instar 0.28.86 → 0.28.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "0.28.86",
+  "version": "0.28.87",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-11T19:04:47.355Z",
-  "instarVersion": "0.28.86",
+  "generatedAt": "2026-05-11T20:08:03.908Z",
+  "instarVersion": "0.28.87",
   "entryCount": 187,
   "entries": {
     "hook:session-start": {
@@ -384,7 +384,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -392,7 +392,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -400,7 +400,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -408,7 +408,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -416,7 +416,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -424,7 +424,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -432,7 +432,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -440,7 +440,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -448,7 +448,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -456,7 +456,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -464,7 +464,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -472,7 +472,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -480,7 +480,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -488,7 +488,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -496,7 +496,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -504,7 +504,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -512,7 +512,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -520,7 +520,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -528,7 +528,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -536,7 +536,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -544,7 +544,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -552,7 +552,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -560,7 +560,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -568,7 +568,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -576,7 +576,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -584,7 +584,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -592,7 +592,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -600,7 +600,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -608,7 +608,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -616,7 +616,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -624,7 +624,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -632,7 +632,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -640,7 +640,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -648,7 +648,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -656,7 +656,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -664,7 +664,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -672,7 +672,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -680,7 +680,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -688,7 +688,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -696,7 +696,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -704,7 +704,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -712,7 +712,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -720,7 +720,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -736,7 +736,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e66eb60abd18d4ae6b44ecd007b1e1248ef80f8fbb3acc345a67832060d9485f",
+      "contentHash": "1ecd66f6392872c8c208d1b19d5af5b1b5228e843fdcb60467da55d5972b888b",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1416,7 +1416,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "bbd65732738409d65ac1f394d88abc0d245c6e4ab4a29d0a47bb5b8379fa87a2",
+      "contentHash": "bf12e9af008f4076a752e4fc3d8271fa1f9bf01ab41dc499f6f733f49d9d3604",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/0.28.87.md

