instar 1.3.1211 → 1.3.1213

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1211",
+  "version": "1.3.1213",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-29T18:46:17.419Z",
-  "instarVersion": "1.3.1211",
+  "generatedAt": "2026-08-29T20:28:30.776Z",
+  "instarVersion": "1.3.1213",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9da7ed7098895409b67172589e374590e0eabe2f8cf2e8050a56eea3bddb9b5b",
+      "contentHash": "8f36cd4834156adfe6213f468ab78288a3a5c34d44045844ba8263515ea1db9a",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "8e859dea098bdf3ef3dad695be63e82507568fc5fab8d407372d898bf97f15ee",
+      "contentHash": "7a3633a568953a12f17d84a1973c4b27f29fcf2c465c59c8da32a0779422de35",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1211",
+  "packageVersion": "1.3.1213",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "3b0e2fb49532fc71ccad75e7d03da358c58350c06b743a3c7a71b1d47e29fdfe",
+  "sha256": "0511bc378e28f623a7f8670ca57f2563ae0c20396c88c436fd87507377ca87b9",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1211"
+  "packageVersion": "1.3.1213"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1211"
+  "packageVersion": "1.3.1213"
 }

package/upgrades/1.3.1212.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- New `src/core/WindowLifecycleObligationLedger.ts`: a content-dependent compiler (source-derived AST over the governing documents; a recite-from-memory shortcut fails when the source changes), per-duty evidence policies with honest authority levels (local-store presence is never promoted to authenticated), per-class executor-liveness predicates (`pending-executable` / `completed-one-shot` / `future-phase`), a signed per-run audit census with hash chain, exact-digest operator-only waivers with non-waivable core duties, and an audited Echo-local rollback.
+- `AgentServer`/`routes`: new authenticated `/window-lifecycle/*` routes (compile, evidence, evaluate, tick, transition, native admission, waiver, rollback, status), enforcement middleware over the session-creation, message-send, and completion-claim doors (typed 409 refusals when enforced), all registered in the `WriteDomainRegistry` and `CapabilityIndex`.
+- `SessionWatchdog`: real all-session inspection authority with durable machine-local HMAC (epoch + monotonic revision, restart-safe) so stall-cadence evidence cannot be forged or replayed.
+- `BetweenWindowAdmissionGate`: consumed unchanged behind a versioned adapter that persists exact inputs/outputs; its structural verdict is never dressed up as semantic proof.
+- Shared test infrastructure: `session-management-e2e` fixtures now use process-unique tmux/temp prefixes so concurrent checkouts' suites cannot delete each other's live fixtures.
+
+## What to Tell Your User
+
+This feature is scoped to the Echo development agent and ships dark: nothing changes on your install unless the ledger is explicitly compiled and graduated on that machine. For the operator it serves, the practical change is that governance-window claims ("opened", "closed", "report sent") stop being assertions and become checked states — a skipped duty now blocks or surfaces loudly instead of passing silently, and enforcement only turns on after a watch-only period proves it makes zero false calls.
+
+## Summary of New Capabilities
+
+- A new Echo-only enforcement plane compiles governance duties (history reads, verbatim recitations, plan updates, cadenced reports) from their source documents into a machine-checkable obligation ledger, and refuses window "open"/"closed" claims while any duty lacks real evidence.
+- Every duty carries an executor-liveness predicate: a duty that is registered but has nothing demonstrably running it becomes a loud `open-unexecuted` finding instead of silent non-execution.
+- The whole plane ships maturation-gated: `off | dry-run (default) | enforced`. In dry-run it records what it would have blocked; it can only graduate to real enforcement on server-derived evidence of zero false calls, and tampering with that evidence demotes it back to dry-run.
+
+## Evidence
+
+- 27 independent review-fix cycles to concurrence (cycle 22; re-confirmed at cycles 24 and 27 after integration corrections), recorded in the Window-28 build ledger with every rejection and disposition.
+- Complete `npm run test:all` exited 0 with zero failures (final E2E phase: 341 files passed / 1 skipped, 3,107 tests passed), including the two-lifecycle production AgentServer E2E (real admission → cadence → mid → close → post-live → closure census, plus graduation, forgery-rejection, and demotion paths) and a mandatory incident test reproducing the 2026-08-28 registered-duty-with-no-executor silence, asserting admission refuses with both predicate and executor reasons.
+- Spec `docs/specs/window-lifecycle-obligation-ledger.md` converged (3 iterations) and operator-approved 2026-08-28 09:32 PDT, with the approval quote recorded in the spec header; side-effects review with second-pass reviewer concurrence at `upgrades/side-effects/window-lifecycle-obligation-ledger.md`.

