fix(graph): defer recycle service resolution until request delivery

scripts/check-record-signatures.py

@@ -496,6 +496,10 @@ def commit(message: str) -> str:
             return rev()
 
         g("init", "-q", "-b", "main")
+        # A throwaway history needs no auto-gc. Background maintenance can still write to
+        # .git after commit exits and race TemporaryDirectory cleanup on a CI runner.
+        g("config", "maintenance.auto", "false")
+        g("config", "gc.auto", "0")
         (root / "Rail.cs").write_text(_RAIL_BEFORE, encoding="utf-8")
         allow.write_text("# header only\n", encoding="utf-8")
         base = commit("base")

scripts/transitional_allow.py

@@ -599,6 +599,11 @@ def run(*args: str) -> None:
                 raise RuntimeError(f"git {' '.join(args)}: {done.stderr}")
 
         run("init", "-q", "-b", "main")
+        # Commits in this throwaway repo need no background maintenance. Git can start an
+        # auto-gc after a commit and keep writing under .git after the command returns;
+        # TemporaryDirectory would then race that writer during cleanup.
+        run("config", "maintenance.auto", "false")
+        run("config", "gc.auto", "0")
         (root / allow).write_text("# header only\n", encoding="utf-8")
         run("add", allow)
         run("commit", "-qm", "base")

src/MeshWeaver.Documentation/Data/Architecture/StaleStateUntilRecycle.md

@@ -192,6 +192,11 @@ bound NodeType is T"* (optionally narrowed to some addresses, or to the activati
   writes `Admin/_Recycle/{id}` (`nodeType: ActivationRecycle`) as System. Every process hears that
   commit on its `IMeshInvalidationFeed` — PostgreSQL LISTEN/NOTIFY in production, the in-process feed
   on a monolith — so the request reaches every silo without a cluster-singleton grain.
+- **Arming the listener does not resolve mesh services.** It runs in the mesh hub's buildup, when
+  resolving `IMeshService` can ask DI for that same hub and wait on the buildup action itself.
+  The feed can deliver during buildup, so the listener queues each request until the hub reaches
+  `Started` before resolving `IMeshService` or `AccessService`. One subscription carries the feed
+  directly into the serial channel, preserving even a synchronous emission during subscription.
 - **Each process disposes what IT hosts.** The agent on every mesh hub walks that process's
   `HostedHubsCollection`, keeps the per-node hubs whose `NodeTypePathHolder` names a requested type
   and that are still `Started`, and posts one `DisposeRequest` each — off the router, through

src/MeshWeaver.Documentation/Data/Architecture/TransitionalAllowEntries.md

@@ -140,6 +140,11 @@ drive the real entry points — `run()` and `check()` — against **real git rep
 "already in the merge base" is a fact about history and cannot be expressed as a fixture of file
 contents. Ten cases each, in both directions:
 
