instar 1.3.1007 → 1.3.1009

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1007",
+  "version": "1.3.1009",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-27T17:44:44.950Z",
-  "instarVersion": "1.3.1007",
+  "generatedAt": "2026-07-27T19:04:51.259Z",
+  "instarVersion": "1.3.1009",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6576dddf2ae6a47a18f00cd06d178f2080d3aabee319f5da1cccb12225091e8c",
+      "contentHash": "66fd80500954f3527022e010a54d7b73b1a0d3f5dfab6342f5581e683e558145",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "b9037bc4bf60a2fb1a9a949e00e2453cf93069a6a40825cbffbc5177f6309043",
+      "contentHash": "a96f5e8942bb9a56eba284e59992f5f027a249cb7e600ae08db78a579764572e",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.1008.md

@@ -0,0 +1,39 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The live mentor-onboarding delivery path now places a durable content-keyed retry brake in front of every outbound prompt.
+
+- Identical unanswered content is limited to three attempts.
+- The attempt is persisted before transport actuation.
+- A transport refusal consumes the same bounded budget as an unacknowledged send.
+- The fourth identical attempt is suppressed.
+- A different agenda item receives an independent budget.
+- Exhaustion emits one distinct delivery-degradation signal, protected by a restart-surviving latch.
+- The retry ledger stores hashes rather than prompt text and refuses growth beyond 64 unresolved keys.
+
+The mentor tick now awaits the delivery callback and records a specific `deliveryReason` when the delivery layer refuses or fails. It no longer marks an asynchronous send as delivered before the transport has answered.
+
+## What to Tell Your User
+
+Mentor onboarding will no longer keep reposting the same unanswered question forever. It makes at most three attempts for identical content, remembers that limit across restarts, and reports one distinct delivery failure when the limit is reached. A genuinely new agenda item can still proceed.
+
+The prior anti-ping-pong guard was correlation-scoped. Once an unanswered correlation aged past the reply timeout, the guard deleted it and the next tick could post the same generated question again. A bot-to-bot receive-path failure therefore produced about twenty-four visible copies over twelve hours.
+
+## Summary of New Capabilities
+
+- Durable, normalized-content deduplication bounds identical unanswered mentor prompts at three attempts.
+- Retry exhaustion and transport failures are visible as structured delivery outcomes with one restart-surviving escalation.
+- New agenda content remains independently eligible while an exhausted item stays suppressed.
+- Existing version-1 outstanding-prompt files load normally and upgrade on their next write.
+
+## Compatibility
+
+Existing version-1 outstanding-prompt files continue to load. The next write upgrades the file to version 2. No config, route, migration job, tick cadence, agenda rule, or reply timeout changes.
+
+## Validation
+
+Refusal-first unit tests failed on unmodified source, then passed with the implementation. Unit, integration, and end-to-end coverage pins the bounded attempts, novel-content independence, restart durability, one-shot escalation, production transport-failure behavior, and status visibility.

package/upgrades/1.3.1009.md

@@ -0,0 +1,71 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed a rollout-active feature that could never graduate because the evidence its own spec
+nominates was unreadable.
+
+`docs/specs/claim-verification-sentinel.md` is `status: approved`, `rollout-disposition: active`,
+`rollout-evidence-type: endpoint`, with the graduation criterion
+`classified-completion-claims >= 1`. On `main`, that criterion was unevaluable:
+
+- `CompletionClaimVerifier` exists and **is** constructed (`AgentServer.ts:2572`), with
+  `monitoring.completionClaimVerification` configured at `dryRun: true`.
+- `POST /completion-claim/observe` and `GET /completion-claim/audit` are live, and the audit
+  route was **actively recording** (records dated `2026-07-27T17:46Z`, verdicts such as
+  `uncorroborated-unknown`).
+- `CompletionClaimVerifier.stats()` is implemented and was **called by no route**.
+- `/completion-claim/stats` → 404, and the spec's `rollout-evidence-ref`
+  (`/completion-claim-verification/stats`) named a prefix that has never existed → 404.
+
+So the feature observed, recorded, and sat in dry-run indefinitely with nothing able to read the
+number that would let anyone graduate it — and no error, alarm, or degraded signal anywhere,
+because a feature stuck in watch-only mode is indistinguishable from a feature being careful.
+
+Adds `GET /completion-claim/stats` (read-only counters, 503 when the verifier is absent, matching
+the sibling audit route) and corrects the spec's `rollout-evidence-ref` to the path that exists.
+
+The response carries both `stats.classifiedTurns` and the spec's own metric name
+`classified-completion-claims`, so a rollout check does not need to know the internal field name.
+
+## What to Tell Your User
+
+Your agent has a safety check that watches its own outgoing messages and flags factual claims it
+can't back up. It has been running in watch-only mode, which is correct — it was meant to prove
+itself before being allowed to do anything.
+
+It could never have finished proving itself. The plan said "switch it on once it has checked at
+least one claim", and pointed at an address for reading that number. The address was never built.
+The counting code existed and had been counting the whole time, with nothing able to read it.
+
+So it would have stayed in watch-only mode forever — not failing, just unmeasurable, and looking
+from the outside exactly like a feature being cautious.
+
+Nothing about what the check *does* has changed. It still only watches. What changed is that its
+progress can now be read, so a decision about switching it on can actually be made.
+
+## Summary of New Capabilities
+
+- Completion-claim verifier counters are readable at `GET /completion-claim/stats`, so a
+  rollout-active feature that was structurally unable to graduate now has evaluable evidence.
+- The spec's graduation metric is surfaced under its own name, so a rollout check does not depend
+  on internal field naming.
+- A feature that has classified nothing reports `0` rather than omitting the metric, so "idle" and
+  "broken endpoint" are distinguishable.
+
+## Evidence
+
+Tests run against **unmodified source first**:
+
+| run | result |
+|---|---|
+| route reverted | **5 failed** |
+| route applied | **5 passed** |
+| `tsc --noEmit` | clean |
+
+The retained case worth naming: when the feature has classified nothing, the metric must read `0`
+and not be omitted. An absent number is indistinguishable from "the endpoint does not work" —
+exactly the confusion that produced this defect.

