe to local dispatch, real-deps construction, module-ref sharing.

package/upgrades/1.3.93.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+The Multi-Machine Session Pool gains its activation wiring (still DARK): the SessionRouter
+is constructed at boot and consulted on the inbound message path, and a forwarded message
+now resumes the session on the owner machine — but ALL of this is gated on the rollout stage
+being advanced past 'dark'. A single-machine, un-activated agent behaves exactly as before:
+the interception is gated off on three independent conditions (no router without machine
+identity, stage defaults dark, fail-safe to local dispatch).
+
+## What to Tell Your User
+
+Nothing changes yet — this is the plumbing that lets the session pool actually move
+conversations between machines once it's staged on. It stays off until explicitly activated.
+
+## Summary of New Capabilities
+
+| Area | Capability |
+| --- | --- |
+| Multi-machine | Inbound dispatch can route a topic's message to the machine that owns the session, and the owner resumes it (gated; dark by default). |
+
+## Evidence
+
+- `tests/unit/session-pool-activation-wiring.test.ts` pins the safety invariants: gated on a
+  non-dark stage, fail-safe to local dispatch, real-deps construction, owner-side resume bridge.

package/upgrades/1.3.94.md

@@ -0,0 +1,38 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Multi-Machine Session Pool — cross-machine routing fix (still dark).** Real
+hardware bring-up of a second machine surfaced a wiring gap: the session pool
+routes every cross-machine action (deliver / transfer / lease) to a peer by its
+`lastKnownUrl` (its tunnel URL), but nothing in the shipped code ever wrote that
+field — so every peer was filtered out and no session could be routed or
+transferred across machines. A machine now advertises its own tunnel URL into
+the mesh registry once the tunnel is up (and re-advertises after a sleep/wake
+restart, since a quick tunnel's URL changes), and a joining machine records the
+URL it paired through. The whole layer remains gated behind
+`multiMachine.sessionPool` (default off / `stage:'dark'`), so single-machine
+agents are unaffected.
+
+## What to Tell Your User
+
+Nothing changes yet — this is still off by default. It fixes a foundational gap
+so that, when the session pool is enabled, conversations can actually be placed
+on and moved between machines.
+
+## Summary of New Capabilities
+
+- `MeshUrlAdvertiser` (`resolveAdvertisedMeshUrl` + `advertiseSelfMeshUrl`):
+  populates a machine's `lastKnownUrl` from its tunnel URL on boot + sleep/wake.
+- `instar join` now records the awake machine's URL on the joining (standby) side.
+
+## Evidence
+
+- Unit: `tests/unit/mesh-url-advertiser.test.ts` (resolver + advertiser vs a real
+  MachineIdentityManager).
+- Wiring-integrity: `tests/unit/mesh-url-advertisement-wiring.test.ts` (asserts
+  the advertiser is actually invoked — the tier that would have caught the
+  original zero-callers gap).
+- Side-effects: `upgrades/side-effects/mesh-url-advertisement.md`.

package/upgrades/side-effects/mesh-url-advertisement.md

@@ -0,0 +1,66 @@
+# Side-effects review — Mesh URL advertisement (lastKnownUrl population)
+
+## What changed
+
+`updateMachineUrl()` (the only writer of `registry.machines[id].lastKnownUrl`)
+had **zero callers** on main. The Multi-Machine Session Pool routes every
+cross-machine RPC — `deliverMessage`, session transfer, lease ops — to a peer by
+reading that peer's `lastKnownUrl`, and filters peers with `!!e.lastKnownUrl`.
+With the field never written, every peer was filtered out and **no session
+could ever be delivered or transferred across machines**. The feature was inert
+across real machines despite green 3-tier tests (which inject mock peer URLs).
+
+Found 2026-05-29 bringing up a second real machine (the mini) for the
+session-pool real-hardware proof.
+
+This change adds:
+- `src/core/MeshUrlAdvertiser.ts` — `resolveAdvertisedMeshUrl(tunnel, resolvedUrl?)`
+  (named → `https://<hostname>`, quick → the runtime-resolved start URL, none →
+  null) + `advertiseSelfMeshUrl(recorder, selfId, url)` (idempotent, tolerant of
+  a missing self entry).
+- `src/commands/server.ts` — calls the advertiser after `tunnel.start()` on both
+  the boot path and the sleep/wake restart path (a quick tunnel gets a new URL
+  after a wake, so the previously-advertised URL goes stale).
+- `src/commands/machine.ts` (`joinMesh`) — the joiner records the URL it
+  connected through as the awake peer's `lastKnownUrl`, so a standby can route
+  back to the awake machine immediately without waiting for a registry sync.
+
+## Blast radius
+
+- **Dark-feature-only effect.** The populated `lastKnownUrl` is consumed solely
+  by the session-pool mesh code, which is gated behind `multiMachine.sessionPool`
+  (default `enabled:false`, `stage:'dark'`). On a single-machine agent there are
+  no peers, so nothing changes. Populating the field is otherwise inert.
+- **No new config, no new route, no schema change** → no migration needed.
+  Existing agents pick up the behavior at boot on the next release. No
+  `PostUpdateMigrator` entry required (the code runs at startup unconditionally
+  when multi-machine is enabled and a tunnel URL exists).
+- **Idempotent + fail-safe.** `advertiseSelfMeshUrl` writes only when the URL
+  changed and swallows the "self entry not present yet" race (returns false).
+  A tunnel-disabled machine advertises nothing (correct — it is genuinely
+  unreachable cross-machine; peers skip it rather than route to a dead URL).
+- **No secret exposure.** A tunnel URL is already public (the dashboard link).
+  Recording it in the registry adds no new exposure.
+
+## What this does NOT close (scoped, decision-gated follow-up)
+
+The **awake machine learning a git-uncredentialed standby's URL** still needs one
+of: (a) the standby having git push creds for the shared agent repo (so its
+advertised entry syncs via the existing git-backed RegistrySyncDebouncer), or
+(b) a signed mesh `announce-url` RPC so a standby can publish its URL to the
+awake machine over authenticated MeshRpc without git. (b) also requires the
+awake side to persist the joiner's identity, which today only happens via the
+**interactive SAS pairing** confirmation — so closing this fully touches the
+pairing security model. That is a genuine design fork (creds vs. new RPC +
+non-interactive registration), not a silent deferral, and is raised explicitly
+rather than hand-resolved on a production identity.
+
+## Tests
+
+- `tests/unit/mesh-url-advertiser.test.ts` — resolver (named/quick/disabled/none)
+  + advertiser against a real `MachineIdentityManager` (writes, idempotent,
+  updates on change, null no-op, missing-entry tolerance).
+- `tests/unit/mesh-url-advertisement-wiring.test.ts` — wiring-integrity: asserts
+  the advertiser is invoked on the boot + sleep/wake tunnel paths and the joiner
+  records the connect URL. This is the tier that was missing — it would have
+  caught the original "zero callers" gap.

