instar 1.3.1190 → 1.3.1191

package/dist/data/standards-guard-index.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
-  "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1190",
+  "registrySha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "packageVersion": "1.3.1191",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "e2275b904b85c7db59a699f899b730f164b89ca204813d9766d5b1c5233a92ba",
-  "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1190"
+  "sha256": "f3973d47f7199ab0b06aa43bcb13b8034f61a88607b4da1ebf5aa436445670cc",
+  "registrySha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "packageVersion": "1.3.1191"
 }

package/dist/data/standards-registry.md

@@ -56,6 +56,8 @@ Generated by `scripts/generate-standards-hierarchy.mjs` from the parent/child de
 
 - [The Body and the Mind](#the-body-and-the-mind)
   - [Structure Decides Alone Only on an Exact Match](#structure-decides-alone-only-on-an-exact-match)
+- [Deferral = Deletion](#deferral-deletion)
+  - [Archiving May Never Mean Deleting](#archiving-may-never-mean-deleting)
 - [Close the Loop](#close-the-loop)
   - [Canonical Pipeline Operational Completeness — Accepted Intake Must Drain](#canonical-pipeline-operational-completeness-accepted-intake-must-drain) — *declared from Building*
   - [Keep the Doorway/Model Map Current](#keep-the-doorwaymodel-map-current) — *declared from Building*
@@ -126,7 +128,7 @@ Generated by `scripts/generate-standards-hierarchy.mjs` from the parent/child de
 - [Near-Silent Notifications](#near-silent-notifications)
   - [Bounded Notification Surface — no feature may flood the user](#bounded-notification-surface-no-feature-may-flood-the-user) — *declared from Building*
 
-*39 declared parent-child relation(s) across 23 parent article(s). The other 49 articles declare no parent.*
+*40 declared parent-child relation(s) across 24 parent article(s). The other 49 articles declare no parent.*
 
 <!-- END GENERATED STANDARDS HIERARCHY -->
 
@@ -217,10 +219,19 @@ The Root says *enforce behavior in structure, not willpower.* This family is **w
 **Fails.** If the durable capture path is absent, fail closed: do not ship or cross the instance boundary with the obligation or lesson uncaptured.
 **Judgment-bound.** Accepted 2026-08-12 by operator ruling as NOT mechanisable: this article turns on whether an insight is worth preserving; a silently omitted insight leaves no trace anywhere to check against. A gate over the DECLARATION would detect a well-formed claim and not a breach, and building one would let a paperwork check be called enforcement — the defect this classification exists to prevent. The obligation therefore shifts from "build a check" to **make the judgment good**, and it is an obligation, not an exemption: (a) **context sufficiency** — the call must be exercised with the context it needs, since a judgment made blind is the failure mode; (b) **rating** — the call is logged with its context in the decision journal and periodically rated: how it performed, how it can improve, what context it was missing. Judgment-bound is not unmeasured; the mechanical check is replaced by continuous evaluation, not by nothing.
 **In practice.** Deferral feels harmless to the deferring instance because *it* still remembers; the cost lands on a successor who never had the context and cannot reconstruct it.
-**Applied at the shipping layer.** This is the substrate-level *why* beneath the **No Deferrals** standard (Shipping): there, a deferral without a tracked same-PR commitment becomes a regression; here, the deeper reason is that across an instance boundary the deferred thing is simply gone.
+**Applied at the shipping layer.** This is the substrate-level *why* beneath the **No Deferrals** standard (Shipping): there, a deferral without a tracked same-PR commitment becomes a regression; here, the deeper reason is that across an instance boundary the deferred thing is simply gone. Tree node beneath it: *Archiving May Never Mean Deleting*, which carries this same conservation past the capture boundary — an insight that WAS captured is equally gone if the store holding it evicts it.
 **Earned from.** A PR deferred "lifeline auto-restart on server upgrade," and that exact gap produced a regression two days later (see *No Deferrals*).
 **Traces to the goal.** A self-evolving agent that defers its own learnings evolves nothing.
 
+### Archiving May Never Mean Deleting
+**Rule.** Where a store bounds its own growth it may COMPACT, COMPRESS, or SUMMARIZE, but it may not DELETE agent memory. Rotation-with-deletion is disqualifying for any store holding what the agent knows. Summaries may be added for speed; they NEVER replace the material they summarize — **except as the execution of a permitted deletion**, where replacing sensitive source material with a summary is one lawful way to carry out an operator instruction or an erasure obligation (added round 3: worded absolutely, this clause forbade privacy-preserving replacement even where retaining the source was unnecessary and disproportionate). Replacement is therefore a FORM of the permitted deletion, never a fourth path around it — **and the replacing summary must itself OMIT the material the deletion required removed** (round 4: without that condition, "replace the source with a summary" is a lawful-sounding way to keep the very content an erasure obligation destroyed, which is worse than refusing the replacement outright). The permitted deletions are DELIBERATE ACTS OF A PRINCIPAL, categorically distinct from a system quietly forgetting on its own: one the operator explicitly requests, and one a lawful erasure obligation requires (a data-subject erasure request, a controller instruction, a legal order) — the second is named because erasure authority does NOT originate only with the operator, and an article that recognised only the operator would force a choice between the constitution and the law. **Dual-purpose records — the precedence rule, stated because the continuity test alone begs the question for them (external adversarial lens, 2026-08-22).** A record can be both memory-bearing and operational (a judgment rationale is provenance AND something a successor needs). The rule is not "classify it once": a bounded operational store MAY hold such a record and MAY age its copy out, but it may never be the ONLY copy of the memory-bearing content — that content must also live in a store governed by this article. Where two readers would classify a record differently, that disagreement is resolved by DUPLICATION, not by adjudication. **Subject, stated in the Rule because it decides a live collision.** This governs AGENT MEMORY — conversation history, learnings, relationships, knowledge; the record a successor instance needs in order to BE the same agent. It does NOT govern telemetry, audit trails, metrics, or coordination breadcrumbs, which are bounded on purpose and whose bounding *Observable Intelligence* affirmatively requires. The distinguishing test is whether losing the record costs the agent its CONTINUITY, not whether the record is useful.
+**Tree placement.** **CHILD** — this is **a tree node under *Deferral = Deletion***, declared 2026-08-22 at ratification. That parent holds that an insight not captured NOW is gone, because the successor instance lacks the context that made it worth capturing. This article is the same conservation one step later in time: an insight that WAS captured is equally gone if the store holding it evicts it. Same loss, same reason — no successor can reconstruct it — different mechanism: omission versus eviction. A CHILD rather than a sibling because the parent states the conservation principle and this extends its reach past the capture boundary. It is deliberately NOT filed under *An Instar Agent Is Always a Multi-Machine Entity*: its subject holds on a single machine with no peers at all — a store that rotates history away violates it whether or not the agent is multi-machine — and filing it there would bind a general obligation to a condition it does not depend on.
+**Fails.** If a store cannot demonstrate that its growth-bounding path preserves rather than evicts, fail closed on ADOPTING that store for agent memory: the work may proceed on a store that can, but memory may not be entrusted to a mechanism that forgets. A PERMITTED deletion — operator-requested or lawful-erasure-required — is never this failure; it is the permitted case, and the wording says "permitted deletion" rather than "operator-requested" because an external lens caught the narrower phrasing quietly re-closing the carve-out the Rule had just widened (round 3). **Erasure must PROPAGATE, and this is the condition that makes the duplication rule safe.** When a permitted deletion runs, it must reach every copy the duplication rule created — the memory store, any bounded operational copy still holding it, derived summaries, and search indexes. A duplication requirement that did not carry a propagation requirement would let this article preserve exactly the content an erasure obligation required destroyed, which is the reverse of the compliance problem it claims to help with.
+**In practice.** **Distinct from *Observable Intelligence*.** That article's **Balanced by — Responsible Resource** clause requires audit trails to age out — bounded retention, never forever — and calls an unbounded observability store its own incoherence. Worded generally, "archiving may never delete" contradicts it head-on, and a reader could cite the registry for either position. The boundary is therefore part of this Rule rather than commentary beneath it: memory is conserved, telemetry is bounded, and the test between them is continuity rather than usefulness. Without that line stated in the Rule the two articles are each citable against the other, which is the both-sides-citable defect the registry's residual section exists to prevent. **Why this is affordable, measured rather than assumed.** The obvious objection is that "every machine holds everything" plus "nothing is ever deleted" is unbounded growth on every machine forever. Compression resolves it and the margin is not close. Measured on the originating machine 2026-08-21: 2,490 messages over 3 days, 3.0 MB raw, **0.4 MB gzipped — 7.5x, lossless.** At that rate a year of history is roughly 50 MB compressed and a decade under half a gigabyte. **The honest scope of that measurement (narrowed at ratification after an external lens called the extrapolation improper):** it covers MESSAGE TEXT on one machine over three working days. It does NOT cover attachments, search indexes, encryption overhead, the other memory kinds, or growth rates unlike those three days, and "affordable on any hardware" is therefore a claim about conversation text specifically, not a proof for all memory. What the number establishes is narrower than it first reads, and is stated at its real strength (round 3, external lens): for THIS sample — message text, this machine, three heavy working days — the size objection does not hold, by a margin large enough that a modest change in growth rate would not reverse it. It does NOT establish a bound for other growth rates, other memory kinds, or constrained hardware, and this article claims no unconditional bound. The obligation to keep memory does not rest on the measurement; the measurement only removes the reflex that the obligation is obviously unaffordable. **A claim that stood in the proposal was withdrawn before ratification and the withdrawal is recorded here rather than edited away:** the proposal argued the real cost was the container — that the coherence journal rotates-and-deletes and that its per-kind byte budgets were too small. Reading the rotation code shows both halves wrong: the byte figure is a rotation THRESHOLD with no total ceiling behind it, and a rotate-but-never-delete setting already ships on one kind today. A peer that falls past the tail window re-joins by snapshot-then-tail rather than losing anything. The container was never the obstacle. **Why the operator carve-out is load-bearing rather than decorative.** The stores that hold agent memory deliberately DO expire their transport logs, and the reason written into that code is erasure compliance: a never-deleting log would retain a person's details after they had asked to be erased. That is a genuine legal constraint and an unqualified "never delete" would collide with it. The carve-out is what lets both hold at once — the system never forgets on its own, and the principal may still ask for a deletion. So this article is compatible with the compliance requirement rather than in conflict with it — but it does not by itself DELIVER compliance, and the earlier draft claiming it did was over-claiming (round 3, external lens). Actual compliance depends on the propagation condition in **Fails.** above holding across every duplicate, summary, index and replica, which is engineering work this article requires and does not perform.
+**Documented-only until.** `2026-09-22` — tracked as `STD-COUNTDOWN-archiving-never-deletes`. No guard decides whether a store deletes agent memory, and none is claimed. This lands as a `/spec-converge` cross-machine and integration reviewer question — "does any store here delete agent memory, and is what it deletes memory or telemetry?" — which is semantic authority, weaker than a lint and stronger than prose. A deterministic version is conceivable (enumerate the stores holding memory kinds, assert each declares a non-evicting retention posture) and is not built. **Sub-obligation countdown.** `2026-09-22` — tracked as `STD-SUBCOUNTDOWN-archiving-never-deletes`. This is a COUNTDOWN, not a resting state: the article is ratified and binding from 2026-08-22, and the label records that its enforcement is owed rather than built.
+**Earned from.** 2026-08-21 (topic 52222), operator directive, ratified 2026-08-22: "archiving CANNOT mean deleting. We must be able to access message history at all costs." Raised while designing cross-machine conversation coherence, where the mechanism proposed for replicating history was one built to bound itself by eviction — the agent was about to entrust its memory to a container designed to forget, and the design passed six convergence rounds without anyone naming that.
+**Traces to the goal.** The founding promise is one coherent, persistent agent. The registry's own Root section already supplies the reason this line falls where it does: destroying an agent's accumulated record is "an injury to a self," not a data incident. *Deferral = Deletion* protects the record at the moment of capture; this protects it for the rest of its life. An agent whose memory is bounded by eviction is not persisting through time — it is a sliding window that believes it is a self.
+
 ### Close the Loop
 **Rule.** Every loop the agent opens — a promise to a user, a feature shipped dark, an LLM gate deployed, a flagged issue, a hypothesis to revisit — must be durably registered and re-surfaced on a cadence until it reaches a *deliberate* close. Capturing it once is not enough; if no structure brings it back for review, it rots silently and is, in effect, abandoned. *"Untracked = Abandoned."*
 **Tree placement.** **ROOT / FOUNDATIONAL** — this standard declares no parent, and that is a stated position rather than an omission. It now carries merged subsections beneath it, which is exactly when its own placement had to be settled rather than assumed. Declared 2026-08-13 under the insertion-placement rule: a standard that is edited must say where it sits, because editing it is when its place in the tree is actually in mind. If a genuine parent is later identified, this becomes a child declaration — a root position is a claim that can be revised, not a permanent exemption.
@@ -453,15 +464,15 @@ The Root says *enforce behavior in structure, not willpower.* This family is **w
 **Per-feature posture (2026-06-12 widening).** The lease layer alone does not make ONE agent — the 2026-06-12 audit (topic 13481) found ~20 features that were individually correct and collectively machine-blind: preferences, attention items, jobs, sentinel voices, and links all silently assumed a single machine, because no review surface ever asked. The rule, per feature: **every feature with durable state, user-facing notices, or generated URLs must declare its multi-machine posture — though this article **does NOT own the posture-declaration obligation**, which belongs to *An Instar Agent Is Always a Multi-Machine Entity*, where the permitted postures are enumerated. Read the requirement to be robust across machines here; read what a posture may SAY, and that one must be asserted, there — replicated (named path) / proxied-on-read (named read) / machine-local by design (with the reason) — at review time.** Enforced through the side-effects review template §7 (Multi-machine posture, `skills/instar-dev/templates/side-effects-artifact.md`) and the spec-converge integration reviewer's mandatory posture check (`skills/spec-converge/SKILL.md`); the gap-closure work itself is `docs/specs/MULTI-MACHINE-SEAMLESSNESS-SPEC.md`.
 
