instar 1.2.59 → 1.2.61

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.2.59",
+  "version": "1.2.61",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-24T20:16:57.281Z",
-  "instarVersion": "1.2.59",
+  "generatedAt": "2026-05-24T21:29:04.458Z",
+  "instarVersion": "1.2.61",
   "entryCount": 191,
   "entries": {
     "hook:session-start": {
@@ -392,7 +392,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -400,7 +400,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -408,7 +408,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -416,7 +416,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -424,7 +424,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -432,7 +432,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -440,7 +440,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -448,7 +448,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -456,7 +456,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -464,7 +464,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -472,7 +472,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -480,7 +480,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -488,7 +488,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -496,7 +496,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -504,7 +504,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -512,7 +512,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -520,7 +520,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -528,7 +528,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -536,7 +536,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -544,7 +544,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -552,7 +552,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -560,7 +560,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -568,7 +568,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -576,7 +576,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -584,7 +584,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -592,7 +592,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -600,7 +600,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -608,7 +608,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -616,7 +616,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -624,7 +624,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -632,7 +632,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -640,7 +640,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -648,7 +648,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -656,7 +656,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -664,7 +664,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -672,7 +672,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -680,7 +680,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -688,7 +688,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -696,7 +696,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -704,7 +704,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -712,7 +712,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -720,7 +720,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -728,7 +728,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -744,7 +744,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9c3a0b58c578a392d4a299917fd71f43911c282963247611122739eb59c2415e",
+      "contentHash": "1397612a42656f1c9bc6649aee811f7eb3842fbc14f7bcec7438644b187ea6d6",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.2.60.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — NEXT (human-as-detector)
+
+<!-- bump: minor -->
+<!-- minor = new capability, backward compatible -->
+
+## What Changed
+
+**New: instar now treats a human-caught coherence break as a first-class diagnostic signal.**
+
+When the user has to point something out — "that's wrong", "you already said the opposite",
+"that's out of date", "why didn't you catch this" — that correction is no longer just an
+input to fix quietly. It is evidence that some automated guardian (CoherenceGate,
+CoherenceMonitor, a freshness check) *should* have caught it and didn't. The new
+`HumanAsDetectorLog` (`src/monitoring/HumanAsDetectorLog.ts`) observes inbound human
+messages, classifies corrections with a conservative, precision-biased regex set (no LLM,
+no network), and records each as a signal mapped to the guardian layer that plausibly
+failed. Over time this builds a heat map of "where the human is doing the system's job",
+exposed read-only at `GET /human-as-detector/summary`.
+
+This is the user-feedback half of the Continuous Working Awareness north star: never let a
+user correction go to waste. It mirrors `DegradationReporter`: a singleton configured at
+startup, append-only JSONL persistence at `.instar/metrics/human-as-detector.jsonl`,
+best-effort, and it never throws into message handling. The observe hook is chained onto the
+inbound Telegram message callback (preserving prior callbacks; only inbound human messages
+are observed).
+
+## What to Tell Your User
+
+When you point out something I got wrong or stale, I now treat that as a sign one of my own
+safety checks missed it — not just a one-off to fix and forget. I quietly keep score of which
+checks keep letting things slip past, so we can see where my automated guardrails are weak and
+strengthen them over time. Nothing for you to set up; existing agents get it on their next
+update. You can ask me to show the heat map of where you've had to catch my mistakes.
+
+## Summary of New Capabilities
+
+- New `HumanAsDetectorLog` monitor: classifies inbound human corrections into categories
+  (factual-correction, staleness, contradiction, source-of-truth-drift, repeat-ask,
+  meta-failure), each mapped to the guardian layer that should have caught it.
+- New read-only endpoint `GET /human-as-detector/summary` — the heat map grouped by suspected
+  failed layer, plus recent signals.
+- Append-only audit trail at `.instar/metrics/human-as-detector.jsonl`.
+- Always-on, no config, no LLM, no network; best-effort and never throws into message handling.
+
+## Evidence
+
+- Tier 1 (unit): 19 tests — 15 on the classifier/observe/heat-map core, 4 on the
+  inbound-human gating helper (`observeInboundMessage`). All pass.
+- Tier 2 (integration): 3 tests against the real `createRoutes` pipeline — empty map,
+  recorded correction surfaces, non-correction ignored. All pass.
+- Tier 3 (e2e): 2 tests booting the real route tree on a live HTTP server — endpoint alive
+  (200), and an observed correction flows to the live endpoint AND to the JSONL on disk.
+  All pass.
+- `npx tsc --noEmit` clean.
+- Ported from Dawn's reference implementation (the-portal handoff); built fresh on current
+  `origin/main`, not from the stale local checkout (avoids reverting SafeFsExecutor /
+  iMessage-attachment features per the handoff's critical warnings).

