instar 1.3.1221 → 1.3.1222

package/src/data/codexStageBReleaseEvidence.ts

@@ -7,10 +7,12 @@ export const SHIPPED_CODEX_STAGE_B_RELEASE_EVIDENCE: unknown = {
   "echoPublicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAVfPs10C+igEwHX1QKxkuGv57xUnfEmLygjW+9comCtg=\n-----END PUBLIC KEY-----\n",
   "artifact": {
     "schemaVersion": 1,
+    "packageVersion": "1.3.1220",
+    "gitCommit": "cfe468dc5ef3f31ac71c28aed6bdc28a26131f49",
     "configSha256": "018d8e91978755abfb021968781d805098d98f9f2c64d70b728d2c18b205d5e8",
     "echoMachineId": "m_03b30f5b32c6ef3eb0afd3ca7054e252",
-    "startedAt": 1788251493809,
-    "endedAt": 1788259530838,
+    "startedAt": 1788576017942,
+    "endedAt": 1788583231083,
     "deliveryCount": 50,
     "caseCounts": {
       "identical": 2,
@@ -28,17 +30,16 @@ export const SHIPPED_CODEX_STAGE_B_RELEASE_EVIDENCE: unknown = {
       "staleOwnerAction": 0
     },
     "rawEvidenceDigests": [
-      "ded4deaeb0c09f3911de5aa7086f4114d4e22b356605ff2669e655cde2e72891",
-      "cc3484e4f834bd1e496123602322aea8950d44e2172878bac550b0a24e3726c2",
-      "f11d401fcba94261f468b9c96a711b9955d59fd0d8b8c97494d8dd5bef96081a",
-      "7ed4a2576c2547d930b8efb83ea55f732c466d9e7c330c98a502edc5bb5e960a",
-      "d35c349bd787b7df74b467f1dd959ffd7cffa0075f1d38632d9dec23d2c3f4c4",
-      "74b92e819f106582fe6c3c96fe118a2d890d2ff7c625cd4404b9e68732322349",
-      "7dac92dbcd6b7f628f3f7ce22020283754c3fb527e39c3d600cb61f12474c491"
+      "8f451873786a8e7c48e64535d72d78d2e97cdae0f4287abcae3bc8b646195bb9",
+      "f2d07ef4046e49fed158732d90b5d0105f585ca2fa13732ac6d0e9a238b357c0",
+      "b7dda84ce9e43178c2fb84bdcd2e5c3ed30cf277067e7f415cdebbd8588f864e",
+      "37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570",
+      "263e662820f478f2a160a8cf5eb96086dc1442ee5fd18329b32c1ea2248fb569",
+      "f360834ee52fc22702d630d92ced062f2b8d9b83dd896ced22647de3234ae2ad",
+      "1b94aa70b163015ab1d4a10f0d170790ad73aa1fd241cb6a828191052b3628a1",
+      "9fcf5e1558ec0b700dabce0fcc93638683d9b211cb09cd15190bf984e9ef92c7"
     ],
     "reviewerDecision": "approved",
-    "packageVersion": "1.3.1219",
-    "gitCommit": "package:1.3.1219",
-    "signature": "Ga8TIYdLoFz3FYKM56NTCjgPlQtSMYJ8lrkKqn0nlrhzsf9zLiZ9DzEkLBMPrVuqWOUbhqnUmU0CuNt2CVFlAw=="
+    "signature": "9CmBo9oVesfP8Kpi94L/paiK+9vNQskTVoY16450HwnsA3AYDjXpiv+Nwkf0vm4ltnEXdeoDhUMOS80npoWwDw=="
   }
 };