 ### An Instar Agent Is Always a Multi-Machine Entity
-**Rule.** Every feature, state surface, and design decision treats the agent as a SINGLE entity spread across many machines, BY DEFAULT. "Unified across my machines" is the default posture; "machine-local" is an EXCEPTION that must be justified with a concrete reason it *cannot* be unified (a login or credential that physically lives in one disk's keychain; a hardware-bound resource; an operator-ratified exception) — never a default chosen for expedience. A design that silently assumes one machine, or that declares "machine-local BY DESIGN" without naming that concrete reason, is a violation, not a valid posture.
+**Rule.** Every feature, state surface, and design decision treats the agent as a SINGLE entity spread across many machines, BY DEFAULT. "Unified across my machines" is the default posture; "machine-local" is an EXCEPTION that must be justified with a concrete reason it *cannot* be unified (a login or credential that physically lives in one disk's keychain; a hardware-bound resource; an operator-ratified exception) — never a default chosen for expedience. A design that silently assumes one machine, or that declares "machine-local BY DESIGN" without naming that concrete reason, is a violation, not a valid posture. **Single-machine survivability (ratified 2026-08-22, operator directive, topic 52222 — Amendment 1).** An agent must be able to operate AS IS on ANY SINGLE machine it is installed on. If every other machine becomes unavailable the agent loses RESOURCES — throughput, parallelism, hardware it does not have — but never INFORMATION. A design in which some information is reachable only by contacting another machine violates this, **however reliable that other machine is assumed to be**. **The subject, stated in the Rule because it decides a live collision (added at ratification, 2026-08-22).** The conservation is over what the agent KNOWS — its memory and the state a coherent reply depends on — not over per-machine OPERATIONAL records whose own articles bound them on purpose. *Decision Provenance & Outcome Review* deliberately keeps judgment-call context machine-local-full and retention-bounded, and *Observable Intelligence* requires audit trails to age out; without this boundary, survivability and those articles would each be citable against the other. The same test applies as in *Archiving May Never Mean Deleting*: losing it costs the agent its CONTINUITY, not merely a diagnostic. A machine-local operational log is therefore not a survivability violation; a machine-local piece of the agent's memory is. **And the posture this retires, named rather than left for a reader to notice (external adversarial lens, 2026-08-22).** `proxied-on-read` — a named remote read — is EXACTLY "information reachable only by contacting another machine", so for memory-bearing state it is no longer a valid destination posture: it survives only for OPERATIONAL state under the boundary above, and for memory it is at best a `migrating-to-unified` waypoint. Leaving that unsaid would have left the article enumerating a posture its own Rule forbids, citable both ways. This is strictly stronger than the reachability test the article applied before it: a fetch-on-demand design passes "can this be unified?" (every machine *can* reach the data) while failing this one, because reachability is conditional on a peer being up. That gap is not hypothetical — it is the one the conversation-history design fell into, surviving six convergence rounds before the operator caught it on read. **The rule is an OUTCOME, not a storage mandate (ratified 2026-08-22, same directive — Amendment 2).** It requires that any machine can act coherently on anything the agent knows; it does NOT prescribe that every byte sits on every disk. Full replication, sealed per-machine replication, and replicate-index-plus-encrypted-content all satisfy it; fetch-on-demand from a live peer does not. Mechanisms may improve without a constitutional edit; the outcome may not quietly weaken. A storage mandate written into a constitution freezes today's implementation into the document and makes adopting the next better mechanism an amendment.
 **Tree placement.** **ROOT / FOUNDATIONAL** — this standard declares no parent, and that is a stated position rather than an omission. It now carries merged subsections beneath it, which is exactly when its own placement had to be settled rather than assumed. Declared 2026-08-13 under the insertion-placement rule: a standard that is edited must say where it sits, because editing it is when its place in the tree is actually in mind. If a genuine parent is later identified, this becomes a child declaration — a root position is a claim that can be revised, not a permanent exemption.
 **Merged subsections.** 2 standard(s) were merged under this one on 2026-08-13 and remain LIVE and binding, each as a named subsection: **Cross-Machine Coherence** — It requires the one-agent cross-machine machinery itself to remain single-authority, internet-capable, deduplicated, and convergent under partitions and load; **Ownership-Gated Side Effects** — It requires every topic-scoped create, revive, rebind, terminate, or other side effect to prove current ownership at fire time and to fail loudly on unresolved ownership. They are named here rather than summarised into this article deliberately — the operator's condition is that the development process still encounters **every specific tripwire** each one carried, and a parent stated at this altitude cannot carry them. Removing any enforcement structure that made a subsection merge-able remains a **breach**; the merge never licenses it.
 **Fails.** If the cross-machine posture lint or semantic reviewer is unavailable, fail open and loud: ordinary work may proceed, but record and surface the missed posture review; a proposed state-fragmenting exception still fails closed.
 **Distinct from Cross-Machine Coherence.** Its sibling above governs the *robustness of the lease / seamlessness layer* under degraded conditions — the machinery that keeps N machines from becoming two agents. This one governs the *default posture of every new feature*: that machinery only makes the agent whole if features actually ride it. The per-feature posture check (2026-06-12 widening, above) already exists — but it verifies a feature *declares* a posture and accepts "machine-local BY DESIGN" as a valid declared answer, so a wrong posture (machine-local where unified was correct) passes the check by being *declared*. The gap this closes: the check tested for a declaration, not for the unified DEFAULT.
-**In practice.** This is **THE SINGLE GOVERNING ARTICLE for the cross-machine posture declaration** (declared 2026-08-08, fourth pass, after the review found both this article and *Cross-Machine Coherence* owning it: "both still own the declaration/review obligation"). It governs here because it STRENGTHENS the permitted answers — the enumerated postures below — while the other article owns the broader robustness rule that a posture serves. Every new state surface asserts its cross-machine posture — `unified` (rides the One Memory / stateSync machinery), `proxied-on-read` (a named remote read), or `machine-local + justification` (the reason jailed to a closed taxonomy: physical-credential-locality, hardware-bound-resource, or an operator-ratified exception). Absence defaults to `unified`-required. A bare "machine-local BY DESIGN" with no justification fails review — the default is *asserted*, never *assumed*.
+**In practice.** This is **THE SINGLE GOVERNING ARTICLE for the cross-machine posture declaration** (declared 2026-08-08, fourth pass, after the review found both this article and *Cross-Machine Coherence* owning it: "both still own the declaration/review obligation"). It governs here because it STRENGTHENS the permitted answers — the enumerated postures below — while the other article owns the broader robustness rule that a posture serves. Every new state surface asserts its cross-machine posture — `unified` (rides the One Memory / stateSync machinery), `proxied-on-read` (a named remote read — **OPERATIONAL state ONLY; invalid for memory-bearing state**, see the survivability clause in the Rule), or `machine-local + justification` (the reason jailed to the closed taxonomy stated above: physical-credential-locality [narrowed 2026-08-22], hardware-bound-resource, operator-ratified-exception, or migrating-to-unified [added 2026-08-22]). Absence defaults to `unified`-required. A bare "machine-local BY DESIGN" with no justification fails review — the default is *asserted*, never *assumed*. **THE CLOSED TAXONOMY, amended 2026-08-22 (operator directive, topic 52222 — Amendments 3 and 5).** A `machine-local` posture jails its reason to this closed set, and widening the set remains a constitution-bound operator decision, never an author's convenience. **`physical-credential-locality` — NARROWED (Amendment 3).** It covers only a credential whose relocation is PROHIBITED or technically impossible: a vendor's terms of service, a hardware-bound key, a legal residency constraint. It does NOT cover a credential that merely HAPPENS to be stored on one disk. Where a vault (Bitwarden and equivalents) can hold it, the locality is a storage choice and this key does not apply. A claim under this key must NAME its basis — the prohibiting authority (`prohibited-by`) or, where the barrier is technical rather than forbidding, what makes relocation impossible (`impossible-because`). Both are accepted, because "technically impossible" often has no authority to cite and demanding one was an inconsistent evidentiary bar (external adversarial lens, 2026-08-22). The claim must also declare whether the barrier is expected to be PERMANENT or TEMPORARY, and **a TEMPORARY declaration must record its exit** (`exit=<ref>`), **a re-review date** (`expires=YYYY-MM-DD`, at most 180 days out), **and the date it was first declared** (`since=YYYY-MM-DD`, with the same 360-day TOTAL-LIFETIME cap) — the full contract `migrating-to-unified` carries, for the same reason and closed in the same place (round 4: giving this key a deadline without a lifetime cap re-created, one key over, exactly the renew-every-180-days loophole round 3 had just closed for the other; a fix that reintroduces the defect it was patterned on is not a fix). At the cap the barrier is re-argued in front of the operator, who may of course rule it PERMANENT — which is the honest outcome for a barrier that has held for a year: a barrier declared temporary with no tracked way out is a permanent barrier wearing a temporary label, and one with an exit but no deadline is the same thing with paperwork (the deadline was added in round 3 after an external lens observed the exit ref alone let a TEMPORARY barrier outlive the horizon imposed on the newer key — a rule that binds a new key more tightly than an old one for no stated reason is an inconsistency, not a conservative default). The one genuine current instance is Anthropic's prohibition on relocating a Claude login between machines (why WS5.2 re-mints per machine rather than copying a token); under this amendment it still passes, and must be declared TEMPORARY with the planned exit recorded — API-key doorways once per-machine login becomes untenable at scale (operator, same directive). **`hardware-bound-resource`** — unchanged. **`operator-ratified-exception`** — unchanged; still requires a machine-verifiable, existence-checkable ref. **`migrating-to-unified` — NEW (Amendment 5).** Permitted ONLY when the marker also cites (a) the ratified decision establishing `unified` as the destination and (b) a resolvable tracking ref for the work that delivers it, AND carries an expiry date, and that date may be **at most 180 days out** — a bound added at ratification after an external adversarial lens showed the key was RENEWABLE rather than self-terminating (an author could set a distant expiry, deliver nothing, and never be asked again; the first draft's own test fixture used the year 2099 and passed). On expiry the surface either declares `unified` or the exception is re-argued in front of the operator; it may never lapse silently into a permanent posture. **And because a per-declaration horizon alone is merely RENEWABLE (round 3, external lens: "renewal forever remains possible; assigning that loophole to semantic review does not close it"), the marker also carries `since=YYYY-MM-DD` — the date the posture was FIRST declared for that surface — and the posture's TOTAL LIFETIME (`expires` − `since`) may not exceed 360 days.** A renewal must carry the original `since` forward, so re-dating the expiry no longer buys unbounded time: the second renewal is the last one the parser will accept. **What remains open, stated rather than claimed closed:** a `since` that is simply rewritten is FALSIFICATION, not a loophole in the letter — the parser cannot detect it, and nothing here pretends otherwise. The difference matters: an author must now lie to keep the posture, where before they only had to pick a distant date. **Why a fourth key was ratified despite the hatch being deliberately narrow.** Amendment 1 GUARANTEES arrivals at this wall: making survivability the test converts a population of currently-passing `machine-local` surfaces into surfaces whose correct posture is `unified` and whose mechanism is unbuilt. With only three keys the honest posture is unavailable — the conversation-history spec keyed nine surfaces `operator-ratified-exception (PENDING)` for a ratification the operator then DENIED, leaving markers citing a refused approval. Adopting 1 without 5 therefore MANUFACTURES the false-claim class the taxonomy exists to reduce. This key is the only one of the four whose use is self-terminating — it requires a date and a tracked delivery, so it cannot become a resting place — and unlike Amendments 1, 2 and 4 its contract is deterministically CHECKABLE on arrival, because its citation requirements reduce to the same existence-check the marker lint already performs. **The honest scope of that check:** the parser verifies the marker's SHAPE — that an authority is named, that refs are ref-shaped, that a date is present and unexpired and inside the maximum horizon. It cannot verify that the named authority actually prohibits the relocation, that the tracked work will deliver unification, or that an expiry triggers real re-argument. Those remain the `/spec-converge` reviewer's semantic authority, exactly as before; "checkable" here never means "proven true".
 **Earned from.** 2026-07-03 (topic 29723), operator-ratified: the tiered-intelligence-delegation spec defaulted its consult memory to machine-local, conflicting with the single-unified-agent goal — and it survived SEVEN convergence rounds before the operator caught it on read. That it took the operator's read, not the review machinery, is the tell: the always-multi-machine expectation lived in prose and reviewer habit, not in structure. Justin named the meta-point — "the fact that I had to point out the misalignment means we have a gap in our standards or how we enforce them; it should be fundamental in our constitution that an Instar agent is always supported as a multi-machine entity."
 **Traces to the goal.** The founding promise is one coherent, persistent agent. An agent whose memory, budgets, or state fragment per-machine is not one agent — it is N confused copies of it. *Structure beats Willpower*: don't rely on the agent or a reviewer *remembering* that the agent is multi-machine; make the unified default the path of least resistance and machine-local the posture that must argue for itself.
-**Applied through.** The deterministic marker floor `scripts/lint-machine-local-justification.js` — a no-LLM static parser that grades the PRESENCE + well-formedness of the `machine-local-justification: <taxonomy-key>` marker a spec must carry per machine-local surface: an undefended machine-local posture fails, and — bidirectionally — a spurious/out-of-taxonomy marker or an `operator-ratified-exception` citing no machine-verifiable ref fails too (self-tested with positive, undefended, and spurious-marker fixtures). This is the cheap deterministic SIGNAL; the `/spec-converge` integration reviewer holds the semantic AUTHORITY (is the justification actually TRUE?) the parser cannot make. The lint ships REPORT-FIRST (a non-blocking signal; `--strict` is the FAIL capability) per the honesty / hard-sequencing clause of `docs/specs/three-standards-enforcement.md` (§197-202, §563-573) and the dark-first Maturation convention. The `/spec-converge` cross-machine check is also STRENGTHENED to REJECT "machine-local" unless the spec carries an explicit `machine-local-justification` (a bare "machine-local BY DESIGN" fails); the side-effects review §7 posture field gains the same justification requirement; and existing features are swept for undefended machine-local surfaces (folds into the feature-maturation audit, topic 30668). This registry entry + its **P21** twin in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` fire the `/spec-converge` lessons-aware reviewer on every future spec.
+**Applied through.** The deterministic marker floor `scripts/lint-machine-local-justification.js` — a no-LLM static parser that grades the PRESENCE + well-formedness of the `machine-local-justification: <taxonomy-key>` marker a spec must carry per machine-local surface: an undefended machine-local posture fails, and — bidirectionally — a spurious/out-of-taxonomy marker or an `operator-ratified-exception` citing no machine-verifiable ref fails too (self-tested with positive, undefended, and spurious-marker fixtures). This is the cheap deterministic SIGNAL; the `/spec-converge` integration reviewer holds the semantic AUTHORITY (is the justification actually TRUE?) the parser cannot make. The lint ships REPORT-FIRST (a non-blocking signal; `--strict` is the FAIL capability) per the honesty / hard-sequencing clause of `docs/specs/three-standards-enforcement.md` (§197-202, §563-573) and the dark-first Maturation convention. The `/spec-converge` cross-machine check is also STRENGTHENED to REJECT "machine-local" unless the spec carries an explicit `machine-local-justification` (a bare "machine-local BY DESIGN" fails); the side-effects review §7 posture field gains the same justification requirement; and existing features are swept for undefended machine-local surfaces (folds into the feature-maturation audit, topic 30668). This registry entry + its **P21** twin in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` fire the `/spec-converge` lessons-aware reviewer on every future spec. **UNENFORCED SUB-OBLIGATION, named (2026-08-22).** Amendments 1 and 2 have NO deterministic guard and are not claimed to have one: no parser can decide whether a design survives the loss of every peer, nor whether a stated outcome is genuinely met. They land as `/spec-converge` cross-machine reviewer questions — "does this survive every peer disappearing?" — which is semantic authority, weaker than a lint and stronger than prose. Amendments 3 and 5 carry deterministically CHECKABLE MARKER CONTRACTS, enforced in `scripts/lint-machine-local-justification.js`. What is enforced is the marker's SHAPE — a basis is named, refs are ref-shaped, dates are present, unexpired, and inside their caps. The SEMANTIC facts those markers assert — that the named authority really prohibits relocation, that the impossibility is real, that the tracked work delivers unification — are NOT checked by anything deterministic and remain the reviewer's (re-narrowed 2026-08-22 round 3, after an external lens read the flat word "enforced" as covering the semantics). Naming this asymmetry rather than citing a guard for the unguarded clauses is deliberate: *Cross-Store Coherence* records that naming a guard in prose made an article classify as ENFORCED by a guard measuring something else, and reproducing that inside the article being amended to be more honest would be the worst available outcome. **Sub-obligation countdown.** `2026-09-22` — tracked as `STD-SUBCOUNTDOWN-multi-machine-survivability`.
 