package/upgrades/1.2.61.md

@@ -0,0 +1,37 @@
+# Upgrade Guide — NEXT (A Wall Is a Hypothesis: new constitution standard + B16 guard)
+
+<!-- bump: patch -->
+<!-- patch = new guard rule within the existing outbound authority + docs; backward compatible -->
+
+## What Changed
+
+**New constitution standard "A Wall Is a Hypothesis", with real structural enforcement.**
+
+Added to the Standards Registry (The Substrate family, beside "The Right to Stand Ground"): before an agent declares a path infeasible / blocked / impossible because some interface or API is missing, it must first inventory the capabilities it already has. A limitation is a hypothesis to test against your own toolkit, not a verdict to accept. A real wall, named honestly after that inventory, is fine — the failure is surrendering without it.
+
+Enforcement is a new always-evaluated rule, **B16_UNVERIFIED_WALL**, in `MessagingToneGate` (the same outbound-message authority that hosts B15's self-stop guard). It blocks an outbound message that declares infeasibility from a missing interface/API/mechanism when the message shows no evidence the agent checked its own tools first. Severity favors false-negatives: genuinely-external limits ("I can't read your email until you connect it"), walls reported after a visible inventory, real either/or questions, and messages discussing the rule all pass.
+
+The standard is also registered in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` (P11), the catalog the `/spec-converge` reviewer loads, so specs that accept an untested wall are flagged at review time.
+
+The registry's own "how a new standard joins" step was corrected for accuracy: the registry-wide conformance gate and the Usher that would read the registry directly are described as actively-being-built North Star surfaces, not as already live — the registry does not yet enforce itself.
+
+## What to Tell Your User
+
+I added a new rule to my own constitution and wired it so it actually bites. Before I tell you something is impossible or can't be done, I now have to check the tools I already have that might get past it. The reason is a recent miss where I called a feature impossible because it had no official hookup for other programs — while forgetting that typing into a live session is one of my core abilities. A checker now reads my outgoing messages and stops me if I claim something is blocked without first showing I looked. The balance matters: this is not me never giving up. Real dead-ends, named after I've actually checked, go through fine, and so do normal limits like needing you to connect an account first. You should just notice fewer "that's impossible" answers that fall apart the moment you push back.
+
+## Summary of New Capabilities
+
+- New constitution standard "A Wall Is a Hypothesis" in the Standards Registry (The Substrate family).
+- New outbound-gate rule B16_UNVERIFIED_WALL blocks unverified infeasibility claims; biased toward false-negatives so ordinary messages pass.
+- Standard registered as principle P11 in the design-principles catalog the spec-review reviewer reads.
+- Registry governance step corrected to distinguish enforcement that is live today from the conformance gate and Usher being built.
+
+## Migration Notes
+
+No action required. `MessagingToneGate` runs server-side, so the rule ships with the server on update — no per-agent migration. The changes to the Standards Registry and the design-principles catalog are repository documentation.
+
+## Evidence
+
+- **Unit** (`tests/unit/messaging-tone-gate-b16.test.ts`, 9 tests): the B16 rule + its infeasibility markers + carve-outs render in the prompt; the gate accepts B16 as a valid rule id without fail-open on the /goal-style wall; both sides of the boundary pass correctly (wall-after-inventory, genuinely-external limit, rule-discussion); drift detection preserved (an invented rule id still fails open).
+- **Integration** (`tests/integration/telegram-reply-b16-wall.test.ts`, 2 tests): through the real POST /telegram/reply route, a B16 block returns 422 with rule B16_UNVERIFIED_WALL and the message is not sent; a passing reply still delivers 200.
+- tsc clean.

package/upgrades/side-effects/human-as-detector.md

@@ -0,0 +1,43 @@
+# Side-Effects Review — HumanAsDetectorLog
+
+**Change**: Ports Dawn's human-as-detector pattern into Instar. Treats every human-caught
+coherence break as a first-class signal about which automated layer failed to catch it.
+
+## Files
+- `src/monitoring/HumanAsDetectorLog.ts` (new) — singleton, deterministic no-LLM classifier,
+  append-only `.instar/metrics/human-as-detector.jsonl`, `summarizeByLayer()` heat map, plus
+  the `observeInboundMessage()` gating helper (inbound-human-only).
+- `tests/unit/HumanAsDetectorLog.test.ts` (new) — 19 unit tests (classifier/observe/heat-map +
+  gating-helper wiring integrity).
+- `tests/integration/human-as-detector-routes.test.ts` (new) — 3 tests via real `createRoutes`.
+- `tests/e2e/human-as-detector-lifecycle.test.ts` (new) — 2 tests, live HTTP boot + disk.
+- `src/server/routes.ts` — adds read-only `GET /human-as-detector/summary` (singleton-backed).
+- `src/commands/server.ts` — configure() at startup; `observeInboundMessage()` chained onto
+  `telegram.onMessageLogged` (chains prior callbacks; only inbound human messages).
+
+## Side effects
+- **New disk write**: appends to `.instar/metrics/human-as-detector.jsonl` only when an
+  inbound human message matches a correction signal. Best-effort; wrapped in try/catch; never
+  throws into message handling.
+- **Console**: one `[HUMAN-AS-DETECTOR]` warn line per detected signal (mirrors
+  DegradationReporter's loud-not-silent convention).
+- **No network, no LLM, no external calls.** Classifier is pure regex over a conservative set.
+- **No behavior change to message handling**: the hook only observes; prior `onMessageLogged`
+  callbacks (TopicMemory dual-write, PresenceProxy, keep-watching) are preserved via chaining.
+- **New endpoint** is read-only and singleton-backed (always available; no 503 path).
+
+## Risk
+- Low. Additive, isolated module. Worst case on a logic bug: a spurious JSONL line or a missed
+  signal — neither affects message delivery (observe never throws into the caller).
+- False-positive risk on the classifier is bounded by the `totalWeight >= 2` threshold (lone
+  weak signals like "actually," are ignored).
+- Rollback cost: trivial — drop the module, the endpoint, and the ~6 wiring lines; no schema,
+  no migration, no config default.
+
+## Signal vs authority
+- Pure signal. The log only *records* and *summarizes*; it has no blocking authority and gates
+  nothing. Consumers (a human reading the heat map, or future evolution tooling) decide.
+
+## Verification
+- `npx tsc --noEmit` — clean (no new errors).
+- `npx vitest run` on the three new test files — 24/24 pass across unit + integration + e2e.