package/src/data/stageBCertifiedSet.ts

@@ -348,20 +348,20 @@ export const STAGE_B_CERTIFIED_SET = {
       "reason": "LLM-provider plumbing reached through a dynamic import in a certified module; shared across every internal LLM feature and certified by its own suites — binding it would re-freeze releases on unrelated provider churn"
     }
   ],
-  "fingerprint": "6aafe889d2bf5e21aeb821348fdbc593e0ca34282de706d53a5eb44cd848ea4b",
-  "artifactDigest": "7499d16a6ab0b986757121c3d1b3f97f93f7204d341e0a07aaecb360863c75eb",
+  "fingerprint": "f1aacb47b41db1f9385f30b67cd53dfe1febac2ea1e555dbd61f5002ac55512f",
+  "artifactDigest": "a2db23a95530681953ffa3002ab14e349ebf53d19be2a54c1f4afacc3aead997",
   "fileHashes": {
     "src/core/CodexComposerAdapter.ts": "8d4753c45f317092f3d1e8d6e5a73a875dbf046cbac20066220fa036b4f0e065",
-    "src/core/CodexDeliveryObserver.ts": "7de40edfd2f64adfcef9e18bf6191acb4bdeb294886f0369895b948e1be345dd",
+    "src/core/CodexDeliveryObserver.ts": "0d70e29ef427af8ceda05a2434858639b48f120edc3490a439c90c26ab450fe3",
     "src/core/CodexLifecycleProductionComposition.ts": "a94897fbd317af61c5ea8d09da7484b2799b985ef44af2e2cc304f769fff62a4",
-    "src/core/InboundDeliveryStore.ts": "93009f9b2cc2c4ee2124c09e8fe3f8ac30edf17b033c13864ff61b0e14ea0e88",
+    "src/core/InboundDeliveryStore.ts": "9a20293ef6cf10938718e64cae357d51c14605b17631d13c0001cb4710c1c9b2",
     "src/core/SessionRecoveryChannel.ts": "d38b8ebc6d073008ae2d9f9109a254019813499d5d327a3ff00e4b2a72272b65",
     "src/core/SessionRecoveryConsumer.ts": "6a00ca4993d188f1c95eaa7d156795804f00f7e10e600ea12fa2e8cd40423268",
     "src/core/StageBStartupReadiness.ts": "92275608368d44abc98802f9a445acc6419fd57bddb8c2e4935f32961d401183"
   },
-  "boundAt": "2026-09-04",
-  "boundBy": "echo (operator-approved rebinding, topic 52075, 2026-09-03)",
-  "note": "Initial binding: certified sources verified byte-identical to the evidence commit (git diff 92a21075d..1b46533a7 over the certified set is empty), so the approved 2026-08-31 canary evidence remains the honest witness."
+  "boundAt": "2026-09-05",
+  "boundBy": "echo (fresh exact-candidate certification, topic 59199, 2026-09-04)",
+  "note": "Fresh binding after the first candidate correctly failed closed on three busy-session false-unknown outcomes. Candidate cfe468dc5 then passed 50/50 deliveries over 7,213,141 ms, the full required case matrix, 30/30 responsiveness samples, and zero forbidden outcomes; its signed evidence digest is bound here."
 } as const;
 
 export type StageBCertifiedSet = typeof STAGE_B_CERTIFIED_SET;

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1221",
+  "packageVersion": "1.3.1222",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "5fa578c9e59c4db0835d48d02776497a23b3fbc74c2f0048192dd5ad9da9c679",
+  "sha256": "ddcd09ee7e0ee06c58100010dd6febb3f6916ea8cccf7a68a04bd24f55905f6f",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1221"
+  "packageVersion": "1.3.1222"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1221"
+  "packageVersion": "1.3.1222"
 }

package/src/scaffold/templates.ts

@@ -1729,7 +1729,7 @@ instar test-as-self --slack                          # Slack permission demonstr
 