 ### Cross-Store Coherence Is an Invariant
 **Rule.** Any two stores that answer the same question — about identity, authority, machine liveness, or configuration — must have a **declared agreement invariant**, and that invariant must be **checked on a cadence by machinery**. A pair of authoritative stores with no coherence check is a contradiction waiting for a code path to read the wrong one. When a NEW store is introduced that answers a question an existing store already answers, declaring the invariant is part of introducing it.

package/dist/data/standards-registry.meta.json

@@ -1,6 +1,6 @@
 {
-  "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "articleCount": 88,
+  "sha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "articleCount": 89,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1190"
+  "packageVersion": "1.3.1191"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1190",
+  "version": "1.3.1191",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-machine-local-justification.js

@@ -70,6 +70,11 @@ export const TAXONOMY_KEYS = new Set([
   'physical-credential-locality',
   'hardware-bound-resource',
   'operator-ratified-exception',
+  // Ratified 2026-08-22 (operator directive, topic 52222 — Amendment 5). The
+  // ONLY self-terminating key: it carries a first-declared date, a bounded
+  // re-review horizon, and a total-lifetime cap, so it cannot become a resting
+  // place. See the A2-migrating-* contracts below.
+  'migrating-to-unified',
 ]);
 
 // ── Finding the posture section (widened 2026-08-21) ──────────────────────
@@ -188,11 +193,269 @@ export function hasResolvableRef(rest) {
   return REF_SHA_RE.test(rest) || REF_URL_RE.test(rest) || REF_REGISTRY_KEY_RE.test(rest);
 }
 
