instar 1.3.12 → 1.3.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.12",
+  "version": "1.3.13",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-27T05:27:08.240Z",
-  "instarVersion": "1.3.12",
+  "generatedAt": "2026-05-27T06:03:48.163Z",
+  "instarVersion": "1.3.13",
   "entryCount": 192,
   "entries": {
     "hook:session-start": {
@@ -401,7 +401,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -409,7 +409,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -417,7 +417,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -425,7 +425,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -433,7 +433,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -441,7 +441,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -449,7 +449,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -457,7 +457,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -465,7 +465,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -473,7 +473,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -481,7 +481,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -489,7 +489,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -497,7 +497,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -505,7 +505,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -513,7 +513,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -521,7 +521,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -529,7 +529,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -537,7 +537,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -545,7 +545,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -553,7 +553,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -561,7 +561,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -569,7 +569,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -577,7 +577,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -585,7 +585,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -593,7 +593,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -601,7 +601,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -609,7 +609,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -617,7 +617,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -625,7 +625,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -633,7 +633,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -641,7 +641,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -649,7 +649,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -657,7 +657,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -665,7 +665,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -673,7 +673,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -681,7 +681,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -689,7 +689,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -697,7 +697,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -705,7 +705,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -713,7 +713,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -721,7 +721,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -729,7 +729,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -737,7 +737,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -753,7 +753,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "768d0dfd6edc7bfa93f3a33e271607a5a4264183c43204900480b84cb9a4e294",
+      "contentHash": "e866bbf04ea3077fceeb8cc7b6860d869579d002da7a06889f4a6781ee149a79",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1449,7 +1449,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "e30d4746e66b84e1608cd372b9d6f54395ad0e466d740a536a9b3a2f039f4081",
+      "contentHash": "75aaa59ade72e28362b53041b5e0e90958740f8d15174381d52f7ff97cd5561e",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.13.md

@@ -0,0 +1,37 @@
+# Instar Upgrade Guide — NEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Framework-Onboarding Mentor System — live-readiness hardening.** Closes the three things the
+§19.4 reviewer flagged as must-haves before the mentor can ever be promoted to `live`: the tick is
+now fire-and-forget (a slow helper-spawn can't hang the request — the result lands in
+`/mentor/status`); the helper-spawn now kills its session and bails cleanly if it overruns (no
+orphaned panes, no half-read transcripts); and `live` mode now has a real, safe delivery path — it
+appends the message to a durable per-mentee outbox the mentee's running session picks up, instead of
+spawning a fresh counterpart session (the structural fix for the agent-to-agent message loop). Still
+dormant by default.
+
+## What to Tell Your User
+
+- The mentor's plumbing is now safe to switch on without it hanging or leaking sessions, and when it
+  eventually talks to the mentee it does so the calm way (drop a note in their inbox, no spawning).
+- Nothing's changed day-to-day; it's still off until you turn it on, and turning it fully live is
+  still gated behind your sign-off.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Async mentor tick | `POST /mentor/tick` returns 202; outcome in `GET /mentor/status`.lastResult |
+| Persist-only delivery | live mode appends to `server-data/mentor-outbox/<framework>.jsonl` (never spawns) |
+
+## Evidence
+
+Net-new hardening of a dormant feature, not a bug fix — no prior production failure. Proven by tests:
+the delivery path is asserted to fire **only in live mode and never in dry-run** (and to no-op safely
+when unwired); the async tick is asserted to return 202 with the result landing in `status.lastResult`
+and the in-flight guard preventing overlap; the spawn-kill-on-timeout path throws after killing the
+session so the tick captures a clean failure rather than a partial transcript. 27 mentor tests +
+route-completeness/discoverability gates; affected push-config suite green (745) vs canonical main.