 Progress monitoring must not manufacture user-facing narration. These systems are signals, never gates, and every error path fails toward silence.
 - **Silent-freeze watchdog** (ActiveWorkSilenceSentinel): before claiming a session is stuck, it re-captures the LIVE frame and corroborates — if the frame still shows an active-work indicator (spinner / "esc to interrupt"), a sub-agent is live, or it's a clean idle prompt, it stays SILENT. It speaks only when genuinely wedged, and even then hedges ("…hasn't changed in N min and a nudge didn't wake it — it may be stuck, or on a long task I can't see into. Want me to check?"). Threshold raised 15m→30m; a 90m frozen-indicator backstop still surfaces a real mid-tool hang. Tune/disable: \`monitoring.activeWorkSilenceSentinel.enabled\` (off), \`.silenceThresholdMs\` (default 30m), \`.activeWorkMaxFrozenIndicatorMs\` (default 90m).
-- **Command-watchdog attribution:** \`SessionWatchdog\` never interrupts the Codex framework host or known bounded external waiters (including safe-merge and GitHub watch commands). If it interrupts a genuinely stuck user command, its audit entry names \`principal: session-watchdog\` and \`operatorInitiated: false\`; Codex's generic "aborted by user" text is transport wording, not proof the operator acted. Continuation is owned by the canonical continuation/recovery funnel, never an independent watchdog prompt.
+- **Command-watchdog attribution:** \`SessionWatchdog\` never interrupts the Codex framework host, known bounded external waiters, or pinned long-lived test/compiler services such as Vitest's esbuild service. A selected descendant is signaled directly only after an action-time PID/parent/argv identity check; the watchdog never sends pane-wide Ctrl+C for a descendant helper. If it interrupts a genuinely stuck user command, its audit entry names \`principal: session-watchdog\` and \`operatorInitiated: false\`; Codex's generic "aborted by user" text is transport wording, not proof the operator acted. Continuation is owned by the canonical continuation/recovery funnel, never an independent watchdog prompt.
 - **Crash-safe inbound delivery:** Normal tmux injection and Codex stranded-draft key attempts use FULL-durable armed/started/terminal phases. A crash-open mutation becomes \`effect-unknown\` and is never blindly repeated. Diagnose privacy-safe counts at \`GET /sessions/inbound-delivery-status\`; no message body is exposed.
 - **PromiseBeacon is internal by default:** commitment cadence, detection, revival, and escalation bookkeeping continue, but PromiseBeacon produces no topic/Slack messages, close-outs, escalation statuses, or Attention items. User output requires an explicit deployment opt-in with \`promiseBeacon.userOutputEnabled: true\`; do not enable it merely to retain follow-through. Effectiveness remains measurable in \`logs/sentinel-events.jsonl\` and the per-feature LLM-metrics surface (feature keys \`active-work-silence\`, \`promise-beacon\`).
 

package/upgrades/1.3.1222.md

@@ -0,0 +1,72 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The session watchdog now recognizes Vitest's long-lived esbuild service as
+framework infrastructure and excludes it before stuck-command judgment. If a
+genuine descendant process must be stopped, the watchdog revalidates the exact
+process identity and session incarnation immediately before signaling that
+process, then escalates through bounded targeted signals instead of sending a
+pane-wide interrupt that can collapse the surrounding Codex turn.
+
+Codex session discovery now uses the maintained state cache on asynchronous
+control-plane paths, and quiet Codex panes are not synchronously probed unless
+there is evidence of a stranded draft. This keeps test execution from starving
+health and Telegram handling. Recovery notices also state their actual queue
+reason so operators can distinguish a queued continuation from a delivered
+one.
+
+Inbound deliveries whose physical effect cannot be proven after bounded
+observation now enter an explicit terminal effect-unknown state. They remain
+auditable without occupying live-capacity slots forever, preventing an
+ambiguous historical backlog from blocking new Telegram messages.
+
+The release canary also found a second observer defect under real load: when a
+busy Codex transcript grew by more than one read budget, a read ending partway
+through the next JSONL record discarded the valid complete prefix as unknown.
+The observer now durably advances through the last complete record and re-reads
+the partial tail on its next bounded sweep. Truly oversized single records,
+malformed JSON, schema drift, and identity mismatches still fail closed.
+
+## What to Tell Your User
+
+Long-running Codex test work is protected from false watchdog interruptions,
+and the agent's health and messaging paths remain responsive while those tests
+run. Ambiguous old deliveries remain visible for investigation but no longer
+crowd new messages out of the live queue.
+
+## Summary of New Capabilities
+
+- Automatic protection for the exact Vitest esbuild service process.
+- Process-targeted watchdog remediation with action-time identity checks.
+- Responsive cached session discovery on asynchronous control-plane paths.
+- An explicit terminal state for deliveries whose physical effect is unknown.
+- Multi-pass observation of valid busy-session transcript backlogs without
+  false unknown outcomes at non-aligned byte boundaries.
+- Clear queue-reason wording in Codex recovery notices.
+
+## Evidence
+
+On topic 67366, the watchdog audit and live process tree showed the watchdog
+selecting Vitest's persistent esbuild service and then issuing a pane-wide
+interrupt; the surrounding test run collapsed while the local health endpoint
+also stopped responding and Telegram retried the inbound message. The repaired
+candidate's focused unit, HTTP integration, and production-lifecycle E2E gates
+all pass, including a real long-running Vitest worker whose esbuild service
+survives unchanged while the lifecycle suite completes. A backed-up copy of the
+live inbound ledger contained 496 ambiguous rows consuming capacity; applying
+the new terminal transition reduced the live count to four while retaining the
+rows for audit, and normal inbound dispatch resumed.
+
+The first exact-candidate two-hour/50-delivery canary correctly refused to sign
+after finding three false unknowns on unrelated busy sessions. Their transcript
+records proved the messages and responses existed beyond a non-aligned 256 KiB
+scan boundary. The corrected scanner has unit, integration, and production-wired
+E2E coverage for that exact multi-budget shape. The fresh corrected candidate
+then passed 50/50 deliveries over 7,213,141 ms, all required special cases,
+30/30 responsiveness samples, and zero false-unknown, exhaustion, duplicate
+ownership, lost-input, or stale-owner outcomes. Echo signed the resulting
+evidence and the certified source manifest binds its exact digest and bytes.