package/upgrades/side-effects/wall-is-a-hypothesis-standard.md

@@ -0,0 +1,49 @@
+# Side-Effects Review — A Wall Is a Hypothesis (B16_UNVERIFIED_WALL)
+
+**Slug:** `wall-is-a-hypothesis-standard`
+**Date:** 2026-05-24
+**Author:** echo
+**Second-pass reviewer:** internal conformance pass
+
+## Summary of the change
+
+Adds the constitution standard "A Wall Is a Hypothesis" to `docs/STANDARDS-REGISTRY.md` and its structural enforcement: a new always-evaluated rule **B16_UNVERIFIED_WALL** in `MessagingToneGate` (the existing outbound-message authority that hosts B15). B16 blocks an outbound message that declares a path impossible/blocked/infeasible because an interface/API/mechanism is missing, when the message shows no evidence the agent inventoried its own capabilities first. Also registers the standard in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` (the catalog the `/spec-converge` reviewer loads).
+
+## Decision-point inventory
+
+- `VALID_RULES` set — **add** `'B16_UNVERIFIED_WALL'`. Without this the gate's drift-detection fails-open on a legitimate B16 citation.
+- `buildPrompt()` rule section — **add** the B16 definition after B15 (always-evaluated, no precondition).
+- Response-format enumeration + two stale doc comments — **modify** to include B16 (the comments already lagged at B14).
+- No route changes: `checkOutboundMessage` → 422 is rule-agnostic; B16 rides the existing outbound paths.
+
+## 1. Over-block
+
+The principal over-block risk: blocking ordinary "I can't do X" messages. Mitigated in the rule text — severity explicitly favors false-negatives; genuinely-external limits ("can't read your email until you connect it"), walls reported after a visible inventory, real either/or questions, real runtime errors, and messages discussing the rule all pass. The rule targets only the precise pattern: an internal feasibility verdict resting on a missing interface with no inventory shown.
+
+## 2. Under-block (a real wall-surrender slipping through)
+
+Possible if the LLM judge misses a borderline case — acceptable by design (favor false-negatives), matching the gate's stated philosophy (high signal, not adversarial correctness). The standard + the `/spec-converge` registration provide the softer review-time catch as backup.
+
+## 3. Level-of-abstraction fit
+
+Correct: the guard lives inside the single outbound authority (where B15 lives), not as a new detector with independent block power. Signal-vs-authority compliant.
+
+## 4. Blocking authority
+
+No new brittle authority. B16 is one more rule the existing authority may cite; the 422 plumbing is unchanged. Fail-open behavior (LLM error/timeout/invalid-rule) is inherited unchanged.
+
+## 5. Interactions
+
+B16 is always evaluated alongside B15 and the signal/health rules in one LLM call — no extra calls, marginally longer prompt. No interaction with the health-alert (B12-B14) or style (B11) rules, which remain gated by their preconditions. The drift-detection branch is unaffected (an invented rule id still fails open — covered by a regression test).
+
+## 6. External surfaces
+
+None. No new endpoints, credentials, or network calls. The standard's enforcement claim was verified against code before authoring (the registry is not parsed at runtime; the conformance gate and Usher are unbuilt North Star designs) — so the "Applied through" line states only what exists.
+
+## 7. Rollback cost
+
+Low. Reverting removes the rule from the set + prompt and the doc entries; no state, no migration, no schema. An older server simply lacks the rule.
+
+## 8. Test evidence
+
+Unit (`messaging-tone-gate-b16.test.ts`, 9 tests) + integration (`telegram-reply-b16-wall.test.ts`, 2 tests) green; tsc clean. Both sides of the decision boundary covered with realistic inputs; the /goal-style wall blocks through the real route (422, message suppressed) and the happy path still delivers (200).