package/upgrades/side-effects/session-pool-activation-wiring.md

@@ -0,0 +1,22 @@
+# Side effects — Session Pool activation wiring (§L4 live-ingress, dark)
+
+## What this adds (task A of the activation)
+Wires the SessionRouter into the live boot + the inbound message-dispatch path, GATED so it is inert until the rollout stage advances past 'dark'.
+
+- `src/commands/server.ts`:
+  - Module-level refs `_sessionRouter` + `_sessionPoolStage()` (the idiomatic instar pattern — the inbound handler in `wireTelegramRouting` is defined above `startServer`, so the router constructed in startServer's mesh block is shared via a module ref, like `_orphanReaper`/`_topicResumeMap`).
+  - **Construction** (mesh block, when a machine identity exists): `new SessionRouter({...})` wired to the real `MachinePoolRegistry` (machineRegistry), `SessionOwnershipRegistry` (resolveOwnership + casClaimOwnership), `PlacementExecutor`, and an outbound `MeshRpcClient` (deliverMessage/spawnOnMachine to peers via `lastKnownUrl`). `_sessionPoolStage()` reads the live `multiMachine.sessionPool.{enabled,stage}` (defaults 'dark').
+  - **Interception** (inbound `onTopicMessage`, after target-session resolution): when `_sessionRouter && _sessionPoolStage() !== 'dark'`, consult `route()`; a `forwarded`/`duplicate` outcome short-circuits (the owner machine handles it); everything else falls through to the existing local dispatch. Wrapped in try/catch → falls back to local on any error.
+
+## Risk / blast radius
+**None in production.** The gate defaults to dark on three independent conditions: `_sessionRouter` is null without machine identity; `_sessionPoolStage()` returns 'dark' unless `enabled && stage` set (ConfigDefaults ships enabled:false/stage:dark); and the interception fails safe to local dispatch. So a single-machine, un-activated agent is byte-identical to today. The live-transfer behavior is gated by the staged rollout (StageAdvancer + E2E records).
+
+## Tests
+- `tests/unit/session-pool-activation-wiring.test.ts` — 4 wiring-integrity tests pinning the safety invariants: gated on non-dark stage (default-dark → inert), fail-safe try/catch → local, real-deps construction (registry/ownership/placement + MeshRpcClient), module-ref sharing. Guards against a regression that removes the gate (which would activate cross-machine routing unconditionally).
+- SessionRouter behavior itself is covered by its 17 unit + 3 integration tests (#506).
+
+## Remaining (the hardware operation — B/C/D)
+Deploy to laptop + bring up the mini as machine #2; advance dark→shadow→live-transfer (each E2E-gated); test-as-self nickname-swap proof. The owner-side deliverMessage→local-spawn bridge (so a forwarded message actually spawns on the owner) is the final piece, validated on the 2-machine setup.
+
+## Addendum — owner-side bridge (task A.2)
+`createDeliverMessageHandler` now takes an `onAccepted` hook wired (in the mesh block) to `spawnSessionForTopic`: a FIRST-seen forwarded `deliverMessage` spawns/resumes the local session for the topic so the conversation continues on the OWNER machine — the receive-side of the §L4 handoff. Gated on `_sessionPoolStage() !== 'dark'` + `telegram` present; fire-and-forget (the durable receipt is ACKed before this runs); fails safe (logs, never throws into the dispatcher). Inert until live-transfer (a deliverMessage only arrives from a router peer). This makes the activation code-complete: outbound forward (router) + receive+ACK (handler) + owner-side resume (bridge). Remaining is purely the 2-machine hardware proof.