+/**
+ * Parse `name=value` / `name: value` sub-fields out of a marker's `rest`.
+ *
+ * Amendments 3 and 5 (ratified 2026-08-22) require a marker to carry NAMED
+ * facts rather than free prose — that is what makes them deterministically
+ * checkable rather than a reviewer's judgement. A value runs to the next known
+ * field name or to end-of-line, and may be quoted.
+ *
+ * Returns a lowercase-keyed object; a repeated field keeps the FIRST value, so
+ * appending a second `permanence=` cannot quietly override the first.
+ */
+export const MARKER_FIELDS = ['prohibited-by', 'impossible-because', 'permanence', 'exit', 'ratified', 'tracking', 'since', 'expires'];
+export function parseMarkerFields(rest) {
+  const out = {};
+  if (!rest) return out;
+  const names = MARKER_FIELDS.map((n) => n.replace(/[-]/g, '\\-')).join('|');
+  const re = new RegExp(
+    `\\b(${names})\\s*[=:]\\s*(?:"([^"]*)"|'([^']*)'|([^\\s].*?))(?=\\s+(?:${names})\\s*[=:]|\\s*$)`,
+    'gi',
+  );
+  let m;
+  while ((m = re.exec(rest)) !== null) {
+    const key = m[1].toLowerCase();
+    const val = (m[2] ?? m[3] ?? m[4] ?? '').trim();
+    if (!(key in out)) out[key] = val;
+  }
+  return out;
+}
+
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+// Amendment 5's maximum horizon. Without it the key is RENEWABLE, not
+// self-terminating: an author sets a distant expiry, delivers nothing, and is
+// never asked again. The first draft's own fixture used the year 2099 and
+// passed, which is how the gap was found (external adversarial lens, 2026-08-22).
+export const MIGRATION_MAX_HORIZON_DAYS = 180;
+
+// Round 3. The horizon alone bounds ONE declaration; renewing it re-dates the
+// expiry and buys unbounded time. `since` (first declaration) plus a TOTAL
+// LIFETIME cap is what makes the key actually terminate. A rewritten `since` is
+// falsification, not a loophole — the parser cannot see it, and the article says so.
+export const MIGRATION_MAX_TOTAL_LIFETIME_DAYS = 360;
+
+/** Shared: an ISO date field that must be present, well-formed, and within `maxDays` of today. */
+function gradeHorizonDate(value, { rule, label, maxDays, today, missingMessage }) {
+  const findings = [];
+  if (!ISO_DATE_RE.test(value || '') || Number.isNaN(Date.parse(value))) {
+    findings.push({ rule: `${rule}-missing`, message: missingMessage });
+    return { findings, dueMs: null };
+  }
+  const dueMs = Date.parse(`${value}T23:59:59Z`);
+  if (dueMs > today.getTime() + maxDays * 24 * 60 * 60 * 1000) {
+    findings.push({
+      rule: `${rule}-beyond-horizon`,
+      message:
+        `${label} ${value} is more than ${maxDays} days out. A distant date makes the ` +
+        `posture renewable rather than self-terminating — it must come back in front of ` +
+        `a reader on a bounded cadence.`,
+    });
+  } else if (dueMs < today.getTime()) {
+    findings.push({ rule: `${rule}-expired`, message: `${label} ${value} has PASSED. The posture must be re-argued or resolved; it may never lapse silently into a permanent one.` });
+  }
+  return { findings, dueMs };
+}
+
+/**
+ * Amendment 3 — `physical-credential-locality` must NAME the prohibiting
+ * authority and declare the prohibition PERMANENT or TEMPORARY. Returns a
+ * findings array (empty when well-formed).
+ *
+ * Why named fields rather than prose: the key as previously written let an
+ * author assert a physical constraint where a storage habit existed, and no
+ * parser could tell the two apart. "Bitwarden could hold this" is the test, and
+ * a marker that cannot even name who forbids the move has not met it.
+ */
+export function gradePhysicalCredentialLocality(rest, today = new Date()) {
+  const findings = [];
+  const f = parseMarkerFields(rest);
+  // The basis may be a PROHIBITION or an IMPOSSIBILITY. Demanding a
+  // `prohibited-by` for a purely technical barrier was an inconsistent
+  // evidentiary bar — a hardware-bound key has no authority to cite (external
+  // adversarial lens, 2026-08-22).
+  if (!f['prohibited-by'] && !f['impossible-because']) {
+    findings.push({
+      rule: 'A2-credential-locality-no-authority',
+      message:
+        `physical-credential-locality must NAME its basis — either ` +
+        `\`prohibited-by="<vendor ToS | legal residency constraint>"\` or ` +
+        `\`impossible-because="<what makes relocation technically impossible>"\` ` +
+        `(Amendment 3, ratified 2026-08-22). This key covers only a credential whose ` +
+        `relocation is PROHIBITED or technically impossible; a credential that merely ` +
+        `HAPPENS to sit on one disk is a storage choice, and where a vault can hold it ` +
+        `this key does not apply. Marker value: "${rest || '(empty)'}".`,
+    });
+  }
+  const perm = (f.permanence || '').toLowerCase();
+  // A TEMPORARY barrier with no tracked way out is a permanent barrier wearing a
+  // temporary label — the defect `migrating-to-unified` carries a horizon against,
+  // and it applied here identically (external adversarial lens, 2026-08-22).
+  if (perm === 'temporary') {
+    if (!hasResolvableRef(f.exit || '')) {
+      findings.push({
+        rule: 'A2-credential-locality-temporary-no-exit',
+        message:
+          `physical-credential-locality declared \`permanence=temporary\` must record its ` +
+          `exit — \`exit=<commit SHA | URL | dotted registry key>\` naming the work or ` +
+          `decision that ends the barrier (Amendment 3, ratified 2026-08-22). Marker value: ` +
+          `"${rest || '(empty)'}".`,
+      });
+    }
+    // An exit with no deadline is a permanent barrier with paperwork. Same horizon
+    // the newer key carries — binding a new key more tightly than an old one for no
+    // stated reason is an inconsistency, not a conservative default (round 3).
+    // Round 4: a deadline WITHOUT a lifetime cap is renewable every 180 days
+    // forever — the exact loophole round 3 closed one key over. Same contract here.
+    const tsince = f.since || '';
+    if (!ISO_DATE_RE.test(tsince) || Number.isNaN(Date.parse(tsince))) {
+      findings.push({
+        rule: 'A2-credential-locality-temporary-no-since',
+        message:
+          `physical-credential-locality declared \`permanence=temporary\` must carry ` +
+          `\`since=YYYY-MM-DD\` — the date the barrier was FIRST declared, carried forward ` +
+          `across renewals (Amendment 3, round 4). Without it the re-review date is ` +
+          `renewable forever. Marker value: "${rest || '(empty)'}".`,
+      });
+    } else if (ISO_DATE_RE.test(f.expires || '') && !Number.isNaN(Date.parse(f.expires))) {
+      const lifetimeDays = (Date.parse(f.expires) - Date.parse(tsince)) / (24 * 60 * 60 * 1000);
+      if (lifetimeDays > MIGRATION_MAX_TOTAL_LIFETIME_DAYS) {
+        findings.push({
+          rule: 'A2-credential-locality-temporary-lifetime-exceeded',
+          message:
+            `physical-credential-locality has been declared TEMPORARY for a TOTAL of ` +
+            `${Math.round(lifetimeDays)} days (since ${tsince} → expires ${f.expires}), over ` +
+            `the ${MIGRATION_MAX_TOTAL_LIFETIME_DAYS}-day lifetime cap. Re-argue it in front ` +
+            `of the operator, who may rule it PERMANENT — the honest outcome for a barrier ` +
+            `that has held for a year.`,
+        });
+      }
+    }
+    for (const finding of gradeHorizonDate(f.expires, {
+      rule: 'A2-credential-locality-temporary-review',
+      label: 'physical-credential-locality TEMPORARY re-review date',
+      maxDays: MIGRATION_MAX_HORIZON_DAYS,
+      today,
+      missingMessage:
+        `physical-credential-locality declared \`permanence=temporary\` must carry a ` +
+        `re-review date — \`expires=YYYY-MM-DD\`, at most ${MIGRATION_MAX_HORIZON_DAYS} ` +
+        `days out (Amendment 3, round 3). Marker value: "${rest || '(empty)'}".`,
+    }).findings) findings.push(finding);
+  }
+  if (perm !== 'permanent' && perm !== 'temporary') {
+    findings.push({
+      rule: 'A2-credential-locality-no-permanence',
+      message:
+        `physical-credential-locality must declare \`permanence=permanent\` or ` +
+        `\`permanence=temporary\` (Amendment 3, ratified 2026-08-22). A temporary ` +
+        `prohibition is a posture with an exit; a permanent one is a standing constraint, ` +
+        `and conflating them hides which is which. Marker value: "${rest || '(empty)'}".`,
+    });
+  }
+  return findings;
+}
+
+/**
+ * Amendment 5 — `migrating-to-unified` is permitted ONLY with (a) the ratified
+ * decision establishing unified as the destination, (b) a resolvable tracking
+ * ref for the work that delivers it, and (c) an expiry date. On expiry the
+ * surface declares `unified` or the exception is re-argued in front of the
+ * operator; it may never lapse silently into a permanent posture — so an
+ * EXPIRED marker is itself a finding, not a grace period.
+ *
+ * `today` is injectable so the expiry arm is testable without freezing a clock.
+ */
+export function gradeMigratingToUnified(rest, today = new Date()) {
+  const findings = [];
+  const f = parseMarkerFields(rest);
+  if (!hasResolvableRef(f.ratified || '')) {
+    findings.push({
+      rule: 'A2-migrating-no-ratified-decision',
+      message:
+        `migrating-to-unified must cite the ratified decision establishing \`unified\` as the ` +
+        `destination — \`ratified=<commit SHA | URL | dotted registry key>\` (Amendment 5, ` +
+        `ratified 2026-08-22). Without it the key asserts a destination nobody approved, which ` +
+        `is the false-claim class it exists to prevent. Marker value: "${rest || '(empty)'}".`,
+    });
+  }
+  if (!hasResolvableRef(f.tracking || '')) {
+    findings.push({
+      rule: 'A2-migrating-no-tracking-ref',
+      message:
+        `migrating-to-unified must cite a resolvable tracking ref for the work that DELIVERS ` +
+        `unified — \`tracking=<commit SHA | URL | dotted registry key>\` (Amendment 5). A ` +
+        `migration with no tracked delivery is a permanent posture wearing a temporary label. ` +
+        `Marker value: "${rest || '(empty)'}".`,
+    });
+  }
+  // Round 3: the total lifetime, not just this declaration's horizon.
+  const since = f.since || '';
+  if (!ISO_DATE_RE.test(since) || Number.isNaN(Date.parse(since))) {
+    findings.push({
+      rule: 'A2-migrating-no-since',
+      message:
+        `migrating-to-unified must carry \`since=YYYY-MM-DD\` — the date the posture was ` +
+        `FIRST declared for this surface, carried forward unchanged across renewals ` +
+        `(Amendment 5, round 3). Without it the horizon bounds one declaration and a ` +
+        `renewal buys unbounded time. Marker value: "${rest || '(empty)'}".`,
+    });
+  }
+  const expires = f.expires || '';
+  if (ISO_DATE_RE.test(since) && ISO_DATE_RE.test(expires) &&
+      !Number.isNaN(Date.parse(since)) && !Number.isNaN(Date.parse(expires))) {
+    const lifetimeDays = (Date.parse(expires) - Date.parse(since)) / (24 * 60 * 60 * 1000);
+    if (lifetimeDays > MIGRATION_MAX_TOTAL_LIFETIME_DAYS) {
+      findings.push({
+        rule: 'A2-migrating-lifetime-exceeded',
+        message:
+          `migrating-to-unified has been in force for a TOTAL of ${Math.round(lifetimeDays)} ` +
+          `days (since ${since} → expires ${expires}), over the ` +
+          `${MIGRATION_MAX_TOTAL_LIFETIME_DAYS}-day lifetime cap. The surface must declare ` +
+          `\`unified\` or the exception must be re-argued in front of the operator — a ` +
+          `renewal may not carry it further.`,
+      });
+    }
+  }
+  if (!ISO_DATE_RE.test(expires) || Number.isNaN(Date.parse(expires))) {
+    findings.push({
+      rule: 'A2-migrating-no-expiry',
+      message:
+        `migrating-to-unified must carry \`expires=YYYY-MM-DD\` (Amendment 5). The expiry is ` +
+        `what makes this key self-terminating and is the entire reason a fourth key was ` +
+        `ratified into a deliberately narrow taxonomy. Marker value: "${rest || '(empty)'}".`,
+    });
+  } else {
+    const due = Date.parse(`${expires}T23:59:59Z`);
+    const horizonMs = MIGRATION_MAX_HORIZON_DAYS * 24 * 60 * 60 * 1000;
+    if (due > today.getTime() + horizonMs) {
+      findings.push({
+        rule: 'A2-migrating-expiry-beyond-horizon',
+        message:
+          `migrating-to-unified expiry ${expires} is more than ` +
+          `${MIGRATION_MAX_HORIZON_DAYS} days out (Amendment 5's maximum horizon). A ` +
+          `distant expiry makes the key renewable rather than self-terminating — the ` +
+          `posture must come back in front of a reader on a bounded cadence.`,
+      });
+    }
+    if (due < today.getTime()) {
+      findings.push({
+        rule: 'A2-migrating-expired',
+        message:
+          `migrating-to-unified EXPIRED on ${expires}. The surface must now declare \`unified\` ` +
+          `or the exception must be re-argued in front of the operator; it may never lapse ` +
+          `silently into a permanent posture (Amendment 5).`,
+      });
+    }
+  }
+  return findings;
+}
+
 /**
  * Grade one spec's text against Standard A's marker contract. Pure — no I/O.
  * Returns { findings: [{ rule, message }] }.
  */
-export function gradeMachineLocalMarkers(text) {
+export function gradeMachineLocalMarkers(text, today = new Date()) {
   const findings = [];
   const markers = parseMarkers(text);
   const posture = findPostureSection(text);
@@ -209,6 +472,12 @@ export function gradeMachineLocalMarkers(text) {
       });
       continue;
     }
+    if (marker.key === 'physical-credential-locality') {
+      for (const f of gradePhysicalCredentialLocality(marker.rest, today)) findings.push(f);
+    }
+    if (marker.key === 'migrating-to-unified') {
+      for (const f of gradeMigratingToUnified(marker.rest, today)) findings.push(f);
+    }
     if (marker.key === 'operator-ratified-exception' && !hasResolvableRef(marker.rest)) {
       findings.push({
         rule: 'A2-unresolvable-ratification-ref',
@@ -236,13 +505,22 @@ export function gradeMachineLocalMarkers(text) {
   if (posture) {
     const sectionText = text.slice(posture.start, posture.end);
     const assertsMachineLocal = /machine-local/i.test(sectionText);
-    const hasValidMarker = markers.some(
-      (mk) =>
-        TAXONOMY_KEYS.has(mk.key) &&
-        mk.index >= posture.start &&
-        mk.index < posture.end &&
-        (mk.key !== 'operator-ratified-exception' || hasResolvableRef(mk.rest)),
-    );
+    // A marker DEFENDS a machine-local posture only when it is well-formed FOR ITS
+    // KEY. Amendments 3 and 5 added per-key contracts, so a marker carrying the
+    // right key and nothing else must not count as a defence — otherwise the new
+    // requirements would be reportable while the posture they govern still passed.
+    const hasValidMarker = markers.some((mk) => {
+      if (!TAXONOMY_KEYS.has(mk.key)) return false;
+      if (mk.index < posture.start || mk.index >= posture.end) return false;
+      if (mk.key === 'operator-ratified-exception') return hasResolvableRef(mk.rest);
+      if (mk.key === 'physical-credential-locality') {
+        return gradePhysicalCredentialLocality(mk.rest, today).length === 0;
+      }
+      if (mk.key === 'migrating-to-unified') {
+        return gradeMigratingToUnified(mk.rest, today).length === 0;
+      }
+      return true;
+    });
     if (assertsMachineLocal && !hasValidMarker) {
       findings.push({
         rule: 'A1-undefended-machine-local',

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-23T02:53:10.208Z",
-  "instarVersion": "1.3.1190",
+  "generatedAt": "2026-08-23T05:06:59.126Z",
+  "instarVersion": "1.3.1191",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
-  "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1190",
+  "registrySha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "packageVersion": "1.3.1191",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "e2275b904b85c7db59a699f899b730f164b89ca204813d9766d5b1c5233a92ba",
-  "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1190"
+  "sha256": "f3973d47f7199ab0b06aa43bcb13b8034f61a88607b4da1ebf5aa436445670cc",
+  "registrySha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "packageVersion": "1.3.1191"
 }

package/src/data/standards-registry.md

@@ -56,6 +56,8 @@ Generated by `scripts/generate-standards-hierarchy.mjs` from the parent/child de
 
 - [The Body and the Mind](#the-body-and-the-mind)
   - [Structure Decides Alone Only on an Exact Match](#structure-decides-alone-only-on-an-exact-match)
+- [Deferral = Deletion](#deferral-deletion)
+  - [Archiving May Never Mean Deleting](#archiving-may-never-mean-deleting)
 - [Close the Loop](#close-the-loop)
   - [Canonical Pipeline Operational Completeness — Accepted Intake Must Drain](#canonical-pipeline-operational-completeness-accepted-intake-must-drain) — *declared from Building*
   - [Keep the Doorway/Model Map Current](#keep-the-doorwaymodel-map-current) — *declared from Building*
@@ -126,7 +128,7 @@ Generated by `scripts/generate-standards-hierarchy.mjs` from the parent/child de
 - [Near-Silent Notifications](#near-silent-notifications)
   - [Bounded Notification Surface — no feature may flood the user](#bounded-notification-surface-no-feature-may-flood-the-user) — *declared from Building*
 
