instar 1.2.78 → 1.2.80

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-25T19:49:20.468Z",
-  "instarVersion": "1.2.78",
+  "generatedAt": "2026-05-25T21:59:37.920Z",
+  "instarVersion": "1.2.80",
   "entryCount": 191,
   "entries": {
     "hook:session-start": {
@@ -392,7 +392,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -400,7 +400,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -408,7 +408,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -416,7 +416,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -424,7 +424,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -432,7 +432,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -440,7 +440,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -448,7 +448,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -456,7 +456,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -464,7 +464,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -472,7 +472,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -480,7 +480,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -488,7 +488,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -496,7 +496,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -504,7 +504,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -512,7 +512,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -520,7 +520,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -528,7 +528,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -536,7 +536,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -544,7 +544,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -552,7 +552,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -560,7 +560,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -568,7 +568,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -576,7 +576,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -584,7 +584,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -592,7 +592,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -600,7 +600,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -608,7 +608,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -616,7 +616,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -624,7 +624,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -632,7 +632,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -640,7 +640,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -648,7 +648,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -656,7 +656,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -664,7 +664,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -672,7 +672,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -680,7 +680,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -688,7 +688,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -696,7 +696,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -704,7 +704,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -712,7 +712,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -720,7 +720,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -728,7 +728,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -744,7 +744,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "5dc56bb977d66452b6a563412f2ea396d6e684c52b233add8771a15288c6c208",
+      "contentHash": "7ac85b7a93c149b17daa4e7ef7a6396e85ecab9f9560eb79b083284013907d5a",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1440,7 +1440,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "074c270761f1a6bd512d77c09465217087d169a19d012a9b2bf76d270b5811e5",
+      "contentHash": "823d36d25490f6afb6968e96d27a538ce031dae7d97a7f2c979ddab707d2918a",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.2.79.md

@@ -0,0 +1,68 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: minor -->
+<!-- minor = new capability, backward compatible -->
+
+## What Changed
+
+Threadline collaboration is now **visible to the operator** instead of happening
+in an invisible side channel (CMT-509). Driven by a real incident: an agent-to-
+agent collaboration ran entirely in background worker sessions and never surfaced
+to the operator, AND the "report back" commitment resolved with the operator never
+informed.
+
+**The fixes (a quiet MVP — convergence scoped it down from "surface everything"
+so it doesn't violate the near-silent-notifications standard):**
+
+1. **Report-back commitments wait for the user.** A `threadline-reply` commitment
+   no longer resolves on delivery-mode alone — it resolves only when the reply was
+   actually surfaced to the user (live-inject into the topic session, or a
+   resume-pending whose Telegram surface confirmed). An un-surfaced reply leaves
+   the commitment OPEN (beacon keeps heartbeating; 7-day TTL backstop).
+2. **Parentless conversations surface to a dedicated Threadline topic.** When a
+   peer reaches out cold (no parent topic), a single warranted first contact posts
+   to ONE dedicated "Threadline" topic — created on demand + reused, kept separate
+   from the generic attention list, never per-thread. One quiet post per
+   conversation (deduped), gated by the warrants-a-reply check so a multi-turn
+   exchange doesn't flood the operator.
+3. Topic-bound conversations continue to surface in their parent topic
+   (TopicLinkageHandler), at most one user-facing post per reply.
+
+## What to Tell Your User
+
+When another agent collaborates with me, you'll now see it: cold outreach shows up
+as one quiet heads-up in a dedicated Threadline topic, and a collaboration tied to
+one of your conversations surfaces right there. And "I'll report back" now actually
+waits until you've been told — it won't quietly mark itself done. It stays
+near-silent: only genuinely new, relevant content surfaces.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Parentless-conversation surfacing | Automatic; one dedicated "Threadline" topic, deduped, near-silent |
+| Commitment resolves only after user-facing surface | Automatic; un-surfaced replies keep the commitment open |
+
+## Migration Notes
+
+Additive. New state file `.instar/threadline/collaboration-surface.json` (dedicated
+topic id + dedupe). Behind `threadline.surfaceCollaboration` (default on). No
+`~/.codex` or relay change.
+
+## Evidence
+
+- Spec: `docs/specs/THREADLINE-COLLABORATION-SURFACING-SPEC.md` (+ ELI16 +
+  convergence report — scoped down to a low-noise MVP; §3 found to need no code
+  change against the live behavior).
+- Tests: `CollaborationSurfacer.test.ts` (9 — routing/dedupe/topic-reuse/JSON-strip/
+  non-fatal), `TopicLinkageHandler.test.ts` (+1 regression: resume-pending with no
+  surface keeps the commitment open), wiring-integrity
+  `collaboration-surfacing-wiring.test.ts` (5 — constructed + invoked at both seams).
+- Test-as-self on live `instar-codey` before merge (cold peer note → one operator
+  update, no spam, commitment resolves only after).
+
+## Rollback
+
+Behind `threadline.surfaceCollaboration` (flag off = today's behavior). The
+commitment-resolution change is a guard on an existing call; revert removes it. No
+state migration.