+The temporary repositories disable Git's automatic maintenance and garbage collection. A
+background writer under `.git` can otherwise outlive a commit and race temporary-directory
+cleanup: CI once passed every assertion and then failed with `Directory not empty: '.git'`.
+Disabling maintenance keeps the real-history test while leaving cleanup errors visible.
+
 ```
 ok   a break with no allow entry FAILS                       ← the control arm
 ok   …with an entry naming an OPEN pull request it PASSES

src/MeshWeaver.Graph/Configuration/ActivationRecycle.cs

@@ -3,7 +3,6 @@
 using System.Reactive;
 using System.Reactive.Concurrency;
 using System.Reactive.Linq;
-using System.Reactive.Subjects;
 using MeshWeaver.Mesh;
 using MeshWeaver.Mesh.Security;
 using MeshWeaver.Mesh.Services;
@@ -375,30 +374,41 @@ private static IObservable<Unit> Arm(IMessageHub meshHub)
     {
         var logger = meshHub.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger(typeof(ActivationRecycle));
         var feed = meshHub.ServiceProvider.GetService<IMeshInvalidationFeed>();
-        var mesh = meshHub.ServiceProvider.GetService<IMeshService>();
-        var access = meshHub.ServiceProvider.GetService<AccessService>();
-        if (feed is null || mesh is null || access is null)
+        if (feed is null)
             return Observable.Return(Unit.Default);
-        var heard = new Subject<string>();
         var handled = new ConcurrentDictionary<string, byte>(StringComparer.OrdinalIgnoreCase);
-        meshHub.RegisterForDisposal(heard);
-        meshHub.RegisterForDisposal(feed.Subscribe(change =>
-        {
-            if (IsRequest(change) && handled.TryAdd(change.Path, 0))
-                heard.OnNext(change.Path);
-        }));
-        meshHub.RegisterForDisposal(heard
-            .Select(path => Handle(meshHub, mesh, access, path, logger)
+        // Arm runs during this hub's buildup. IMeshService resolves IMessageHub, so neither
+        // resolution nor request handling may run until the hub's initialization gate opens.
+        // One subscription carries the feed straight into Concat: even a synchronous emission
+        // during Subscribe has a listener, and a request heard during buildup waits in the channel.
+        meshHub.RegisterForDisposal(Observable.Create<MeshChangeEvent>(observer => feed.Subscribe(observer.OnNext))
+            .Where(change => IsRequest(change) && handled.TryAdd(change.Path, 0))
+            .Select(change => WhenStarted(meshHub.RunLevelChanged, () => Handle(
+                    meshHub,
+                    meshHub.ServiceProvider.GetRequiredService<IMeshService>(),
+                    meshHub.ServiceProvider.GetRequiredService<AccessService>(),
+                    change.Path,
+                    logger))
                 .Catch((Exception ex) =>
                 {
-                    logger?.LogError(ex, "[ActivationRecycle] {Path}: this process could not act on the request — its live activations of the named types keep their build", path);
+                    logger?.LogError(ex, "[ActivationRecycle] {Path}: this process could not act on the request — its live activations of the named types keep their build", change.Path);
                     return Observable.Empty<Unit>();
                 }))
             .Concat()
             .Subscribe(_ => { }, ex => logger?.LogError(ex, "[ActivationRecycle] the agent on {Hub} stopped", meshHub.Address)));
         return Observable.Return(Unit.Default);
     }
 
+    /// <summary>Waits for startup before subscribing to one request's work; fails if teardown wins.</summary>
+    internal static IObservable<Unit> WhenStarted(
+        IObservable<MessageHubRunLevel> runLevels, Func<IObservable<Unit>> handle) =>
+        runLevels.Where(level => level >= MessageHubRunLevel.Started)
+            .Take(1)
+            .SelectMany(level => level == MessageHubRunLevel.Started
+                ? Observable.Defer(handle)
+                : Observable.Throw<Unit>(new ObjectDisposedException(nameof(ActivationRecycle),
+                    $"The mesh hub reached {level} before the recycle request could be handled.")));
+
     /// <summary>
     /// Whether a change event is the commit of a request (not a report, not a nested node). Created
     /// OR Updated: a storage relay reports a durable write as an update whatever it was (the

test/MeshWeaver.Graph.Test/ActivationRecycleTest.cs

@@ -1,7 +1,9 @@
 using System;
 using System.Collections.Immutable;
 using System.Linq;
+using System.Reactive;
 using System.Reactive.Linq;
+using System.Reactive.Subjects;
 using System.Threading.Tasks;
 using MeshWeaver.Fixture;
 using MeshWeaver.Graph.Configuration;
@@ -26,6 +28,26 @@ namespace MeshWeaver.Graph.Test;
 /// </summary>
 public class ActivationRecycleTest(ITestOutputHelper output) : MonolithMeshTestBase(output)
 {
+    /// <summary>A feed event heard during buildup waits for the real startup gate before touching DI.</summary>
+    [Fact]
+    public void ARequestHeardDuringBuildup_IsHandledOnlyAfterTheHubStarts()
+    {
+        using var levels = new BehaviorSubject<MessageHubRunLevel>(MessageHubRunLevel.Starting);
+        var handled = 0;
+        using var subscription = ActivationRecycle.WhenStarted(levels, () =>
+            Observable.Defer(() =>
+            {
+                handled++;
+                return Observable.Return(Unit.Default);
+            })).Subscribe();
+
+        handled.Should().Be(0, "the feed can deliver while the mesh hub is building up");
+        levels.OnNext(MessageHubRunLevel.Started);
+        handled.Should().Be(1, "the request is retained until initialization opens");
+        levels.OnNext(MessageHubRunLevel.Started);
+        handled.Should().Be(1, "one request is handled exactly once");
+    }
+
     private const string TypeT = "RecycleTypeT";
     private const string TypeU = "RecycleTypeU";
     private const string T1 = $"{TestPartition}/RecycleT1";