instar 1.3.111 → 1.3.113

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-30T07:33:02.628Z",
-  "instarVersion": "1.3.111",
+  "generatedAt": "2026-05-30T10:06:52.662Z",
+  "instarVersion": "1.3.113",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -409,7 +409,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -417,7 +417,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -425,7 +425,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -433,7 +433,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -441,7 +441,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -449,7 +449,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -457,7 +457,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -465,7 +465,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -473,7 +473,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -481,7 +481,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -489,7 +489,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -497,7 +497,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -505,7 +505,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -513,7 +513,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -521,7 +521,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -529,7 +529,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -537,7 +537,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -545,7 +545,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -553,7 +553,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -561,7 +561,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -569,7 +569,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -577,7 +577,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -585,7 +585,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -593,7 +593,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -601,7 +601,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -609,7 +609,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -617,7 +617,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -625,7 +625,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -633,7 +633,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -641,7 +641,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -649,7 +649,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -657,7 +657,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -665,7 +665,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -673,7 +673,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -681,7 +681,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -689,7 +689,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -697,7 +697,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -705,7 +705,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -713,7 +713,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -721,7 +721,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -729,7 +729,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -737,7 +737,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -745,7 +745,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -761,7 +761,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "80b68f39cb6113a879db06c1e704cbc1f999b95c8a5021cbf1b0bbac1f0dbb8d",
+      "contentHash": "85676f4062c0ea35989c300891883e3d6db36080e4674bca111020a9d64d1081",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.112.md

@@ -0,0 +1,54 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**The UnjustifiedStopGate now has a self-circuit-breaker, fixing a chronic
+`/health` degraded-flood + subprocess churn on subscription agents.**
+
+The stop gate rules on Stop events via a Haiku judgment call. On subscription
+agents (no API key) that call goes through `ClaudeCliIntelligenceProvider`, which
+spawns a `claude -p` subprocess — irreducibly ~5-6s — but the gate's client budget
+is `clientTimeoutMs = 2000`. So on every subscription agent the gate times out on
+EVERY stop: it fail-opens (never ruling), wastefully spawns+kills a `claude`
+subprocess, and emits one `DegradationReport` per stop — flooding `/health` with
+identical `degraded` entries (observed 22+) that look alarming but mean nothing.
+
+After `breakerThreshold` (default 3) consecutive provider failures the gate opens
+its breaker: `evaluate()` fails open IMMEDIATELY without spawning, for
+`breakerCooldownMs` (default 5 min), then retries once (half-open); a reachable
+provider resets it. The fail-open decision is unchanged — `breakerOpen` allows the
+stop exactly like `timeout` — so the breaker only makes the unavoidable fail-open
+fast (no doomed subprocess) and quiet (no per-event degradation, no rollup skew).
+`breakerThreshold: 0` disables it.
+
+## What to Tell Your User
+
+Mostly invisible. This fixes a false alarm: on agents running without an API key, a
+safety check was timing out on every stop, which made my health page show
+"degraded" with lots of identical entries even though nothing was actually wrong —
+and it was wastefully launching and killing a helper process each time. I added a
+self-healing circuit breaker so it stops the wasted work and the false alarms and
+recovers on its own. My actual behavior when stopping is unchanged.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Stop-gate circuit breaker (self-healing) | Automatic; tune via the gate's `breakerThreshold` / `breakerCooldownMs` |
+| Disable the breaker | `breakerThreshold: 0` |
+| Breaker telemetry | `UnjustifiedStopGate.breakerState()` |
+
+## Evidence
+
+- **Live reproduction:** with all other agents paused (no load), Echo's `/health`
+  read `degraded` with 22+ identical `unjustifiedStopGate.timeout` entries; a
+  `claude -p` haiku call in the agent cwd returned in ~5-9s, far over the 2000ms
+  budget — confirming the timeout-on-every-stop + spawn-then-kill churn.
+- **Tests:** `tests/unit/UnjustifiedStopGate-breaker.test.ts` (5) — opens after K
+  failures and stops calling the provider; half-open retry after cooldown;
+  reachable-provider reset; `breakerThreshold=0` disables; a real timeout counts.
+  Existing gate/route/db suites (42) green. `tsc` + lint clean.
+- Spec: `docs/specs/STOPGATE-CLI-CIRCUIT-BREAKER-SPEC.md`. Side-effects:
+  `upgrades/side-effects/stopgate-cli-circuit-breaker.md`.

package/upgrades/1.3.113.md

@@ -0,0 +1,24 @@
+# Upgrade Guide - vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+Threadline conversation lifecycle now retires stale active and idle threads automatically. Conversations that have seen no activity for 24 hours are archived instead of staying in the active set forever, while pinned conversations are left alone. Archived conversations keep their history and metadata, so a later peer reply can still reactivate the relationship context.
+
+The Threadline active-agent summary also now reports only truly active threads. Idle conversations are no longer counted as active work, which makes agent health and collaboration dashboards reflect the real current workload instead of accumulated stale conversations.
+
+## What to Tell Your User
+
+- **Cleaner Threadline state**: "I now clean up old Threadline conversations automatically, so stale inter-agent chats stop cluttering the active thread count while the relationship history remains available."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Stale Threadline retirement | Automatic during Threadline active-thread reads |
+| Accurate active thread counts | Automatic in threadline agent status |
+
+## Evidence
+
+Codey's live Threadline store showed 42 conversations before the change: 39 active, 3 idle, and 38 with Echo. Many were single-message relay threads from May 23-28 that still counted as active on May 30. Focused regression tests now prove stale active and idle conversations are archived without deletion, pinned stale threads remain active, and idle threads no longer increment the active thread metric.

