instar 1.3.1213 → 1.3.1214

package/upgrades/side-effects/w29-ledger-selfaction-model.md

@@ -0,0 +1,39 @@
+# Side-Effects Review — window-lifecycle self-action convergence model
+
+**Slug:** w29-ledger-selfaction-model · **Date:** 2026-08-29 · **Author:** Codey (W29 Lane C2), commit ritual by Echo/Observer 1 · **Tier:** 1 (test infrastructure, 40 LOC)
+
+## Summary
+Registers the WindowLifecycleObligationLedger's owned 60s notify tick in `src/testing/selfActionRegistry.ts` (a faithful convergence model of its save-before-send dedupe brake) plus the `@self-action-controller` annotation at the real emit site in `src/server/routes.ts`. Closes the ACT-320 closure:gap declared at the W28 merge.
+
+## 1. Over-block
+None — the change blocks nothing; it is a registry entry + comment. The ratchet could over-fail future edits to the real brake; that is its purpose.
+
+## 2. Under-block
+The model covers the dedupe-brake class only (one issue → one emit, restart-surviving). It does not model the tick's other behaviors (evaluation cost, remediation flows) — those are not self-action emits.
+
+## 3. Level-of-abstraction fit
+Matches the established registry pattern (30th entry, same shape as the other 29): modeled trigger→brake→emit under the pinned PressureFixture. No new mechanism.
+
+## 4. Signal vs authority compliance
+No decision authority anywhere — pure test infrastructure. The ratchet is CI signal.
+
+## 5. Interactions
+The forcing lint (`lint-no-unregistered-self-action`) stops flagging this emit (verified); no other check consumes the registry entry. No double-fire risk — the annotation is a comment.
+
+## 6. External surfaces
+None. No runtime behavior, routes, or messaging changes.
+
+## 7. Multi-machine posture
+Not applicable — test-only code; the modeled controller itself is Echo-local by the W28 spec's non-leakage rule.
+
+## 8. Rollback cost
+Revert the commit; the lint returns to report-only flagging of the emit. No data or state involved.
+
+## Fidelity verification (the load-bearing check)
+The model records the issue into durable state BEFORE emitting, mirroring `routes.ts` where `ledger.surfacedIssues.push(...)` + `windowStore.save(...)` precede the async `sendToTopic` (verified at the shipped lines during this review). Ratchet: 141/141 including the new entry's bounded-emission and restart cases.
+
+## Review record
+Lane C2 (codex): 1 review cycle, clean, stop conditions declared before cycle 1, last-material-defect cycle 0 (none found). Observer independently verified fidelity + gates at commit time.
+
+## Conclusion
+Clear to ship.

package/upgrades/w29-ledger-selfaction-model.eli16.md

@@ -0,0 +1,7 @@
+# ELI16 — proving the rulebook engine's messenger can't spam
+
+The window-rulebook engine that shipped this week has a background loop that checks, every minute, whether any window duty is being violated — and when it finds a new problem, it sends one notice to the observers' channel. A loop that sends messages on its own is exactly the kind of thing that has caused message floods before, so this repo keeps a registry of every such self-acting loop, each paired with a small simulated model of its braking logic. A test then squeezes every model under sustained worst-case pressure — the problem never goes away, the process restarts mid-stream — and proves the loop settles at a bounded number of actions instead of firing forever.
+
+The engine's loop was shipped with its brake in the code (it durably records each issue BEFORE sending, so the same issue can never send twice — even across a restart) but WITHOUT its entry in that registry, which was tracked as a follow-up with a deadline. This change pays that debt: it adds the faithful model of the engine's brake to the registry (the model was checked line-against-line with the real code: record-first, then send), plus the one-line annotation at the real send site that links code and registry. The pressure test now covers it — 141 checks pass, including the new ones proving one problem yields exactly one notice, forever, restart included.
+
+Nothing about the engine's behavior changes. This is test infrastructure: the safety net under the engine's messenger, not the messenger itself. If someone later edits the engine's brake and breaks it, the registry test is now the tripwire that catches it before it ships.