-*39 declared parent-child relation(s) across 23 parent article(s). The other 49 articles declare no parent.*
+*40 declared parent-child relation(s) across 24 parent article(s). The other 49 articles declare no parent.*
 
 <!-- END GENERATED STANDARDS HIERARCHY -->
 
@@ -217,10 +219,19 @@ The Root says *enforce behavior in structure, not willpower.* This family is **w
 **Fails.** If the durable capture path is absent, fail closed: do not ship or cross the instance boundary with the obligation or lesson uncaptured.
 **Judgment-bound.** Accepted 2026-08-12 by operator ruling as NOT mechanisable: this article turns on whether an insight is worth preserving; a silently omitted insight leaves no trace anywhere to check against. A gate over the DECLARATION would detect a well-formed claim and not a breach, and building one would let a paperwork check be called enforcement — the defect this classification exists to prevent. The obligation therefore shifts from "build a check" to **make the judgment good**, and it is an obligation, not an exemption: (a) **context sufficiency** — the call must be exercised with the context it needs, since a judgment made blind is the failure mode; (b) **rating** — the call is logged with its context in the decision journal and periodically rated: how it performed, how it can improve, what context it was missing. Judgment-bound is not unmeasured; the mechanical check is replaced by continuous evaluation, not by nothing.
 **In practice.** Deferral feels harmless to the deferring instance because *it* still remembers; the cost lands on a successor who never had the context and cannot reconstruct it.
-**Applied at the shipping layer.** This is the substrate-level *why* beneath the **No Deferrals** standard (Shipping): there, a deferral without a tracked same-PR commitment becomes a regression; here, the deeper reason is that across an instance boundary the deferred thing is simply gone.
+**Applied at the shipping layer.** This is the substrate-level *why* beneath the **No Deferrals** standard (Shipping): there, a deferral without a tracked same-PR commitment becomes a regression; here, the deeper reason is that across an instance boundary the deferred thing is simply gone. Tree node beneath it: *Archiving May Never Mean Deleting*, which carries this same conservation past the capture boundary — an insight that WAS captured is equally gone if the store holding it evicts it.
 **Earned from.** A PR deferred "lifeline auto-restart on server upgrade," and that exact gap produced a regression two days later (see *No Deferrals*).
 **Traces to the goal.** A self-evolving agent that defers its own learnings evolves nothing.
 
+### Archiving May Never Mean Deleting
+**Rule.** Where a store bounds its own growth it may COMPACT, COMPRESS, or SUMMARIZE, but it may not DELETE agent memory. Rotation-with-deletion is disqualifying for any store holding what the agent knows. Summaries may be added for speed; they NEVER replace the material they summarize — **except as the execution of a permitted deletion**, where replacing sensitive source material with a summary is one lawful way to carry out an operator instruction or an erasure obligation (added round 3: worded absolutely, this clause forbade privacy-preserving replacement even where retaining the source was unnecessary and disproportionate). Replacement is therefore a FORM of the permitted deletion, never a fourth path around it — **and the replacing summary must itself OMIT the material the deletion required removed** (round 4: without that condition, "replace the source with a summary" is a lawful-sounding way to keep the very content an erasure obligation destroyed, which is worse than refusing the replacement outright). The permitted deletions are DELIBERATE ACTS OF A PRINCIPAL, categorically distinct from a system quietly forgetting on its own: one the operator explicitly requests, and one a lawful erasure obligation requires (a data-subject erasure request, a controller instruction, a legal order) — the second is named because erasure authority does NOT originate only with the operator, and an article that recognised only the operator would force a choice between the constitution and the law. **Dual-purpose records — the precedence rule, stated because the continuity test alone begs the question for them (external adversarial lens, 2026-08-22).** A record can be both memory-bearing and operational (a judgment rationale is provenance AND something a successor needs). The rule is not "classify it once": a bounded operational store MAY hold such a record and MAY age its copy out, but it may never be the ONLY copy of the memory-bearing content — that content must also live in a store governed by this article. Where two readers would classify a record differently, that disagreement is resolved by DUPLICATION, not by adjudication. **Subject, stated in the Rule because it decides a live collision.** This governs AGENT MEMORY — conversation history, learnings, relationships, knowledge; the record a successor instance needs in order to BE the same agent. It does NOT govern telemetry, audit trails, metrics, or coordination breadcrumbs, which are bounded on purpose and whose bounding *Observable Intelligence* affirmatively requires. The distinguishing test is whether losing the record costs the agent its CONTINUITY, not whether the record is useful.
+**Tree placement.** **CHILD** — this is **a tree node under *Deferral = Deletion***, declared 2026-08-22 at ratification. That parent holds that an insight not captured NOW is gone, because the successor instance lacks the context that made it worth capturing. This article is the same conservation one step later in time: an insight that WAS captured is equally gone if the store holding it evicts it. Same loss, same reason — no successor can reconstruct it — different mechanism: omission versus eviction. A CHILD rather than a sibling because the parent states the conservation principle and this extends its reach past the capture boundary. It is deliberately NOT filed under *An Instar Agent Is Always a Multi-Machine Entity*: its subject holds on a single machine with no peers at all — a store that rotates history away violates it whether or not the agent is multi-machine — and filing it there would bind a general obligation to a condition it does not depend on.
+**Fails.** If a store cannot demonstrate that its growth-bounding path preserves rather than evicts, fail closed on ADOPTING that store for agent memory: the work may proceed on a store that can, but memory may not be entrusted to a mechanism that forgets. A PERMITTED deletion — operator-requested or lawful-erasure-required — is never this failure; it is the permitted case, and the wording says "permitted deletion" rather than "operator-requested" because an external lens caught the narrower phrasing quietly re-closing the carve-out the Rule had just widened (round 3). **Erasure must PROPAGATE, and this is the condition that makes the duplication rule safe.** When a permitted deletion runs, it must reach every copy the duplication rule created — the memory store, any bounded operational copy still holding it, derived summaries, and search indexes. A duplication requirement that did not carry a propagation requirement would let this article preserve exactly the content an erasure obligation required destroyed, which is the reverse of the compliance problem it claims to help with.
+**In practice.** **Distinct from *Observable Intelligence*.** That article's **Balanced by — Responsible Resource** clause requires audit trails to age out — bounded retention, never forever — and calls an unbounded observability store its own incoherence. Worded generally, "archiving may never delete" contradicts it head-on, and a reader could cite the registry for either position. The boundary is therefore part of this Rule rather than commentary beneath it: memory is conserved, telemetry is bounded, and the test between them is continuity rather than usefulness. Without that line stated in the Rule the two articles are each citable against the other, which is the both-sides-citable defect the registry's residual section exists to prevent. **Why this is affordable, measured rather than assumed.** The obvious objection is that "every machine holds everything" plus "nothing is ever deleted" is unbounded growth on every machine forever. Compression resolves it and the margin is not close. Measured on the originating machine 2026-08-21: 2,490 messages over 3 days, 3.0 MB raw, **0.4 MB gzipped — 7.5x, lossless.** At that rate a year of history is roughly 50 MB compressed and a decade under half a gigabyte. **The honest scope of that measurement (narrowed at ratification after an external lens called the extrapolation improper):** it covers MESSAGE TEXT on one machine over three working days. It does NOT cover attachments, search indexes, encryption overhead, the other memory kinds, or growth rates unlike those three days, and "affordable on any hardware" is therefore a claim about conversation text specifically, not a proof for all memory. What the number establishes is narrower than it first reads, and is stated at its real strength (round 3, external lens): for THIS sample — message text, this machine, three heavy working days — the size objection does not hold, by a margin large enough that a modest change in growth rate would not reverse it. It does NOT establish a bound for other growth rates, other memory kinds, or constrained hardware, and this article claims no unconditional bound. The obligation to keep memory does not rest on the measurement; the measurement only removes the reflex that the obligation is obviously unaffordable. **A claim that stood in the proposal was withdrawn before ratification and the withdrawal is recorded here rather than edited away:** the proposal argued the real cost was the container — that the coherence journal rotates-and-deletes and that its per-kind byte budgets were too small. Reading the rotation code shows both halves wrong: the byte figure is a rotation THRESHOLD with no total ceiling behind it, and a rotate-but-never-delete setting already ships on one kind today. A peer that falls past the tail window re-joins by snapshot-then-tail rather than losing anything. The container was never the obstacle. **Why the operator carve-out is load-bearing rather than decorative.** The stores that hold agent memory deliberately DO expire their transport logs, and the reason written into that code is erasure compliance: a never-deleting log would retain a person's details after they had asked to be erased. That is a genuine legal constraint and an unqualified "never delete" would collide with it. The carve-out is what lets both hold at once — the system never forgets on its own, and the principal may still ask for a deletion. So this article is compatible with the compliance requirement rather than in conflict with it — but it does not by itself DELIVER compliance, and the earlier draft claiming it did was over-claiming (round 3, external lens). Actual compliance depends on the propagation condition in **Fails.** above holding across every duplicate, summary, index and replica, which is engineering work this article requires and does not perform.
+**Documented-only until.** `2026-09-22` — tracked as `STD-COUNTDOWN-archiving-never-deletes`. No guard decides whether a store deletes agent memory, and none is claimed. This lands as a `/spec-converge` cross-machine and integration reviewer question — "does any store here delete agent memory, and is what it deletes memory or telemetry?" — which is semantic authority, weaker than a lint and stronger than prose. A deterministic version is conceivable (enumerate the stores holding memory kinds, assert each declares a non-evicting retention posture) and is not built. **Sub-obligation countdown.** `2026-09-22` — tracked as `STD-SUBCOUNTDOWN-archiving-never-deletes`. This is a COUNTDOWN, not a resting state: the article is ratified and binding from 2026-08-22, and the label records that its enforcement is owed rather than built.
+**Earned from.** 2026-08-21 (topic 52222), operator directive, ratified 2026-08-22: "archiving CANNOT mean deleting. We must be able to access message history at all costs." Raised while designing cross-machine conversation coherence, where the mechanism proposed for replicating history was one built to bound itself by eviction — the agent was about to entrust its memory to a container designed to forget, and the design passed six convergence rounds without anyone naming that.
+**Traces to the goal.** The founding promise is one coherent, persistent agent. The registry's own Root section already supplies the reason this line falls where it does: destroying an agent's accumulated record is "an injury to a self," not a data incident. *Deferral = Deletion* protects the record at the moment of capture; this protects it for the rest of its life. An agent whose memory is bounded by eviction is not persisting through time — it is a sliding window that believes it is a self.
+
 ### Close the Loop
 **Rule.** Every loop the agent opens — a promise to a user, a feature shipped dark, an LLM gate deployed, a flagged issue, a hypothesis to revisit — must be durably registered and re-surfaced on a cadence until it reaches a *deliberate* close. Capturing it once is not enough; if no structure brings it back for review, it rots silently and is, in effect, abandoned. *"Untracked = Abandoned."*
 **Tree placement.** **ROOT / FOUNDATIONAL** — this standard declares no parent, and that is a stated position rather than an omission. It now carries merged subsections beneath it, which is exactly when its own placement had to be settled rather than assumed. Declared 2026-08-13 under the insertion-placement rule: a standard that is edited must say where it sits, because editing it is when its place in the tree is actually in mind. If a genuine parent is later identified, this becomes a child declaration — a root position is a claim that can be revised, not a permanent exemption.
@@ -453,15 +464,15 @@ The Root says *enforce behavior in structure, not willpower.* This family is **w
 **Per-feature posture (2026-06-12 widening).** The lease layer alone does not make ONE agent — the 2026-06-12 audit (topic 13481) found ~20 features that were individually correct and collectively machine-blind: preferences, attention items, jobs, sentinel voices, and links all silently assumed a single machine, because no review surface ever asked. The rule, per feature: **every feature with durable state, user-facing notices, or generated URLs must declare its multi-machine posture — though this article **does NOT own the posture-declaration obligation**, which belongs to *An Instar Agent Is Always a Multi-Machine Entity*, where the permitted postures are enumerated. Read the requirement to be robust across machines here; read what a posture may SAY, and that one must be asserted, there — replicated (named path) / proxied-on-read (named read) / machine-local by design (with the reason) — at review time.** Enforced through the side-effects review template §7 (Multi-machine posture, `skills/instar-dev/templates/side-effects-artifact.md`) and the spec-converge integration reviewer's mandatory posture check (`skills/spec-converge/SKILL.md`); the gap-closure work itself is `docs/specs/MULTI-MACHINE-SEAMLESSNESS-SPEC.md`.
 