package/upgrades/side-effects/mentor-live-readiness.md

@@ -0,0 +1,63 @@
+# Side-Effects Review — Mentor live-readiness (§19.4 follow-on)
+
+**Spec:** `docs/specs/FRAMEWORK-ONBOARDING-MENTOR-SPEC.md` (converged 5 iters, approved by Justin)
+**Change:** Closes the three live-promotion blockers the §19.4 Phase-5 reviewer flagged, so the
+mentor can be promoted toward `live` safely: (1) **async tick** — `POST /mentor/tick` is now
+fire-and-forget (202) with the result in `GET /mentor/status`.lastResult, so a slow Stage-A spawn
+can't hang the request; (2) **spawn-kill-on-timeout** — `spawnStageA` kills the session and throws
+on poll exhaustion (no orphaned tmux pane, no partial transcript); (3) **persist-only delivery** —
+`live` mode delivers the Stage-A message by appending to a durable per-mentee outbox, never via
+`threadline_send`/spawn (the structural fix for the cross-agent spawn loop).
+**Files:** `src/scheduler/MentorOnboardingTick.ts`, `src/scheduler/MentorOnboardingRunner.ts`,
+`src/server/routes.ts`, `src/server/AgentServer.ts`, the three mentor test files, `upgrades/NEXT.md`.
+
+## Principle check (Phase 1)
+
+Decision point? Same as §19.4 — signal-only loop. The new delivery path is the only outbound
+action, and it is **persist-only** (queue append), gated to `live` mode, and structurally cannot
+spawn a counterpart session. Still ships dormant (`mentor.enabled=false`).
+
+## The seven questions
+
+1. **Over-block.** Async tick returns 202 even if a tick is in-flight (`accepted:false, reason:
+   in-flight`) — correct (no overlapping ticks). No legitimate action blocked.
+2. **Under-block.** Spawn-kill-on-timeout closes the orphan/partial-transcript gap. Delivery is
+   persist-only — it queues; whether the mentee's session ingests the outbox is the mentee's side,
+   validated at the live step. The outbox write is best-effort (never throws) so a delivery failure
+   can't crash a tick — a dropped message is preferable to a crashed loop while dormant/dry-run.
+3. **Level-of-abstraction fit.** Async state lives on the runner (`inFlight` + `lastResult`); the
+   route is a thin 202 trigger. Delivery is an injected service (pure tick stays I/O-free; the
+   AgentServer impl is the only thing that touches disk). Correct layering.
+4. **Signal vs authority.** Compliant. Delivery is the loop's only outbound effect, persist-only,
+   live-gated. No component is gated/killed/blocked. The tick still has no authority over the user.
+5. **Interactions.** `killSession` on timeout reuses the existing SessionManager kill path. The
+   outbox is a new dedicated dir (`server-data/mentor-outbox/`), isolated from the ledger and other
+   stores. The in-flight guard prevents the heartbeat job from stacking ticks.
+6. **External surfaces.** `POST /mentor/tick` now returns 202 (was 200 with the result) for the
+   enabled case; disabled still returns 200 `{ran:false,reason:disabled}`. `GET /mentor/status` gains
+   `inFlight` + `lastResult`. The outbox is a local file, not an external call. Still Bearer-gated.
+7. **Rollback cost.** Low. Dormant; revert restores the synchronous tick. The outbox dir is harmless
+   queued data.
+
+## Phase 5 — second-pass
+
+The §19.4 live loop already carried a dedicated second-pass (concur, 0 blocking). This PR
+*implements that reviewer's three flagged fixes verbatim* (async tick, kill-on-timeout, persist-only
+delivery), so it closes their concerns rather than introducing new decision surface. Self-reviewed
+against their notes; no new spawning/gating logic beyond the persist-only outbox (which is the
+spawn-loop-safe shape they recommended).
+
+## Remaining before `live`
+
+`dailySpendCapUsd` is still a run-count cap (`maxRoundsPerDay`, a real hard spend bound) rather than
+dollar accounting — tracked (<!-- tracked: topic-13435 -->). Deep Stage-B forensics + surface
+assembly land in the next PR. End-to-end mentee ingestion of the outbox is validated at the live
+step (test-as-self), which remains Justin's sign-off per the off→dry-run→live track.
+
+## Testing
+
+- Tier 1 (unit, +3 tick): delivery in live-only / not dry-run / safe-when-unwired; (+2 runner):
+  startTick fire-and-forget 202 + result lands in status; disabled short-circuit.
+- Tier 2 (integration): `/mentor/tick` 202-when-enabled + status.lastResult; disabled 200.
+- Tier 3 (e2e): unchanged — dormant on the production path.
+- route-completeness + discoverability gates pass; affected push-config suite green (745) vs main.