package/upgrades/inbound-delivery-unknown-terminalization.eli16.md

@@ -0,0 +1,36 @@
+# Inbound Delivery Capacity Recovery — Plain-English Overview
+
+> The one-line version: delivery attempts whose observation window ended uncertain must stop occupying the finite live-message queue.
+
+## The problem in one breath
+
+Instar safely refused to guess whether hundreds of older injected messages were consumed, marking them “unknown.” However, it left their transport state as “dispatched,” and the admission counter treats every dispatched row as live. Once 500 such rows accumulated, every new Telegram message was rejected with “Message could not be delivered to the session.”
+
+## What already exists
+
+- **Durable inbound journal** — records each physical terminal injection before it happens so crashes cannot silently replay uncertain effects.
+- **Codex delivery observer** — watches the composer and rollout transcript until it proves consumption/response or reaches a fixed observation deadline.
+- **Admission ceilings** — prevent an unbounded number of live rows or bytes from exhausting the server.
+- **Terminal evidence retention** — keeps consumed, failed, and effect-unknown evidence for audit, then garbage-collects it under bounded age/count rules.
+
+## What this adds
+
+When the observer reaches its deadline without proof, the existing `markObservationUnknown` transition now records `effect-unknown` as the transport state as well as unknown transcript/composer eligibility. This does not claim that the message succeeded or failed. It only makes the already non-replayable uncertainty terminal, allowing the admission counter to release its slot while retaining the evidence for audit.
+
+The status projection now reports these records as `effect-unknown` before considering their eligibility label, so uncertain-effect metrics remain honest. A regression test fills a one-row admission capacity, terminalizes the uncertain observation, verifies capacity returns, and verifies that a subsequent message can be prepared.
+
+## The safeguards
+
+**No automatic replay.** Effect-unknown is explicitly non-replayable, preserving the core no-duplicate guarantee.
+
+**No evidence deletion.** Rows are retained under the existing terminal evidence policy. This change is a state transition, not data erasure.
+
+**Bounded authority.** Only dispatched rows that the observer already selected after its observation deadline can take this transition. Prepared or actively observed rows are untouched.
+
+## What ships when
+
+The transition and status correction ship together. Existing stale rows on this machine are migrated with the identical narrow predicate after a complete SQLite backup; future rows self-terminalize through the observer.
+
+## What you actually need to decide
+
+Should expired, already-uncertain delivery evidence become terminal so it cannot permanently block new Telegram messages?