 ### An Instar Agent Is Always a Multi-Machine Entity
-**Rule.** Every feature, state surface, and design decision treats the agent as a SINGLE entity spread across many machines, BY DEFAULT. "Unified across my machines" is the default posture; "machine-local" is an EXCEPTION that must be justified with a concrete reason it *cannot* be unified (a login or credential that physically lives in one disk's keychain; a hardware-bound resource; an operator-ratified exception) — never a default chosen for expedience. A design that silently assumes one machine, or that declares "machine-local BY DESIGN" without naming that concrete reason, is a violation, not a valid posture.
+**Rule.** Every feature, state surface, and design decision treats the agent as a SINGLE entity spread across many machines, BY DEFAULT. "Unified across my machines" is the default posture; "machine-local" is an EXCEPTION that must be justified with a concrete reason it *cannot* be unified (a login or credential that physically lives in one disk's keychain; a hardware-bound resource; an operator-ratified exception) — never a default chosen for expedience. A design that silently assumes one machine, or that declares "machine-local BY DESIGN" without naming that concrete reason, is a violation, not a valid posture. **Single-machine survivability (ratified 2026-08-22, operator directive, topic 52222 — Amendment 1).** An agent must be able to operate AS IS on ANY SINGLE machine it is installed on. If every other machine becomes unavailable the agent loses RESOURCES — throughput, parallelism, hardware it does not have — but never INFORMATION. A design in which some information is reachable only by contacting another machine violates this, **however reliable that other machine is assumed to be**. **The subject, stated in the Rule because it decides a live collision (added at ratification, 2026-08-22).** The conservation is over what the agent KNOWS — its memory and the state a coherent reply depends on — not over per-machine OPERATIONAL records whose own articles bound them on purpose. *Decision Provenance & Outcome Review* deliberately keeps judgment-call context machine-local-full and retention-bounded, and *Observable Intelligence* requires audit trails to age out; without this boundary, survivability and those articles would each be citable against the other. The same test applies as in *Archiving May Never Mean Deleting*: losing it costs the agent its CONTINUITY, not merely a diagnostic. A machine-local operational log is therefore not a survivability violation; a machine-local piece of the agent's memory is. **And the posture this retires, named rather than left for a reader to notice (external adversarial lens, 2026-08-22).** `proxied-on-read` — a named remote read — is EXACTLY "information reachable only by contacting another machine", so for memory-bearing state it is no longer a valid destination posture: it survives only for OPERATIONAL state under the boundary above, and for memory it is at best a `migrating-to-unified` waypoint. Leaving that unsaid would have left the article enumerating a posture its own Rule forbids, citable both ways. This is strictly stronger than the reachability test the article applied before it: a fetch-on-demand design passes "can this be unified?" (every machine *can* reach the data) while failing this one, because reachability is conditional on a peer being up. That gap is not hypothetical — it is the one the conversation-history design fell into, surviving six convergence rounds before the operator caught it on read. **The rule is an OUTCOME, not a storage mandate (ratified 2026-08-22, same directive — Amendment 2).** It requires that any machine can act coherently on anything the agent knows; it does NOT prescribe that every byte sits on every disk. Full replication, sealed per-machine replication, and replicate-index-plus-encrypted-content all satisfy it; fetch-on-demand from a live peer does not. Mechanisms may improve without a constitutional edit; the outcome may not quietly weaken. A storage mandate written into a constitution freezes today's implementation into the document and makes adopting the next better mechanism an amendment.
 **Tree placement.** **ROOT / FOUNDATIONAL** — this standard declares no parent, and that is a stated position rather than an omission. It now carries merged subsections beneath it, which is exactly when its own placement had to be settled rather than assumed. Declared 2026-08-13 under the insertion-placement rule: a standard that is edited must say where it sits, because editing it is when its place in the tree is actually in mind. If a genuine parent is later identified, this becomes a child declaration — a root position is a claim that can be revised, not a permanent exemption.
 **Merged subsections.** 2 standard(s) were merged under this one on 2026-08-13 and remain LIVE and binding, each as a named subsection: **Cross-Machine Coherence** — It requires the one-agent cross-machine machinery itself to remain single-authority, internet-capable, deduplicated, and convergent under partitions and load; **Ownership-Gated Side Effects** — It requires every topic-scoped create, revive, rebind, terminate, or other side effect to prove current ownership at fire time and to fail loudly on unresolved ownership. They are named here rather than summarised into this article deliberately — the operator's condition is that the development process still encounters **every specific tripwire** each one carried, and a parent stated at this altitude cannot carry them. Removing any enforcement structure that made a subsection merge-able remains a **breach**; the merge never licenses it.
 **Fails.** If the cross-machine posture lint or semantic reviewer is unavailable, fail open and loud: ordinary work may proceed, but record and surface the missed posture review; a proposed state-fragmenting exception still fails closed.
 **Distinct from Cross-Machine Coherence.** Its sibling above governs the *robustness of the lease / seamlessness layer* under degraded conditions — the machinery that keeps N machines from becoming two agents. This one governs the *default posture of every new feature*: that machinery only makes the agent whole if features actually ride it. The per-feature posture check (2026-06-12 widening, above) already exists — but it verifies a feature *declares* a posture and accepts "machine-local BY DESIGN" as a valid declared answer, so a wrong posture (machine-local where unified was correct) passes the check by being *declared*. The gap this closes: the check tested for a declaration, not for the unified DEFAULT.
-**In practice.** This is **THE SINGLE GOVERNING ARTICLE for the cross-machine posture declaration** (declared 2026-08-08, fourth pass, after the review found both this article and *Cross-Machine Coherence* owning it: "both still own the declaration/review obligation"). It governs here because it STRENGTHENS the permitted answers — the enumerated postures below — while the other article owns the broader robustness rule that a posture serves. Every new state surface asserts its cross-machine posture — `unified` (rides the One Memory / stateSync machinery), `proxied-on-read` (a named remote read), or `machine-local + justification` (the reason jailed to a closed taxonomy: physical-credential-locality, hardware-bound-resource, or an operator-ratified exception). Absence defaults to `unified`-required. A bare "machine-local BY DESIGN" with no justification fails review — the default is *asserted*, never *assumed*.
+**In practice.** This is **THE SINGLE GOVERNING ARTICLE for the cross-machine posture declaration** (declared 2026-08-08, fourth pass, after the review found both this article and *Cross-Machine Coherence* owning it: "both still own the declaration/review obligation"). It governs here because it STRENGTHENS the permitted answers — the enumerated postures below — while the other article owns the broader robustness rule that a posture serves. Every new state surface asserts its cross-machine posture — `unified` (rides the One Memory / stateSync machinery), `proxied-on-read` (a named remote read — **OPERATIONAL state ONLY; invalid for memory-bearing state**, see the survivability clause in the Rule), or `machine-local + justification` (the reason jailed to the closed taxonomy stated above: physical-credential-locality [narrowed 2026-08-22], hardware-bound-resource, operator-ratified-exception, or migrating-to-unified [added 2026-08-22]). Absence defaults to `unified`-required. A bare "machine-local BY DESIGN" with no justification fails review — the default is *asserted*, never *assumed*. **THE CLOSED TAXONOMY, amended 2026-08-22 (operator directive, topic 52222 — Amendments 3 and 5).** A `machine-local` posture jails its reason to this closed set, and widening the set remains a constitution-bound operator decision, never an author's convenience. **`physical-credential-locality` — NARROWED (Amendment 3).** It covers only a credential whose relocation is PROHIBITED or technically impossible: a vendor's terms of service, a hardware-bound key, a legal residency constraint. It does NOT cover a credential that merely HAPPENS to be stored on one disk. Where a vault (Bitwarden and equivalents) can hold it, the locality is a storage choice and this key does not apply. A claim under this key must NAME its basis — the prohibiting authority (`prohibited-by`) or, where the barrier is technical rather than forbidding, what makes relocation impossible (`impossible-because`). Both are accepted, because "technically impossible" often has no authority to cite and demanding one was an inconsistent evidentiary bar (external adversarial lens, 2026-08-22). The claim must also declare whether the barrier is expected to be PERMANENT or TEMPORARY, and **a TEMPORARY declaration must record its exit** (`exit=<ref>`), **a re-review date** (`expires=YYYY-MM-DD`, at most 180 days out), **and the date it was first declared** (`since=YYYY-MM-DD`, with the same 360-day TOTAL-LIFETIME cap) — the full contract `migrating-to-unified` carries, for the same reason and closed in the same place (round 4: giving this key a deadline without a lifetime cap re-created, one key over, exactly the renew-every-180-days loophole round 3 had just closed for the other; a fix that reintroduces the defect it was patterned on is not a fix). At the cap the barrier is re-argued in front of the operator, who may of course rule it PERMANENT — which is the honest outcome for a barrier that has held for a year: a barrier declared temporary with no tracked way out is a permanent barrier wearing a temporary label, and one with an exit but no deadline is the same thing with paperwork (the deadline was added in round 3 after an external lens observed the exit ref alone let a TEMPORARY barrier outlive the horizon imposed on the newer key — a rule that binds a new key more tightly than an old one for no stated reason is an inconsistency, not a conservative default). The one genuine current instance is Anthropic's prohibition on relocating a Claude login between machines (why WS5.2 re-mints per machine rather than copying a token); under this amendment it still passes, and must be declared TEMPORARY with the planned exit recorded — API-key doorways once per-machine login becomes untenable at scale (operator, same directive). **`hardware-bound-resource`** — unchanged. **`operator-ratified-exception`** — unchanged; still requires a machine-verifiable, existence-checkable ref. **`migrating-to-unified` — NEW (Amendment 5).** Permitted ONLY when the marker also cites (a) the ratified decision establishing `unified` as the destination and (b) a resolvable tracking ref for the work that delivers it, AND carries an expiry date, and that date may be **at most 180 days out** — a bound added at ratification after an external adversarial lens showed the key was RENEWABLE rather than self-terminating (an author could set a distant expiry, deliver nothing, and never be asked again; the first draft's own test fixture used the year 2099 and passed). On expiry the surface either declares `unified` or the exception is re-argued in front of the operator; it may never lapse silently into a permanent posture. **And because a per-declaration horizon alone is merely RENEWABLE (round 3, external lens: "renewal forever remains possible; assigning that loophole to semantic review does not close it"), the marker also carries `since=YYYY-MM-DD` — the date the posture was FIRST declared for that surface — and the posture's TOTAL LIFETIME (`expires` − `since`) may not exceed 360 days.** A renewal must carry the original `since` forward, so re-dating the expiry no longer buys unbounded time: the second renewal is the last one the parser will accept. **What remains open, stated rather than claimed closed:** a `since` that is simply rewritten is FALSIFICATION, not a loophole in the letter — the parser cannot detect it, and nothing here pretends otherwise. The difference matters: an author must now lie to keep the posture, where before they only had to pick a distant date. **Why a fourth key was ratified despite the hatch being deliberately narrow.** Amendment 1 GUARANTEES arrivals at this wall: making survivability the test converts a population of currently-passing `machine-local` surfaces into surfaces whose correct posture is `unified` and whose mechanism is unbuilt. With only three keys the honest posture is unavailable — the conversation-history spec keyed nine surfaces `operator-ratified-exception (PENDING)` for a ratification the operator then DENIED, leaving markers citing a refused approval. Adopting 1 without 5 therefore MANUFACTURES the false-claim class the taxonomy exists to reduce. This key is the only one of the four whose use is self-terminating — it requires a date and a tracked delivery, so it cannot become a resting place — and unlike Amendments 1, 2 and 4 its contract is deterministically CHECKABLE on arrival, because its citation requirements reduce to the same existence-check the marker lint already performs. **The honest scope of that check:** the parser verifies the marker's SHAPE — that an authority is named, that refs are ref-shaped, that a date is present and unexpired and inside the maximum horizon. It cannot verify that the named authority actually prohibits the relocation, that the tracked work will deliver unification, or that an expiry triggers real re-argument. Those remain the `/spec-converge` reviewer's semantic authority, exactly as before; "checkable" here never means "proven true".
 **Earned from.** 2026-07-03 (topic 29723), operator-ratified: the tiered-intelligence-delegation spec defaulted its consult memory to machine-local, conflicting with the single-unified-agent goal — and it survived SEVEN convergence rounds before the operator caught it on read. That it took the operator's read, not the review machinery, is the tell: the always-multi-machine expectation lived in prose and reviewer habit, not in structure. Justin named the meta-point — "the fact that I had to point out the misalignment means we have a gap in our standards or how we enforce them; it should be fundamental in our constitution that an Instar agent is always supported as a multi-machine entity."
 **Traces to the goal.** The founding promise is one coherent, persistent agent. An agent whose memory, budgets, or state fragment per-machine is not one agent — it is N confused copies of it. *Structure beats Willpower*: don't rely on the agent or a reviewer *remembering* that the agent is multi-machine; make the unified default the path of least resistance and machine-local the posture that must argue for itself.
-**Applied through.** The deterministic marker floor `scripts/lint-machine-local-justification.js` — a no-LLM static parser that grades the PRESENCE + well-formedness of the `machine-local-justification: <taxonomy-key>` marker a spec must carry per machine-local surface: an undefended machine-local posture fails, and — bidirectionally — a spurious/out-of-taxonomy marker or an `operator-ratified-exception` citing no machine-verifiable ref fails too (self-tested with positive, undefended, and spurious-marker fixtures). This is the cheap deterministic SIGNAL; the `/spec-converge` integration reviewer holds the semantic AUTHORITY (is the justification actually TRUE?) the parser cannot make. The lint ships REPORT-FIRST (a non-blocking signal; `--strict` is the FAIL capability) per the honesty / hard-sequencing clause of `docs/specs/three-standards-enforcement.md` (§197-202, §563-573) and the dark-first Maturation convention. The `/spec-converge` cross-machine check is also STRENGTHENED to REJECT "machine-local" unless the spec carries an explicit `machine-local-justification` (a bare "machine-local BY DESIGN" fails); the side-effects review §7 posture field gains the same justification requirement; and existing features are swept for undefended machine-local surfaces (folds into the feature-maturation audit, topic 30668). This registry entry + its **P21** twin in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` fire the `/spec-converge` lessons-aware reviewer on every future spec.
+**Applied through.** The deterministic marker floor `scripts/lint-machine-local-justification.js` — a no-LLM static parser that grades the PRESENCE + well-formedness of the `machine-local-justification: <taxonomy-key>` marker a spec must carry per machine-local surface: an undefended machine-local posture fails, and — bidirectionally — a spurious/out-of-taxonomy marker or an `operator-ratified-exception` citing no machine-verifiable ref fails too (self-tested with positive, undefended, and spurious-marker fixtures). This is the cheap deterministic SIGNAL; the `/spec-converge` integration reviewer holds the semantic AUTHORITY (is the justification actually TRUE?) the parser cannot make. The lint ships REPORT-FIRST (a non-blocking signal; `--strict` is the FAIL capability) per the honesty / hard-sequencing clause of `docs/specs/three-standards-enforcement.md` (§197-202, §563-573) and the dark-first Maturation convention. The `/spec-converge` cross-machine check is also STRENGTHENED to REJECT "machine-local" unless the spec carries an explicit `machine-local-justification` (a bare "machine-local BY DESIGN" fails); the side-effects review §7 posture field gains the same justification requirement; and existing features are swept for undefended machine-local surfaces (folds into the feature-maturation audit, topic 30668). This registry entry + its **P21** twin in `docs/INSTAR-DESIGN-PRINCIPLES-AND-LESSONS.md` fire the `/spec-converge` lessons-aware reviewer on every future spec. **UNENFORCED SUB-OBLIGATION, named (2026-08-22).** Amendments 1 and 2 have NO deterministic guard and are not claimed to have one: no parser can decide whether a design survives the loss of every peer, nor whether a stated outcome is genuinely met. They land as `/spec-converge` cross-machine reviewer questions — "does this survive every peer disappearing?" — which is semantic authority, weaker than a lint and stronger than prose. Amendments 3 and 5 carry deterministically CHECKABLE MARKER CONTRACTS, enforced in `scripts/lint-machine-local-justification.js`. What is enforced is the marker's SHAPE — a basis is named, refs are ref-shaped, dates are present, unexpired, and inside their caps. The SEMANTIC facts those markers assert — that the named authority really prohibits relocation, that the impossibility is real, that the tracked work delivers unification — are NOT checked by anything deterministic and remain the reviewer's (re-narrowed 2026-08-22 round 3, after an external lens read the flat word "enforced" as covering the semantics). Naming this asymmetry rather than citing a guard for the unguarded clauses is deliberate: *Cross-Store Coherence* records that naming a guard in prose made an article classify as ENFORCED by a guard measuring something else, and reproducing that inside the article being amended to be more honest would be the worst available outcome. **Sub-obligation countdown.** `2026-09-22` — tracked as `STD-SUBCOUNTDOWN-multi-machine-survivability`.
 
