instar 1.3.1195 → 1.3.1196

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1195",
+  "packageVersion": "1.3.1196",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "b4c9f07f239e4f4783980209f1e4895e84571b3925b720346a8922f6ac34ca6a",
+  "sha256": "245d913df7c5e45424a2491bef4d7ea849d2cce4e224a0ab1943fa31195ec96d",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1195"
+  "packageVersion": "1.3.1196"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1195"
+  "packageVersion": "1.3.1196"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1195",
+  "version": "1.3.1196",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-24T01:00:22.148Z",
-  "instarVersion": "1.3.1195",
+  "generatedAt": "2026-08-24T02:13:09.489Z",
+  "instarVersion": "1.3.1196",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1195",
+  "packageVersion": "1.3.1196",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "b4c9f07f239e4f4783980209f1e4895e84571b3925b720346a8922f6ac34ca6a",
+  "sha256": "245d913df7c5e45424a2491bef4d7ea849d2cce4e224a0ab1943fa31195ec96d",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1195"
+  "packageVersion": "1.3.1196"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1195"
+  "packageVersion": "1.3.1196"
 }

package/upgrades/1.3.1196.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`tests/e2e/benchmark-divergence-alive.test.ts` no longer asserts `mirror.stale === false`. It asserts the wiring facts it owns — the mirror resolves on the production init path, carries a `capturedAt`, and reports a `stale` verdict CONSISTENT with the `staleDays` it computed — and leaves the threshold itself to a unit test with an injected clock.
+
+`tests/unit/BenchmarkDivergenceAnalyzer.test.ts` gains that test: with a PRESENT mirror, `capturedAt + 30d` ⇒ `stale: false`, `capturedAt + 31d` ⇒ `stale: true`.
+
+No runtime behaviour changes — tests only.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+The shipped baseline `src/data/benchmarkPredictions.json` carries `capturedAt: 2026-07-24T01:20:00.000Z`; `mirrorStalenessMaxDays` defaults to 30. The assertion therefore passed for thirty days and turned RED at 2026-08-24T01:20Z on every branch simultaneously — main included — with no commit involved. Confirmed by running the e2e against `origin/main` at `9f83c19ca`: 1 failed, 4 passed, `expected { present: true, …(3) } to match object { present: true, stale: false }`. It blocked every merge, since `safe-merge` refuses on any red check.
+
+Both sides of the boundary are pinned deliberately: a change that made nothing ever stale would satisfy a one-sided test while deleting the signal. Negative control — with `staleDays > mirrorStalenessMaxDays` removed from `mirrorStatus()`, the new test fails (1 of 26); restored, 26/26. E2E 5/5.
+
+## Known Limits
+
+The shipped baseline IS now stale by the default threshold, so a fresh install correctly reports `stale: true`. That is the feature working and it is deliberately NOT papered over here — refreshing `capturedAt` to make a test green would fabricate a capture that never happened. Whether to ship a newer capture on a cadence is a release decision, named rather than taken.
+
+This fixes the one assertion found. No sweep was run for other tests whose verdict depends on wall-clock aging of a committed artifact, and none is claimed.

package/upgrades/mirror-staleness-is-not-an-aliveness-fact.eli16.md

@@ -0,0 +1,35 @@
+# A test that turned red at a specific minute, on every branch, with nobody touching anything — Plain-English Overview
+
+## The problem in one breath
+
+One end-to-end test checked that a reference file shipped inside instar was "not stale". That file was captured on 24 July, and the rule is that it goes stale after thirty days. So at **01:20 UTC today** — thirty-one days later — the test started failing everywhere at once. No commit caused it. The clock did.
+
+## Why that is worse than an ordinary failure
+
+Nothing in the code changed, so nothing in the code looks guilty. Every branch went red simultaneously, including the main one, which makes it read like an infrastructure outage rather than a test making a claim it had no business making.
+
+And it blocked everything: nothing could merge, because merges wait on a green build.
+
+## What the test was actually entitled to check
+
+That the feature is **wired up** — that the reference file is found when the server really boots, that it carries a capture date, and that the "is it stale?" answer it reports agrees with the age it worked out.
+
+What it was **not** entitled to check is whether that file happens to be under thirty days old on the day the test runs. That is a fact about how often we ship a fresh capture, not about whether the code works.
+
+## What changes
+
+The end-to-end test now checks the wiring and the internal consistency of the answer. The staleness rule itself moved to a test where the clock is a dial we set: at exactly thirty days it must report *not stale*, and at thirty-one it must report *stale*.
+
+Both sides are pinned deliberately. A "fix" that made nothing ever stale would have satisfied a one-sided test while quietly deleting the warning the feature exists to give.
+
+## The safeguard
+
+Checked against deliberately broken code: with the staleness rule removed, the new test fails. So it is a test, not a decoration.
+
+## One thing worth knowing separately
+
+The shipped reference capture really is more than thirty days old now. That means a fresh install will correctly report it as stale — which is the feature working, not breaking. Whether to ship a newer capture is a release-cadence decision, and it is deliberately not made here: silently refreshing the date would have hidden the same information this change exists to preserve.
+
+## What you actually need to decide
+
+Nothing about the test. Separately, and not urgently: whether the shipped reference capture should be refreshed on a cadence so installs do not inherit a stale one.