package/upgrades/1.3.1213.md

@@ -0,0 +1,45 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`PeerEndpointRecorder` gained invariant 2b: a non-empty peer advertisement that OMITS a
+rope kind no longer discards that kind when this machine's own rope-health record shows
+it currently alive. Retention requires positive evidence — a dead rope, a never-dialled
+rope, and an unreadable health source all keep the previous replace semantics, and an
+advertised kind always wins for its own kind. Wired from `meshResolver.snapshot()` in
+`server.ts`.
+
+Found live on 2026-08-29: a peer whose agent runs inside WSL can only see an unreachable
+virtual NIC, so it advertised `[lan]` alone, and the mesh discarded the working tailscale
+rope that was carrying its traffic at that moment.
+
+## What to Tell Your User
+
+If one of your machines runs its agent inside a nested environment (WSL, a container, a
+VM), it may not be able to see the address the other machines actually reach it on. When
+it announced the only address it *could* see, your other machines used to believe it and
+throw away the route that was working — leaving that machine unreachable with no way for
+it to correct the record.
+
+Now a route your machine can see carrying traffic is kept even when an announcement
+forgets to mention it. A route that has genuinely gone dead is still dropped, so nothing
+lingers forever.
+
+## Summary of New Capabilities
+
+- A peer's shorter address list can no longer delete a route this machine can see working.
+- Retention is evidence-based: only a rope the local health record reports alive is kept;
+  dead and never-dialled ropes are dropped exactly as before.
+- Fully reversible — with no health source wired the behaviour is byte-identical to the
+  previous replace semantics.
+
+## Evidence
+
+- Unit: `tests/unit/PeerEndpointRecorder.test.ts` (+8 cases), verified red-then-green
+  against pre-2b behaviour.
+- Integration: `tests/integration/mesh-endpoint-propagation.test.ts` (+2 cases) driving
+  the real `/api/lease` route with a real registry.
+- Side-effects review: `upgrades/side-effects/mesh-endpoint-degradation-retention.md`.