package/upgrades/side-effects/codex-observer-bounded-backlog.md

@@ -0,0 +1,84 @@
+# Side-Effects Review — Codex observer bounded backlog
+
+**Version / slug:** `codex-observer-bounded-backlog`
+**Date:** `2026-09-04`
+**Author:** Codex
+**Second-pass reviewer:** independent Codex reviewer
+
+## Summary of the change
+
+The Codex delivery observer now advances every complete JSONL prefix inside its bounded read even when the byte budget ends partway through the next record. The incomplete tail is left unread and starts the next sweep. A single record with no newline inside the full budget remains typed `unknown`.
+
+This was found by the exact-candidate Stage-B canary: all 50 dedicated rows converged, but three real messages in busy sessions generated more than 256 KiB between sweeps. The old scanner marked the entire valid backlog unknown solely because byte 262,144 was not a newline, even though hundreds of complete record boundaries preceded it. Transcript inspection proved the injected user events and assistant responses were present.
+
+## Decision-point inventory
+
+- `scanSharedRollout` — modify — advances only through the last complete newline in a bounded read.
+- `scanRollout` — modify — applies the same prefix rule to the compatibility scanner.
+
+## 1. Over-block
+
+No new block is introduced. A record larger than the entire per-row budget still has no complete boundary and remains unknown; schema drift and malformed complete JSON remain unknown.
+
+## 2. Under-block
+
+An incomplete tail is not parsed or trusted. It is re-read from its exact first byte on the next sweep. The cursor advances only to a verified newline, so no partial JSON can be skipped or treated as evidence.
+
+## 3. Level-of-abstraction fit
+
+This is byte-framing behavior in the JSONL scanner, the layer that owns cursor advancement. It does not change delivery authority, replay policy, or message interpretation.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md).
+
+- [x] No — this change has no block/allow judgment surface.
+
+No new judgment is added. A complete newline is structural framing evidence; absence of any boundary at the hard budget remains the conservative uncertainty floor.
+
+## 4b. Judgment-point check
+
+No new static heuristic is added at a competing-signals decision point. This is an enumerable JSONL framing invariant: only bytes through a complete newline may advance the durable cursor.
+
+## 5. Interactions
+
+- **Races:** scans use the stat/read prefix already in place; bytes appended after the read wait for a later sweep.
+- **Budgets:** each sweep still reads at most the configured per-row and aggregate limits.
+- **Retries:** progress is durable in `inbound_rollout_cursor`; restart resumes from the last complete boundary.
+- **Failure posture:** malformed complete JSON, unsupported events, identity mismatch, truncation, and an oversized single record still fail closed.
+
+## 6. External surfaces
+
+Busy Codex sessions no longer show false unknown delivery outcomes or strand valid messages from observability merely because their transcript grew by more than one scan budget. No API shape or user-facing wording changes.
+
+## 6b. Operator-surface quality
+
+No operator surface is changed — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: each observer reads the local transcript for the delivery effect performed on that machine. Ownership and transfer fencing are unchanged.
+
+## 8. Rollback cost
+
+Pure scanner code; revert is mechanically simple but would restore demonstrated false-unknown outcomes under large valid transcript bursts.
+
+## Conclusion
+
+The first canary correctly refused certification after exposing three false unknowns. The fix preserves every hard bound and uncertainty rule while distinguishing a safely resumable complete prefix from a truly boundary-free oversized record. Unit, integration, and production-wired E2E tests cover the non-aligned multi-budget case. The fresh exact candidate subsequently passed 50/50 deliveries over 7,213,141 ms, the complete case matrix, 30/30 responsiveness samples, and zero forbidden outcomes; its signed evidence is now bound to the certified sources.
+
+## Second-pass review
+
+Concur. Cursor advancement is restricted to complete newline boundaries, partial bytes remain unread, and the next sweep revalidates them from the record start. The change cannot authorize delivery or replay and narrows false uncertainty without weakening malformed-input handling. The reviewer noted that the compatibility scanner needed the same direct regression assertion as the production shared path; that coverage was added before commit.
+
+## Evidence pointers
+
+- `tests/unit/CodexDeliveryObserver.test.ts`
+- `tests/integration/codex-observer-bounded-backlog.test.ts`
+- `tests/e2e/codex-session-lifecycle-reliability.test.ts`
+- First canary ledger: 50/50 dedicated rows responded; three candidate-window false unknowns on busy sessions identified at non-aligned >256 KiB backlogs.
+- Corrected canary ledger: 50/50 rows consumed/cleared/responded; zero false unknown, exhaustion, duplicate ownership, lost inbound, or stale-owner outcomes; signed artifact digest `a2db23a95530681953ffa3002ab14e349ebf53d19be2a54c1f4afacc3aead997`.
+
+## Class-Closure Declaration
+
+No agent-authored-artifact defect and no added or modified self-triggered controller — not applicable. The regression is nevertheless pinned at all three required test tiers by the evidence above.