package/upgrades/1.2.80.md

@@ -0,0 +1,28 @@
+# Upgrade Notes — NEXT
+
+## What Changed
+
+Enable-layer coherence — three objective fixes so a feature's on/off switch actually works:
+
+1. **Telemetry deadlock fixed.** `POST /telemetry/enable` previously returned 503 ("subsystem not initialized") because the telemetry heartbeat was only constructed at boot *if telemetry was already enabled* — so it could never be turned on through its own endpoint. The heartbeat is now always constructed (construction is cheap and pure); the side-effecting parts (`start()`/submit()) already self-gate on the enabled flag, so a constructed-but-disabled heartbeat never starts a loop and never sends anything. Enabling now works.
+
+2. **Two broken feature toggles fixed.** The `dispatches` and `feedback` feature toggles pointed at config keys the API refused to change, so calling them returned 400 (the switch was wired to nothing). Both keys are now accepted by `PATCH /config`. (Both are real config keys; the toggles simply weren't in the allowlist.)
+
+3. **A guard so this can't recur.** A new build-time test asserts every feature's enable/disable action targets a real, accepted surface — a patchable config key or a known dedicated endpoint. This guard found the `feedback` toggle bug during development (in addition to the already-known `dispatches` one).
+
+## What to Tell Your User
+
+A few feature on/off switches were quietly wired to nothing — flipping them did nothing or errored. They work now, and there's a new safety check that fails the build if any future feature ships with a switch that points nowhere. Nothing changes in normal operation; this just makes "turn this feature on" mean what it says.
+
+## Summary of New Capabilities
+
+- `POST /telemetry/enable` works without a pre-existing enabled state (deadlock removed).
+- The `dispatches` and `feedback` feature toggles now function via `PATCH /config`.
+- New build-time guard: every feature's enable/disable action must target a real, patchable surface.
+
+## Evidence
+
+- **enableAction-validity guard** (`tests/unit/feature-enableaction-validity.test.ts`) — 15/15 green; it actively caught the `feedback` toggle bug (a second instance of the same class as the known `dispatches` bug) during development.
+- **Telemetry safety** relies on the already-tested self-gating: `TelemetryHeartbeat.test.ts` covers "does not start when disabled" and "does not send when disabled," so always-constructing is side-effect-safe; the route's enable behavior is covered by `telemetry-routes.test.ts`.
+- **Regression:** touched-area suite green (telemetry routes, TelemetryHeartbeat, validity = 99 passing); typecheck clean.
+- **Side-effects review:** `upgrades/side-effects/enable-layer-coherence.md`.