 ### Cross-Store Coherence Is an Invariant
 **Rule.** Any two stores that answer the same question — about identity, authority, machine liveness, or configuration — must have a **declared agreement invariant**, and that invariant must be **checked on a cadence by machinery**. A pair of authoritative stores with no coherence check is a contradiction waiting for a code path to read the wrong one. When a NEW store is introduced that answers a question an existing store already answers, declaring the invariant is part of introducing it.

package/src/data/standards-registry.meta.json

@@ -1,6 +1,6 @@
 {
-  "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "articleCount": 88,
+  "sha256": "5e49a5f5481c67c725c3bab997ab085370c5904e92e1ebf480d6105711e1e305",
+  "articleCount": 89,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1190"
+  "packageVersion": "1.3.1191"
 }

package/upgrades/1.3.1191.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The operator ratified five amendments to the multi-machine standard (topic 52222, 2026-08-22). Two of them are deterministically checkable and are now enforced by the marker lint (`scripts/lint-machine-local-justification.js`), a report-first parser over `docs/specs/**` that blocks nothing.
+
+`physical-credential-locality` is NARROWED. A marker must now NAME its basis — `prohibited-by="<authority>"` where relocation is forbidden, or `impossible-because="<barrier>"` where it is technically impossible — and declare `permanence=permanent|temporary`. A TEMPORARY barrier must additionally record `exit=<ref>`, a `expires=YYYY-MM-DD` re-review date at most 180 days out, and `since=YYYY-MM-DD` with a 360-day total-lifetime cap. The bare form that previously passed now reports findings and no longer defends its posture.
+
+`migrating-to-unified` is a NEW fourth taxonomy key for a surface whose correct posture is `unified` but whose mechanism is unbuilt. It requires `ratified=<ref> tracking=<ref> since=YYYY-MM-DD expires=YYYY-MM-DD`, with the same 180-day horizon and 360-day total-lifetime cap. An expired, beyond-horizon, or past-lifetime marker is itself a finding.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+21 self-tests, both directions per contract: well-formed markers pass; each missing citation, an expired posture, a beyond-horizon expiry, a renewal past the total lifetime, a TEMPORARY barrier missing its exit / re-review date / `since`, and the pre-amendment bare credential form each fail under `--strict`. The withdrawn-defence arm asserts a malformed marker leaves its posture reading UNDEFENDED rather than merely reportable, and the passing fixtures compute their dates so they cannot rot into failures.
+
+Sweeping the spec corpus moves the report from 94 findings to 135: 16 credential markers that never named who forbids the move, and 9 postures thereby left undefended. Report-only — that rise is the narrowing working, and repairing those 16 is separate work.
+
+The change was reviewed by an external adversarial lens over four rounds (nine findings, converged at zero new). It proved this change's own first-draft fixture used `expires=2099-01-01` and passed, which is how the renewable-not-self-terminating gap was found.
+
+## Known Limits
+
+The parser checks the marker's SHAPE only. It cannot verify that a named authority really prohibits relocation, that an impossibility is real, that tracked work will deliver unification, or that an expiry triggers genuine re-argument — those remain the `/spec-converge` reviewer's semantic authority. A rewritten `since` defeats the lifetime cap and is falsification the parser cannot detect. The lint stays REPORT-FIRST; `--strict` is used by its own tests and is not wired into CI as a blocking gate. Amendments 1, 2 and 4 of the same directive carry no deterministic guard at all and are declared unenforced in the registry with dated countdowns.

package/upgrades/ratify-multi-machine-amendments-2026-08-22.eli16.md

@@ -0,0 +1,54 @@
+# Ratifying five amendments to the multi-machine standard — Plain-English Overview
+
+## The problem in one breath
+
+The rulebook said an agent's features should work across all its machines, and let a feature opt out by picking one of three excuses. On 2026-08-21 the operator found that the rule, as written, still permitted a design where some of what the agent knows lives on only one machine — and that one of the three excuses was being used for credentials that merely *happened* to sit on one disk. He approved five changes on 2026-08-22. This is those five changes written into the rulebook, plus machinery for the two of them a program can actually check.
+
+## What already exists
+
+*An Instar Agent Is Always a Multi-Machine Entity* is the single governing article for how a feature declares where its state lives. A feature declares `unified`, `proxied-on-read`, or `machine-local` with a reason drawn from a closed list of three: a credential physically tied to one machine, a hardware-bound resource, or an exception the operator ratified. A report-only script, `scripts/lint-machine-local-justification.js`, parses those declarations out of specs and reports the malformed ones. It blocks nothing; a human reviewer holds the judgment about whether a stated reason is actually true.
+
+## What this adds
+
+**1 — Single-machine survivability.** If every other machine disappears, the agent loses resources but never information. This is stronger than the test the article used before: a design that fetches data from a peer on demand passes "can this be unified?" while failing this, because it depends on that peer being up. That is exactly the gap the conversation-history design fell into, surviving six review rounds before the operator caught it.
+
+**2 — Say what must be true, not how to store it.** The rule now states an outcome — any machine can act coherently on anything the agent knows — instead of mandating that every byte sits on every disk. Several storage designs satisfy it; fetch-from-a-live-peer does not. A better mechanism can be adopted later without amending the constitution.
+
+**3 — The credential excuse is narrowed.** `physical-credential-locality` now covers only a credential whose relocation is genuinely prohibited — a vendor's terms, a hardware-bound key, a legal residency rule. The declaration must name who forbids the move and say whether that is permanent or temporary. A credential a vault could hold is a storage choice, and this excuse no longer covers it.
+
+**4 — Archiving may compress, never delete.** This became its own rule rather than part of the multi-machine one, because it is true of an agent on a single machine with no peers at all. It governs *memory* — conversations, learnings, relationships, knowledge — and deliberately does not govern logs, metrics, or audit trails, which are supposed to be trimmed. Without that boundary it would contradict an existing rule requiring audit trails to age out, and each could be cited against the other. The single permitted deletion is one the operator asks for.
+
+**5 — A label for "on the way."** A new fourth excuse, `migrating-to-unified`, for a surface whose correct posture is unified but whose machinery is not built. It must cite the decision that made unified the destination, link the work that delivers it, and carry an expiry date.
+
+## The new pieces
+
+Change 5 exists because of change 1, and this is the one dependency among the five. Making survivability the test converts a population of currently-passing `machine-local` surfaces into surfaces whose correct posture is unified and whose mechanism is unbuilt — with only three excuses available, the honest label does not exist. The conversation-history design already hit this: nine of its surfaces were labelled "operator ratified this" for a ratification the operator then refused. So adopting 1 without 5 would manufacture exactly the false labelling the list of excuses exists to prevent.
+
+## The safeguards
+
+**Two of the five are machine-checked; three are not, and the rulebook says so.** Changes 3 and 5 reduce to checks the parser already performs, so they are enforced on arrival. Changes 1, 2 and 4 cannot be — no program can decide whether a design survives losing its peers — so they are recorded as unenforced obligations with dated countdowns rather than given a guard they do not have. Naming a guard that measures something else is how an article comes to read as protected while protecting nothing; the registry already carries one article's worth of scar tissue about exactly that, and this change refuses to repeat it inside the article being amended for honesty.
+
+**The new key cannot become a permanent hiding place.** It requires a date and a tracked delivery, and an expiry that has passed is itself a reported finding. That is the only reason a fourth excuse was acceptable in a list kept deliberately short.
+
+**Nothing here blocks anyone.** The parser reports and exits zero. Narrowing the credential excuse moved the report count from 94 findings to 135 across the spec corpus — 19 declarations that never named who forbids the move, and 11 surfaces thereby left undefended. That number going up is the amendment working.
+
+## What an outside reviewer found before this shipped
+
+Rather than write the five changes and call them done, the diff was handed to an independent model told to attack it. Four rounds. It was right nine times, and six of those changed the text:
+
+- **The new "on the way" label was renewable, not self-expiring.** Nothing stopped an author setting the expiry to the year 2099 — and this change's own first test case did exactly that and passed. It now carries a maximum date *and* a total lifetime, so it can be renewed roughly once before it must be resolved or re-argued.
+- **Then the same hole was re-created one rule over.** Fixing the credential excuse by giving it a deadline, but no lifetime, reproduced the loophole that had just been closed for the other key. Both now carry the same contract.
+- **The rulebook contradicted itself.** An existing posture means "read it from the other machine when needed" — exactly what change 1 forbids. Both were left standing, each citable against the other. Now the enumeration says which one wins.
+- **Deletion authority was stated too narrowly.** Only the operator could ask for something to be removed, but an erasure obligation can come from the person concerned or from law. The carve-out now covers both — and a permitted deletion must reach every copy, which matters precisely because this rule creates copies on purpose.
+- **Two things were over-claimed** — that the two checkable amendments were "enforced" (the checker verifies the shape of a declaration, never whether it is true), and that three days of measured conversation proved keeping everything forever is affordable on any hardware.
+- **The memory-versus-telemetry test begged the question for records that are both.** Resolved by a precedence rule: a bounded store may age out its copy, but it may never be the only copy.
+
+That is what a real second pass looks like when it is allowed to say no.
+
+## What ships when
+
+The rulebook text and the two enforced contracts ship together, so the prose and the parser cannot disagree. Fixing the 16 newly-reported declarations is separate work and is not folded in here.
+
+## What you actually need to decide
+
+Nothing further about the five — all five were approved on 2026-08-22 and this is their application. One thing does need the operator, and it is not a judgment call: a guard landed on 2026-08-17 requiring every constitutional change to carry an independently signed ratification, and the key it verifies against shipped empty. No rulebook change has landed since. This one cannot either until that key is installed in protected main. The private key is deliberately meant to live where no agent can reach it, so that step is the operator's alone.