@@ -0,0 +1,153 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: minor -->
+<!-- Valid values: patch, minor, major -->
+<!-- patch = bug fixes, refactors, test additions, doc updates -->
+<!-- minor = new features, new APIs, new capabilities (backwards-compatible) -->
+<!-- major = breaking changes to existing APIs or behavior -->
+
+## What Changed
+
+### Stuck Telegram messages — auto-resend Enter after paste
+
+On Claude Code v2.1.105 and newer, the Enter keypress after a bracketed-paste
+sequence is occasionally eaten by a race with the paste-end handler. The
+injected message — including Telegram and Slack relays — would land in the
+prompt and sit there forever, never submitted, until someone pressed Enter
+in the dashboard or tmux session manually.
+
+Two-layer fix:
+
+- **`SessionManager.verifyInjection`** (proactive). After every `rawInject`,
+  schedule a 1.5-second check that compares the first 40 chars of the message
+  against the pane at the `❯` prompt. If it's still there, send one extra
+  Enter. Single-shot per injection, no-op when the text submitted normally,
+  reports recovery via `DegradationReporter`.
+- **`StallTriageNurse` fast-path** (recovery-time backstop). Before paying for
+  an LLM diagnosis call, the triage nurse checks for ≥20 chars of text at the
+  `❯` prompt without any processing glyphs (`⎿ ✶ ⏺` / "Coalescing" /
+  "thinking" / "esc to interrupt"). If detected, nudge with a single Enter and
+  skip the LLM round-trip. Conservative heuristic — false positives at worst
+  send a harmless Enter.
+
+Tests: `tests/unit/session-injection-verify.test.ts` (7 tests),
+`tests/unit/stall-triage-typed-not-submitted.test.ts` (5 tests).
+
+Side-effects review:
+`upgrades/side-effects/verify-injection-stuck-input.md`.
+
+### Project-scope Phase 1a PR 2 — Stage validator + `/projects` API
+
+Second of three PRs scaffolding the project-scope feature. PR 1 added
+the type-level fields; this PR adds the persistence-layer validator and
+the HTTP surface your agent uses to register and inspect projects.
+
+Spec source: `docs/specs/PROJECT-SCOPE-SPEC.md` §§ Phase 1.2, 1.3, 1.6,
+1.10, 1.12.
+
+**New files (persistence/validator layer):**
+- `src/core/SafeYaml.ts` — minimal hand-rolled YAML-frontmatter
+  extractor with bounded depth and length, so user-supplied plan docs
+  can't smuggle in YAML-bomb input.
+- `src/core/PlanDocParser.ts` — parses a plan-doc markdown file into
+  `{project, children, errors}`. Validates required frontmatter, slug
+  shape, source/effort/scope tags, child uniqueness, round membership.
+- `src/core/StageTransitionValidator.ts` — deterministic validator for
+  child-initiative `pipelineStage` edges (`outline → approved →
+  building → merged`, plus skipped/regressed). Every check is an
+  artifact assertion: frontmatter literal equality, `gh pr view`
+  reports `MERGED`, file exists, realpath jailed under
+  `targetRepoPath`.
+
+**New HTTP endpoints (all require auth):**
+
+| Endpoint | Status | Notes |
+|----------|--------|-------|
+| `GET /projects` | functional | Lists project-kind initiatives. |
+| `GET /projects/:id` | functional | Project + its children. Supports `?fields=<csv>` projection. |
+| `GET /projects/:id/next` | placeholder (501) | Round-runner lands in Phase 1b. |
+| `POST /projects` | functional | Creates project + children from a plan doc. Rate-limited 5/hour per auth token. |
+| `POST /projects/validate` | functional | Dry-run plan-doc parse; no side effects. |
+| `DELETE /projects/:id` | functional | Archives; requires `If-Match`; refuses while a round is in-progress. |
+
+The full Phase 1.3 endpoint set (`advance`, `drift-check`, `halt`,
+`ack`, `accept-partial`, `claim-ownership`, `resolve-conflict`) lands
+in Phase 1b once the round-runner exists.
+
+**Other changes:**
+- `InitiativeTracker.list({ kind })` — new optional filter on `list()`.
+  Records without explicit `kind` are treated as `'task'` for back-compat.
+- Rate-limit counter persisted at `.instar/local/projects-rate.json`
+  (gitignored; never syncs across machines — matches per-agent semantics).
+
+## What to Tell Your User
+
+Two things landed in this release.
+
+First — a fix for the stuck-Telegram-message bug. Sometimes your message would
+land in my input box but never actually submit, and you'd have to press Enter
+in the dashboard to unstick me. That race is now caught automatically: after
+every injection I do a quick re-check, and if your message is still sitting
+there waiting, I press Enter for it. There's also a backstop in the stall
+recovery path. You shouldn't have to nudge me again.
+
+Second — your agent now has a real HTTP surface for projects. You (or your
+agent) can register a multi-spec project from a plan-doc markdown file and
+have the agent track it as a top-level project-kind initiative with children
+rolled up underneath.
+
+Right now the projects piece is plumbing. It lets a caller do six things:
+list projects, fetch one, dry-run a plan doc, create from a plan doc, ask
+"what's next?" (currently returns a placeholder — the round-runner lands in
+the next phase), and archive a project. The endpoints are auth-gated and
+creation is rate-limited to five per hour so a buggy caller cannot
+accidentally spawn a flood of projects. The advance, halt, and acknowledge
+endpoints — the ones that actually drive a project forward — land in the
+next phase along with the round-runner that powers them.
+
+Nothing existing changes shape. The initiatives routes still return what
+they always did. If you do not use the new endpoints, you will not notice
+anything.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Auto-recover stuck Telegram/Slack injections | automatic — `SessionManager.verifyInjection` resends Enter when needed |
+| Register a project from a plan doc | `POST /projects` with `{"planDocPath": "<abs-path>"}` |
+| Dry-run validate a plan doc | `POST /projects/validate` with `{"planDocPath": "<abs-path>"}` |
+| List all projects | `GET /projects` |
+| Fetch project + children | `GET /projects/:id` (optionally `?fields=id,title,pipelineStage`) |
+| Archive a project | `DELETE /projects/:id` with `If-Match: <version>` |
+| Stage-transition validator (library) | `import { validateStageTransition } from './core/StageTransitionValidator.js'` |
+
+## Evidence
+
+**Stuck-input fix (PR #151).** Reproduction: Justin observed Telegram messages
+landing in Claude Code's input buffer at the `❯` prompt without being submitted
+on Claude Code v2.1.139, confirmed by a 2026-05-11 dashboard screenshot showing
+the message text visible at the prompt with no processing glyphs. The race
+matches the original failure mode that the verifyInjection design (April 13,
+commit a81699d4) was written for. Observed-before: message sat in input
+indefinitely until a manual Enter from the dashboard. Verified-after: with
+verifyInjection in `rawInject`, a 1.5s post-injection check fires and
+auto-resends Enter when the marker text is still at the prompt; recovery
+reported via DegradationReporter. Coverage:
+- `tests/unit/session-injection-verify.test.ts` — 7 tests covering marker
+  extraction, captureOutput, Enter resend, and the no-op when the text
+  submitted normally.
+- `tests/unit/stall-triage-typed-not-submitted.test.ts` — 5 tests covering the
+  StallTriage fast-path: detection thresholds, glyph-presence refusal, the
+  LLM-bypass nudge.
+- Side-effects review: `upgrades/side-effects/verify-injection-stuck-input.md`.
+
+**Project-scope Phase 1a PR 2.** Spec:
+`docs/specs/PROJECT-SCOPE-SPEC.md` §§ 1.2, 1.3, 1.6, 1.10, 1.12.
+
+- `tests/unit/PlanDocParser.test.ts` — 9 new tests covering frontmatter
+  parsing, slug validation, source/effort/scope tags, child uniqueness.
+- `tests/unit/StageTransitionValidator.test.ts` — 26 new tests covering
+  every named edge, reconciler bypass, jail check, PR state mapping.
+- `tests/integration/projects-api.test.ts` — 14 new tests covering all
+  six endpoints end-to-end through the live express router.
+- Side-effects review: `upgrades/side-effects/project-scope-phase1a-pr2.md`.

package/upgrades/side-effects/0.28.86.md

@@ -0,0 +1,13 @@
+# Side-Effects Review — v0.28.86
+
+This release shipped one user-facing change:
+
+- **Project-scope Phase 1a PR 1 — Initiative type extension**
+
+Side-effects review for that change lives at
+[`project-scope-phase1a-pr1.md`](./project-scope-phase1a-pr1.md). It was
+authored before the release-cut script started linking artifacts by version
+filename; this file is the version-keyed pointer the pre-push gate looks for.
+
+No other behavior changed in 0.28.86 beyond the type-level scaffolding
+documented in that review.