package/upgrades/side-effects/enable-layer-coherence.md

@@ -0,0 +1,74 @@
+# Side-Effects Review — Enable-layer coherence (low-risk half)
+
+**Version / slug:** `enable-layer-coherence`
+**Date:** `2026-05-25`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (objective bug-fixes, fail-safe, full guard coverage; spec-driven, approved)`
+
+## Summary of the change
+
+Three objective enable-path fixes (the low-risk half of feature-activation-coherence, approved by Justin): (1) always-construct `TelemetryHeartbeat` so `POST /telemetry/enable` isn't a deadlock (`src/commands/server.ts`); (2) add `dispatches` + `feedback` to the `PATCH /config` allowlist, extracted to an exported `PATCHABLE_CONFIG_KEYS` (`src/server/routes.ts`), fixing two toggles that 400'd; (3) a build-time enableAction-validity guard (`tests/unit/feature-enableaction-validity.test.ts`) that fails the build if any feature's enable/disable action targets a non-patchable surface. Spec: `docs/specs/enable-layer-coherence.md`.
+
+## Decision-point inventory
+
+- `PATCH /config` allowlist — **modify** — add two real config keys (`dispatches`, `feedback`); extract to a module-scope export.
+- Telemetry heartbeat construction — **modify** — always construct (was conditional); side-effects unchanged (self-gated internally).
+- enableAction-validity guard — **add** — build-time test, no runtime surface.
+
+---
+
+## 1. Over-block
+
+No new block/allow runtime surface that rejects legitimate input. The allowlist change *widens* what `PATCH /config` accepts (adds two keys); it cannot newly reject anything. Telemetry construction has no block surface. "No over-block — the change only widens acceptance + adds a build-time test."
+
+## 2. Under-block
+
+The enableAction-validity guard could miss a malformed action shape it doesn't model (e.g. a future action with a method other than PATCH/POST, or a `/config` body nested differently). It checks top-level body keys for `PATCH /config` and a known-endpoint set otherwise; an exotic future action shape would pass unchecked. Acceptable: it covers every current shape and the failure mode it guards (non-allowlisted config key). Telemetry: a classifier/provider outage means telemetry simply doesn't send (it's off anyway) — no under-block of anything user-facing.
+
+## 3. Level-of-abstraction fit
+
+Right layer. The allowlist is the existing accept-list at the route boundary; extracting it to an export (consumed by both the route and the test) is the correct single-source-of-truth move. The telemetry fix matches the existing always-construct/gate-effects pattern already used by `PrivateViewer`/publishing in the same file. The guard is a build-time unit test — the right place to assert a static invariant about FeatureDefinitions.
+
+## 4. Signal vs authority compliance
+
+**Reference:** docs/signal-vs-authority.md
+- [x] No — this change has no new block/allow authority surface (allowlist widening + always-construct + a build-time test).
+
+No brittle logic gains blocking authority. The allowlist is a passive accept-list (unchanged mechanism). Telemetry's authority (consent checker + enabled flag) is untouched.
+
+## 5. Interactions
+
+- **Shadowing:** none. Allowlist check is unchanged in position; telemetry construction moved from conditional to unconditional but `.start()` is still deferred to the same post-scheduler point and still no-ops when disabled.
+- **Double-fire:** none. Telemetry record callsites (`recordSessionSpawned`, `setConsentChecker`) now run for an always-constructed heartbeat; when disabled they buffer counters that never submit (bounded, harmless) and set a consent checker only consulted during (gated) submission.
+- **Races:** none new. Construction is synchronous at boot; the allowlist is read-only per request.
+- **Feedback loops:** none.
+
+## 6. External surfaces
+
+- **Other agents / install base:** ships to all agents on the normal server update. Telemetry stays off unless explicitly enabled (Echo: off). The two toggle fixes only make `dispatches`/`feedback` *enable-able* via API — they don't change any default (both remain whatever the config says; for Echo, `dispatches` absent = off, `feedback` already on).
+- **External systems:** no new egress. Telemetry submission remains gated on enabled + consent (both off for Echo). Enabling `dispatches` for a *downstream* agent now also constructs its puller (`AutoDispatcher`, gated on `config.dispatches` existing) — but that only happens if that agent's config has dispatches, which is their choice.
+- **Persistent state:** none added. `POST /telemetry/enable` provisions an install id only when actually called (unchanged).
+- **Response shape:** unchanged for existing callers (allowlist widening doesn't alter success/empty responses for previously-accepted keys).
+
+## 7. Rollback cost
+
+Pure code + a test. Each fix independently revertable: telemetry → conditional construction (deadlock returns, nothing else); allowlist → drop the two keys (toggles 400 again); guard → delete the test. No persistent state, no migration, no agent-state repair, no user-visible regression during rollback. Fail-safe: a bug in the telemetry change cannot cause egress (start/submit self-gate) — worst case is "behaves like today."
+
+## Conclusion
+
+No design changes from the review. The guard validated itself by catching a real second bug (`feedback`) during implementation — a strong signal the abstraction is right. All three fixes are objective, fail-safe, and independently revertable; telemetry egress is unchanged (off for Echo). Clear to ship. The behavior-reducing dispositions (autonomous-evolution execution retirement, response-review merge) are deliberately excluded — they await Justin's explicit decision in a separate spec.
+
+---
+
+## Second-pass review (if required)
+
+Not required — objective bug-fixes, fail-safe, full guard coverage, spec-driven + approved.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/feature-enableaction-validity.test.ts` — 15/15 green; caught the `feedback` toggle bug during development.
+- `tests/unit/TelemetryHeartbeat.test.ts` — "does not start when disabled" / "does not send when disabled" (the property making always-construct safe).
+- `tests/unit/telemetry-routes.test.ts` — enable-route behavior with a constructed heartbeat.
+- Typecheck clean; touched-area regression sweep 99 passing.