package/upgrades/side-effects/ratify-multi-machine-amendments-2026-08-22.md

@@ -0,0 +1,91 @@
+# Side-Effects Review — Enforce Amendments 3 and 5 of the multi-machine standard
+
+**Version / slug:** `ratify-multi-machine-amendments-2026-08-22`
+**Date:** `2026-08-22`
+**Author:** `echo`
+**Second-pass reviewer:** `codex-cli — external adversarial lens, 4 rounds (9 → 4 → 2 → 0 findings)`
+
+## Summary of the change
+
+The operator ratified five amendments to *An Instar Agent Is Always a Multi-Machine Entity* on 2026-08-22 (topic 52222, all five approved). Two of them are deterministically checkable and are enforced here in `scripts/lint-machine-local-justification.js`, the report-first marker parser that grades `machine-local-justification:` markers in specs. **Amendment 3** narrows `physical-credential-locality` so it covers only a credential whose relocation is *prohibited* — the marker must now carry `prohibited-by="<authority>"` and `permanence=permanent|temporary`. **Amendment 5** adds a fourth taxonomy key, `migrating-to-unified`, permitted only with `ratified=<ref> tracking=<ref> expires=YYYY-MM-DD`, where an already-past expiry is itself a finding. The registry text for all five amendments lands in the same change (`docs/STANDARDS-REGISTRY.md`), with Amendment 4 as a new Substrate article. Amendments 1, 2 and 4 are declared UNENFORCED in the registry rather than given a guard they do not have.
+
+## Decision-point inventory
+
+- `gradeMachineLocalMarkers` (scripts/lint-machine-local-justification.js) — modify — grades marker presence/well-formedness; gains two per-key contracts.
+- `TAXONOMY_KEYS` (same file) — modify — the closed taxonomy gains `migrating-to-unified` by operator ratification.
+- `hasValidMarker` (A1 arm, same file) — modify — a marker now DEFENDS a machine-local posture only when well-formed for its key.
+
+The lint holds no blocking authority anywhere: it ships report-first (exit 0 unless `--strict`), is not wired into CI as a blocking gate, and is not invoked by any runtime path.
+
+## 1. Over-block
+
+The narrowing makes 19 existing `physical-credential-locality` markers report findings, and 11 of those were the sole defence of their surface, so those surfaces now also report A1-undefended. **This is the intended effect of the amendment, not an over-block**: the operator's stated reason for Amendment 3 is that the key as written let a storage habit assert a physical constraint, and a narrowing that fails none of the cases it narrowed has narrowed nothing. It cannot over-BLOCK in the literal sense because the lint blocks nothing — total findings move 73 → 122, all report-only. The sweep to fix those 16 markers is separate work and is named as such rather than folded in here.
+
+## 2. Under-block
+
+The parser checks the PRESENCE and shape of a named authority, never its truth: `prohibited-by="because I said so"` passes the parser. That is deliberate and is the standing signal-vs-authority split — the `/spec-converge` integration reviewer holds the semantic authority to decide whether a stated prohibition is real. Likewise `ratified=`/`tracking=` are checked as existence-shaped refs (SHA / URL / dotted key), exactly as `operator-ratified-exception` already is, not resolved against the objects they name. Stating this rather than implying the parser judges truth.
+
+## 3. Level-of-abstraction fit
+
+The contracts live in the parser that already owns marker well-formedness, beside the identical existence-check `operator-ratified-exception` has carried since the lint shipped. No new file, no new invocation point, no new gate. Amendment 5's citation requirements were chosen *because* they reduce to that existing check — which is why 3 and 5 land enforced while 1, 2 and 4 cannot.
+
+## 4. Signal vs authority compliance
+
+Compliant, and unchanged in kind. The lint is a SIGNAL: cheap, deterministic, no LLM, report-first, non-blocking. The AUTHORITY over whether a posture is correct remains the `/spec-converge` reviewer. The change adds no blocking capability and does not move the lint toward one. `--strict` remains an opt-in capability used by this lint's own tests, as before.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No judgment point is added. Every new check is a deterministic parse of named fields plus one date comparison. Nothing here calls a model or infers intent from prose — and the one place where judgment genuinely belongs (is the named authority real?) is explicitly left with the reviewer rather than approximated in a regex.
+
+## 5. Interactions
+
+- **`docs/STANDARDS-REGISTRY.md`** — the amended article states the taxonomy this parser enforces. Both ends of the pair land in the same commit, so the prose and the parser cannot disagree.
+- **`scripts/standards-coverage.mjs`** — classifies articles by the guard their prose names. The amended article names this lint for Amendments 3 and 5 ONLY, and declares 1, 2 and 4 unenforced. This is deliberate: *Cross-Store Coherence* records that naming a guard in prose made an article classify as ENFORCED by a guard measuring something else, and the enforcement ratio rising on an edit that built nothing was the tell. Reproducing that inside the article being amended for honesty would be the worst available outcome.
+- **`tests/fixtures/spec-lint/A-good-defended.md`** — updated to the new contract. The pre-amendment bare form is preserved as `A-bad-credential-bare.md` so the case that used to pass is shown failing rather than deleted.
+- **`docs/standards-registry-floor.json`** — `minArticleCount` 88 → 89 for the new Substrate article.
+
+## 6. External surfaces
+
+None. No HTTP route, no CLI command shipped to agents, no message, no notification, no scheduled job. The lint is a repo dev script; end-user agents never invoke it.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface is added. The operator-facing consequence of this change is the registry text itself, which was written for a reader making a decision, and the five plain-English questions the operator answered before it was written. Finding messages name the amendment and quote the offending marker so an author can act without reading the parser.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+`unified` — trivially. The lint is a stateless pure-function parser over repo files with no durable state, no per-machine state, no generated URL, and no notification. Running it on any machine over the same tree produces the same findings. The one non-pure input is the current date, used solely for the expiry arm; it is injectable (`today`) and defaults to `new Date()`, so a machine with a skewed clock reports a different expiry verdict — an acceptable and visible divergence for a report-only signal, and the reason the parameter exists rather than reading the clock inline.
+
+## 8. Rollback cost
+
+Near zero and purely additive to revert. Removing `migrating-to-unified` from `TAXONOMY_KEYS` and deleting the two grader functions returns the parser to its prior behaviour exactly; the fixtures and tests revert with them. Because the lint blocks nothing, a revert cannot strand anyone's work — the only effect is that the two amendments become documented-only like the other three. The registry text and the parser must be reverted together or the article names a guard that no longer checks what it claims.
+
+## Conclusion
+
+Ship. The change is the mechanical half of an operator-ratified constitutional amendment, adds no authority, has no runtime or external surface, and is covered both directions by tests (well-formed markers pass; the narrowed case, each missing citation, and an expired posture each fail). The honest caveat that belongs with it: the registry edit itself cannot merge until the standards direction guard has an approver key installed in protected main — that gate is the operator's and is named in the PR rather than worked around.
+
+## Second-pass review
+
+**Run, and it changed the change.** An external model was given the diff with instructions to REFUTE — contradiction, over-claim, loophole, subject-drift — not to approve. Four rounds; nine findings; convergence when a full re-review returned NO NEW FINDINGS. Full record: `docs/specs/reports/standards-family-convergence-2026-08-22.md`. The six that altered the constitutional text:
+
+1. **`proxied-on-read` contradicted the new survivability clause** — the article enumerated a posture its own Rule forbids, each citable against the other. Now annotated operational-only and named in the Rule.
+2. **The new key was RENEWABLE, not self-terminating** — proven by this change's own first-draft fixture, which used `expires=2099-01-01` and passed. Closed in two steps: a 180-day horizon, then `since=` plus a 360-day total-lifetime cap after the lens observed a per-declaration horizon is renewable.
+3. **The same loophole re-created one key over** — round 3 gave the TEMPORARY credential barrier a deadline but no lifetime cap, reintroducing on the older key what had just been closed on the newer. Now identical contracts. Worth naming: a fix patterned on another fix inherited the defect that pattern had already been corrected for.
+4. **Erasure authority is not only the operator** — the carve-out now covers a lawful erasure obligation, the `Fails.` line no longer re-narrows it, and a PROPAGATION condition requires a permitted deletion to reach every duplicate, summary and index the duplication rule created.
+5. **Two over-claims** — "ENFORCED" read as covering semantics the parser cannot check (now "deterministically CHECKABLE marker contracts", with the boundary in the same sentence); and three days of compressed message text extrapolated to "any hardware" (now scoped to its sample).
+6. **The continuity test begged the question for dual-purpose records** — resolved by a precedence rule (a bounded store may age its COPY, never hold the ONLY copy) plus, in round 4, a requirement that a replacing summary OMIT the erased material.
+
+The lint changes in this artifact's §1–§8 above are the mechanical half of findings 2, 3 and 5; the tests were extended in step with each round (13 → 16 → 20 → 21).
+
+## Evidence pointers
+
+- `tests/unit/lint-machine-local-justification.test.ts` — 21 tests, all passing, including the withdrawn-defence arm (a bare credential marker must leave its posture reading UNDEFENDED, not merely reportable), the self-terminating arms (expired, beyond-horizon, and past-total-lifetime each fail separately), and the TEMPORARY-barrier contract (exit ref, re-review date, and `since` each tested missing).
+- Sweep before/after over `docs/specs/**`: 94 findings → 135 (`+19` credential markers now needing an authority and permanence, `+11` postures thereby left undefended, `+19` permanence findings). Report-only; no build state changes.
+- `node scripts/lint-registry-tree-parentage.mjs` — clean, 89 articles, 40 bidirectional relations.
+- `node scripts/standards-coverage.mjs --check` — the Building and The Substrate area audits are RECORDED and current (`docs/audits/standards-area-audit-2026-08-22.json`). The ONLY remaining failure is the direction guard, which requires an operator-signed ratification per changed article; the approver key pinned in protected main is an empty placeholder. Named in the PR, not worked around.
+- `node scripts/lint-registry-insertion-placement.mjs` — clean, 89 articles, 78 declaring a placement.
+- `node scripts/generate-standards-registry-asset.mjs` — canary accepts; 0 unrecognized article sections.
+
+## Class-Closure Declaration (display-only mirror)
+
+The class is "a taxonomy key whose contract the parser cannot check." Both keys amended here are closed against it: each new requirement was chosen so it reduces to an existence check the parser already performs. The class is NOT closed for Amendments 1, 2 and 4, and that is stated in the registry as an unenforced sub-obligation with a dated countdown rather than left for a reader to discover.