package/upgrades/eli16/bounded-mentor-onboarding-retries.md

@@ -0,0 +1,53 @@
+# Bounded mentor-onboarding retries — Plain-English Overview
+
+> The one-line version: an unanswered mentor prompt can now be sent at most three times, the limit survives a restart, and the system reports delivery trouble instead of posting the same question forever.
+
+## The problem
+
+The mentor loop already avoided sending a second prompt while the first one was waiting for a reply. That protection had a hole: after twenty minutes, the old correlation was declared expired and removed. The next tick then treated the same words as a brand-new prompt.
+
+That is how one permission question appeared about every thirty minutes for roughly twelve hours. Each individual send looked legal because the previous correlation had expired. Across the whole episode, however, there was no content-level limit, so the system could repeat its own action indefinitely.
+
+The visible Telegram post also did not prove that the mentee could receive it. Telegram can display a message from one bot while withholding that bot-authored message from another bot's update stream. The old loop interpreted the missing reply as an unanswered coaching question and retried. It needed to recognize the repeated lack of confirmation as a delivery problem.
+
+## What changes
+
+Before any live mentor send, the existing outstanding-prompt tracker now normalizes the message, combines it with the mentee identity, and hashes that pair into a content key. The tracker durably reserves the attempt before it calls the transport.
+
+Each content key gets three attempts:
+
+- Attempt one is allowed.
+- Attempts two and three are allowed after the earlier correlation expires or the transport refuses it.
+- A fourth attempt with the same unanswered content is refused.
+- Different content gets a different key and remains eligible.
+
+The state file is upgraded in place from version 1 to version 2. It keeps the existing outstanding correlations and adds a bounded retry ledger. Only hashes and timing/count metadata are stored; the prompt text is not copied into this state.
+
+## Why the ordering matters
+
+The reservation is written before the send. If the retry ledger cannot be persisted, the transport is not called. This prevents a disk or state failure from silently removing the very brake that makes the self-action bounded.
+
+A transport refusal still consumes an attempt. Otherwise an unreachable destination could be retried forever while the counter remained at zero. A confirmed correlated reply clears that content episode, because repeating the same words after an actual reply is a new conversation rather than an unanswered retry.
+
+## What the operator sees
+
+The normal first attempts remain unchanged. When the content budget is exhausted, the mentor tick reports a distinct delivery reason instead of claiming success or folding the event into a generic unanswered-question state.
+
+The first exhaustion also emits one degradation signal explaining that delivery could not be confirmed and that identical sends are now suppressed. A persisted `escalatedAt` latch prevents the escalation itself from becoming another flood, including across a restart.
+
+## Boundaries
+
+This change does not alter Threadline identity resolution, Telegram's bot-to-bot behavior, the process-wide LLM circuit breaker, the mentor agenda, the reply timeout, the tick cadence, or budget limits. It does not add a route or configuration switch.
+
+The retry ledger is capped at 64 unresolved content keys. Reaching that cap refuses new mentor sends rather than growing state without limit. Version-1 files remain readable and are rewritten as version 2 on the next state change.
+
+## Proof
+
+The four requested refusal-first tests were added before implementation and failed against the original source because `reserveSend` did not exist. After implementation they prove:
+
+- first content is allowed;
+- identical unanswered content is refused after three attempts;
+- a different agenda item remains allowed;
+- the breaker and its one-shot escalation survive a reconstructed tracker using the same state file.
+
+Additional coverage proves whitespace-normalized dedupe, raw prompt text exclusion, the 64-key state bound, asynchronous delivery outcome handling, HTTP status propagation, and the real production delivery closure over three transport failures plus a fourth-send refusal.