package/upgrades/side-effects/mirror-staleness-is-not-an-aliveness-fact.md

@@ -0,0 +1,78 @@
+# Side-Effects Review — an aliveness test stops asserting a fact about the calendar
+
+**Slug:** `mirror-staleness-is-not-an-aliveness-fact`
+**Date:** 2026-08-24
+**Risk floor:** 1 (tests only; no runtime file touched)
+
+## Summary of the change
+
+An e2e aliveness test asserted `mirror.stale === false` against a baseline shipped inside the package. The baseline's `capturedAt` is 2026-07-24T01:20Z and the staleness threshold defaults to 30 days, so the assertion turned red at 2026-08-24T01:20Z on every branch at once, main included, with no commit involved. The e2e now asserts the wiring (present, `capturedAt` set, `stale` consistent with `staleDays`); the threshold moves to a unit test with an injected clock, pinned on both sides.
+
+## Decision-point inventory
+
+None. No runtime decision changes; `mirrorStatus()` is untouched.
+
+## 1. Over-block
+
+None. The e2e can no longer fail for a reason unrelated to the code under test — which is the point, and is a REDUCTION in false red, not in coverage: the staleness rule is now checked more strictly than before (two points, controlled clock) rather than incidentally.
+
+## 2. Under-block
+
+Named honestly: the e2e no longer notices if the SHIPPED baseline ages out. That was never something it could report usefully — it could only say "red today, green yesterday, same code" — but the information is real and now has no automated home. It is recorded under Known Limits in the release fragment rather than silently dropped.
+
+## 3. Level-of-abstraction fit
+
+This is the whole finding. An aliveness test answers "is the feature wired on the production boot path?". Whether a shipped artifact is under thirty days old is a fact about release cadence and belongs where the clock is an input. Putting it in the e2e put a calendar dependency in a layer that cannot control the calendar.
+
+## 4. Signal vs authority compliance
+
+Not applicable — tests only, no runtime authority.
+
+## 4b. Judgment-point check
+
+None.
+
+## 5. Interactions
+
+- **`safe-merge`** refuses on any red check, so this single assertion blocked EVERY merge from 01:20Z. Two open PRs (#1967, and anything opened later) were stuck behind it. That is why the fix is worth doing now rather than filing.
+- **`mirrorStatus()`** is unchanged, so the `precondition-failed / stale-mirror` verdict path and the unit tests around it keep their existing behaviour.
+
+## 6. External surfaces
+
+None.
+
+## 6b. Operator-surface quality
+
+Improves it indirectly: the operator stops seeing a repo-wide red that no commit explains.
+
+## 7. Multi-machine posture
+
+`unified` — tests only, no per-machine state.
+
+## 8. Rollback cost
+
+Revert two test files. Reverting restores a build that goes red on a timer, so it should not be reverted quietly.
+
+## Conclusion
+
+Ship.
+
+## Phase-5 second pass
+
+**Not required, and not run** — no block/allow decision, no session lifecycle, no gate/sentinel/guard/watchdog, no runtime file touched. Stated explicitly so the section below is not mistaken for an independent reviewer's concurrence.
+
+## The finding that outlives the fix
+
+This is the second time today the same shape has appeared, in two unrelated subsystems: a correctness claim resting on wall-clock timing. This morning it was a thread id whose uniqueness came only from the millisecond (fixed in #1971). Tonight it is a test whose verdict came only from the date. Both fail without a commit, both look like flake, and both get *more* likely with time or speed rather than less.
+
+The tempting cheap fix here was to bump `capturedAt` in the shipped baseline. That would have made the suite green in one line and fabricated a capture that never happened — turning a true signal ("the shipped baseline is old") into a false one. Worth naming because it was the obvious move and it was wrong.
+
+## Evidence pointers
+
+- `origin/main` at `9f83c19ca`, e2e run locally: 1 failed / 4 passed, `expected { present: true, …(3) } to match object { present: true, stale: false }`. Main was red on the clock, not on a change.
+- `src/data/benchmarkPredictions.json` → `capturedAt: 2026-07-24T01:20:00.000Z`; age 31 days; `mirrorStalenessMaxDays` default 30 (`BenchmarkDivergenceAnalyzer.ts:110`).
+- Negative control: with the threshold comparison removed from `mirrorStatus()`, the new unit test fails (1/26). Restored: 26/26. E2E 5/5.
+
+## Class-Closure Declaration (display-only mirror)
+
+The class is "a test whose verdict depends on wall-clock aging of a committed artifact." Closed for this one assertion. NOT closed generally — no sweep was run for other date-sensitive assertions, and the sibling class named above (correctness resting on wall-clock timing, in runtime code as well as tests) is not swept for either. Named, not claimed.