package/upgrades/side-effects/stopgate-cli-circuit-breaker.md

@@ -0,0 +1,62 @@
+# Side-effects review — UnjustifiedStopGate circuit breaker
+
+**Spec:** `docs/specs/STOPGATE-CLI-CIRCUIT-BREAKER-SPEC.md`
+**Change:** a self-circuit-breaker on the stop gate's LLM path so subscription
+agents (where a `claude -p` judgment call takes ~5-6s but the budget is ~2s) stop
+churning doomed subprocesses and flooding /health with per-stop degradations.
+**Class:** robustness fix (found by the 12h session's "load is suspect" investigation).
+
+## What changed
+
+- **`src/core/UnjustifiedStopGate.ts`** — new config `breakerThreshold` (default 3),
+  `breakerCooldownMs` (default 5 min), injectable `now`. New `breakerOpen` failure
+  kind + `breakerState()` telemetry. `evaluate()` short-circuits (no LLM call) while
+  the breaker is open; counts provider failures (timeout/llmUnavailable); resets on
+  a reachable provider.
+- **`src/core/StopGateDb.ts`** — `InvalidKind` gains `breakerOpen`.
+- **`src/server/routes.ts`** — `/internal/stop-gate/evaluate` fail-opens on
+  `breakerOpen` (as for any failure) but skips the failure DB record + the
+  DegradationReport for it (deliberate short-circuit, not an evaluation failure).
+
+## Blast radius
+
+- **Stop decisions:** unchanged. `breakerOpen` allows the stop exactly like a
+  `timeout` fail-open — the breaker can never make a stop decision worse, only the
+  fail-open faster + quieter. (This is what keeps the change low-risk despite the
+  stop gate being safety-adjacent.)
+- **Fast-provider (API-key) agents:** the breaker never opens (calls succeed) →
+  identical behaviour to today. Only slow/unavailable-provider agents see the
+  short-circuit.
+- **Stop-gate analytics:** `breakerOpen` is excluded from the failure rollup (it
+  is not an evaluation failure), so the gate's failure-rate metric is no longer
+  skewed by the very churn the breaker stops.
+- **/health:** stops flooding — at most `breakerThreshold` degradations per
+  cooldown window instead of one per stop event.
+- **Config / schema / migration:** none. Safe in-code defaults; no PostUpdateMigrator
+  entry. Operators may pass `breakerThreshold`/`breakerCooldownMs`/`clientTimeoutMs`
+  via the gate constructor if they want to tune it.
+
+## What could break (and why it doesn't)
+
+- **Breaker stuck open forever?** No — it half-opens after the cooldown and a
+  single reachable response closes it. A genuinely recovered provider self-heals.
+- **A transient blip opens it?** Only after `breakerThreshold` (3) CONSECUTIVE
+  failures; a single success in between resets the counter.
+- **Lost audit of fail-opens?** Real evaluation failures (timeout, malformed, etc.)
+  are still recorded + reported exactly as before; only the deliberate breaker
+  short-circuit is excluded.
+
+## Security
+
+No new external input / network / auth / fs surface. Pure in-memory breaker state.
+
+## Rollback
+
+Revert the commit, or set `breakerThreshold: 0` (disables the breaker). No state.
+
+## Tests
+
+`tests/unit/UnjustifiedStopGate-breaker.test.ts` (+5): opens after K + stops
+calling the provider; half-open retry after cooldown; reachable-provider reset;
+threshold=0 disables; real-timeout counts. Existing gate/route/db suites (42) green.
+`tsc` + lint clean.

package/upgrades/side-effects/threadline-stale-thread-retirement.md

@@ -0,0 +1,35 @@
+# Side-effects review - Threadline stale thread retirement
+
+## 1. Over-block / under-block
+
+Over-block risk is that an ongoing but quiet Threadline conversation could be archived after 24 hours. The mitigation is that archival is non-destructive: history, metadata, remote agent identity, and thread id stay in the conversation store, and a later peer reply can reactivate the same thread. Pinned conversations are excluded entirely.
+
+Under-block risk is that stale conversations younger than 24 hours still count as active until the threshold passes. That is intentional because a shorter threshold could retire normal overnight collaborations too aggressively. The active metric was also tightened so idle conversations stop inflating active counts immediately.
+
+## 2. Level-of-abstraction fit
+
+The retirement primitive lives in `ConversationStore`, which owns persisted Threadline conversation state. `ThreadResumeMap` invokes it before active-set reads because that class is the compatibility view used by Threadline surfaces. The MCP status metric is corrected at the presentation layer by counting only active states.
+
+## 3. Signal vs authority compliance
+
+The change does not add a brittle blocking detector. The store applies a deterministic lifecycle rule to local persisted state, and it archives rather than deletes. The active-thread metric is a signal to operators and agents; it no longer treats idle records as active authority.
+
+## 4. Interactions with adjacent systems
+
+Threadline resume remains intact because archived conversations are not deleted. Relay reply handling can still find the thread by id and update it. Pinned conversations remain available for long-running relationships. Existing resolved and archived conversations are unaffected.
+
+## 5. Rollback cost
+
+Low. Reverting the store method, resume-map call sites, and metric filter restores prior behavior. Already-archived stale conversations remain preserved on disk and can be reactivated by inbound messages or manually inspected.
+
+## 6. Backwards compatibility / drift surface
+
+The store schema does not change. The only behavior change is automatic state transition to `archived` for inactive, non-pinned conversations. The 24-hour threshold is centralized as a named default so future tuning has one obvious place.
+
+## 7. Authorization / trust posture
+
+No external calls, credentials, or user-visible messaging paths are added. The change only mutates local Threadline conversation state through the existing `ConversationStore` mutation path.
+
+## Outcome
+
+Ship. The fix addresses the observed active-thread accumulation without destroying conversation history or changing network protocols.