package/upgrades/side-effects/mesh-endpoint-degradation-retention.md

@@ -0,0 +1,106 @@
+# Side-effects review — mesh endpoint degradation retention (invariant 2b)
+
+**Change:** `PeerEndpointRecorder.record()` no longer lets a non-empty but DEGRADED peer
+advertisement discard a rope this machine's own health record currently shows alive.
+Wired in `server.ts` from `meshResolver.snapshot()`.
+
+**Origin (live incident, 2026-08-29, topic 62395):** a peer whose agent runs inside WSL
+can only see an unreachable virtual NIC (`eth0 172.22.96.135`); Tailscale lives on the
+Windows host, outside that VM. It advertised `[lan]` alone; the recorder replaced
+`[tailscale, lan]`, and the mesh lost its only working route to that machine — while the
+tailscale rope was verifiably carrying traffic at that moment (peer answered
+`/health` 200 and a signed mesh probe returned the typed `not-router` refusal).
+
+## 1. Over-block — what legitimate input does this now reject?
+
+None: the change never rejects an advertisement. Every advertised kind is still recorded
+verbatim and still wins for its own kind (covered by the "re-advertising a kind with a new
+url still wins" and "advertised kind actually changed" tests). The only behavioural delta
+is ADDITIVE retention of an omitted kind.
+
+The nearest thing to an over-block is over-RETENTION: keeping a rope the peer meant to
+retire. Bounded three ways — retention requires a positive `alive === true`; `false` and
+`undefined` (never dialled) both drop; and the resolver remains the dial-time authority,
+so a retained rope that stops working is marked dead and then dropped on the next
+degraded advertisement.
+
+## 2. Under-block — what does this still miss?
+
+It does NOT help when the proven rope is ALSO not currently alive in the health record at
+the moment the degraded advertisement lands (a machine that reboots into WSL-only
+visibility while its tailscale rope happens to be marked dead). That case needs the
+peer to be able to advertise an address it cannot locally see, which is the separate
+NAT'd-machine work — tracked, not deferred silently:
+<!-- tracked: CMT-211 -->
+
+It also does not fix the root cause for that machine: a WSL-hosted agent still cannot
+discover its own reachable address. This change stops the DATA LOSS, not the blindness.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. `PeerEndpointRecorder` is the documented single chokepoint for "I just
+learned a peer's ropes" and already owns invariants 1–5, including the sibling
+absence-is-never-a-wipe rule. Invariant 2b is the same class of protection (an
+advertisement must not destroy knowledge) and belongs beside it, not in the two
+callsites. Nothing lower (the validator) knows current state; nothing higher (the routes)
+should own merge policy.
+
+## 4. Signal vs authority compliance
+
+Compliant. The recorder produces/persists a SIGNAL (the known endpoint set); it holds no
+blocking authority. `PeerEndpointResolver` remains the dial-time authority and already
+deprioritises-but-probes dead ropes, so a retained-but-stale endpoint cannot block or
+misroute anything — it can only be tried last. The new dep is a read-only evidence
+source; an exception from it is caught and degrades to the previous behaviour.
+
+## 5. Interactions
+
+- **Invariant 4 (idempotency):** preserved and explicitly tested — when the merged set
+  equals what is stored (the common steady-state case), the write is still skipped, so
+  this does not reintroduce the ~720 no-op rewrites/day the idempotency guard removed.
+- **Invariant 2 (absence):** untouched; the empty/invalid path returns before the merge.
+- **Invariant 5 (advisory):** untouched; only the peer's own entry is written.
+- **`MeshEndpointValidator` cap:** the merge appends retained entries AFTER validation of
+  the advertised set. A peer at the kind cap cannot exceed it, because retention only
+  adds kinds the advertisement did NOT name and there are three kinds total.
+- **No double-fire / no race added:** the merge is pure and synchronous inside the
+  existing single write path.
+
+## 6. External surfaces
+
+No route, config key, schema, or user-visible surface changes. `GET /health →
+multiMachine.syncStatus` and `GET /pool` may now show a peer retaining a rope kind they
+would previously have lost — which is the intended correction. Timing dependence is
+limited to reading a live snapshot, and the failure mode of that read is explicitly
+"no evidence ⇒ previous behaviour".
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN.** The retention decision is made from the RECEIVING machine's
+own rope-health record and written only into its own registry copy. This is deliberate
+and load-bearing: rope health is inherently per-observer (machine A's tailscale rope to C
+can be alive while B's is dead), so replicating the decision would let one machine's view
+overwrite another's ground truth. Each machine independently reaches the correct answer
+from its own evidence. No replication path is added and none is wanted. A single-machine
+agent has no peers and is a strict no-op.
+
+## 8. Rollback cost
+
+Trivial and total. Remove the `isEndpointAlive` dep from the `server.ts` construction and
+the recorder falls back — by an explicitly-tested path ("with NO health dep wired,
+behaviour is byte-identical to plain replace") — to the exact pre-change semantics. No
+data migration: the registry format is unchanged, and a retained endpoint is an ordinary
+entry the next advertisement can overwrite. No agent state repair.
+
+## Tests
+
+- Unit (`tests/unit/PeerEndpointRecorder.test.ts`, +8): retain-on-alive, drop-on-dead,
+  drop-on-no-evidence, drop-on-throw, advertised-kind-upgrade-wins, idempotent-merge,
+  no-dep-is-identical. Verified RED against pre-2b behaviour (3 failures for the right
+  reason: the retention cases) and GREEN after.
+- Integration (`tests/integration/mesh-endpoint-propagation.test.ts`, +2): the real
+  `/api/lease` route with a real registry — a degraded advertisement keeps a live rope,
+  and still drops a dead one.
+- E2E: not applicable — no new API route or feature-liveness surface; the change is a
+  merge rule inside an existing chokepoint already covered end-to-end by the integration
+  route test.