package/upgrades/side-effects/codex-test-worker-control-plane.md

@@ -0,0 +1,86 @@
+# Side-Effects Review — Codex test-worker interruption and control-plane resilience
+
+**Version / slug:** `codex-test-worker-control-plane`
+**Date:** `2026-09-04`
+**Author:** `Codex`
+**Second-pass reviewer:** `Codex independent reviewer`
+
+## Summary of the change
+
+This change protects exact esbuild service descendants before watchdog judgment, replaces pane-wide interruption with identity-fenced process signals, removes synchronous tmux probes from selected asynchronous server hot paths, and preserves honest durable lifeline replay reasons. It updates watchdog, session/input monitoring, lifeline, migration, scaffold awareness, and their unit/integration/E2E coverage.
+
+## Decision-point inventory
+
+- `SessionWatchdog.checkSession` — modify — exact service-role evidence prevents a destructive action against infrastructure.
+- `SessionWatchdog.signalIfIdentityMatches` — add — a deterministic safety fence revalidates the selected process before signaling.
+- `SessionManager.listRunningSessions` — modify — asynchronous hot paths trust the state registry/cache rather than blocking on tmux.
+- `StuckInputSentinel.tick` — modify — idle Codex sessions without durable stranded-draft evidence avoid synchronous pane probing.
+- `TelegramLifeline` replay notice — modify — chooses wording from the durable queue cause.
+
+## 1. Over-block
+
+An esbuild process with the exact `--service... --ping` contract is always protected even if that helper itself malfunctions. This is intentional: the owning test command remains observable, and killing its internal compiler helper is not a safe recovery action. One-shot esbuild invocations and shell commands merely mentioning those flags are not exempt.
+
+## 2. Under-block
+
+Other long-lived compiler or language-server protocols are not automatically protected unless already covered by framework ownership/exclusions. The fix is deliberately exact to the observed process contract. A process that preserves PID, parent, and exact argv across an exec-like behavioral change could pass the identity fence; session-level termination still goes through ReapAuthority.
+
+## 3. Level-of-abstraction fit
+
+Service classification is a low-level structural safety floor at the point that selects process targets. The contextual stuck-command authority still judges eligible user commands. Targeted signaling is the lower-level primitive the watchdog should use; final lifecycle authority remains centralized in ReapAuthority. Queue-cause formatting is a pure presentation helper over already-durable facts.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the service classifier is a safety guard on an irreversible/disruptive action, an explicit exception allowed by the principle.
+
+The exact argv classifier cannot authorize interruption; it can only refuse an unsafe target. Positive stuck judgments remain with the existing contextual authority or hard-ceiling policy, and final session death remains with ReapAuthority.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+The new heuristic is not a competing-signals judgment point. It is an enumerable process-protocol identity used solely as a no-kill safety floor; it never chooses to act. The existing contextual judge continues to resolve competing evidence for non-infrastructure commands.
+
+## 5. Interactions
+
+- **Shadowing:** service protection runs before exclusions and the stuck judge; this intentionally prevents the judge from acquiring authority over the helper.
+- **Double-fire:** targeted SIGINT replaces, rather than supplements, pane-wide Control-C. StuckInputSentinel remains independent and only submits a durable marked draft.
+- **Races:** every descendant signal rechecks PID, parent, and exact argv; failed identity checks delete escalation state. Escalation also binds session id and start timestamp, then refuses a replacement incarnation even if it reuses the tmux name. ReapAuthority re-resolves that same live session.
+- **Feedback loops:** a protected esbuild helper is reevaluated each poll but produces no intervention. Queue replay keeps stable delivery identity and cause.
+
+## 6. External surfaces
+
+Codex users stop seeing false operator-interruption banners and test runs stop collapsing from killed esbuild services. Telegram users may see corrected wording that distinguishes a server outage from a forwarding failure. Queue records gain an optional cause field compatible with older records. Timing remains machine-load dependent, but the affected event-loop paths no longer execute synchronous tmux probes. No operator-facing action is added.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No dashboard, approval, grant, revoke, or secret-entry surface is changed; not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN:** process trees, tmux sessions, watchdog targets, and local server availability are machine-specific truths. Telegram queue notices use the existing one-voice lifeline path and stable message identity; no new notice producer is introduced. Durable queue state remains in the existing agent state path and this change does not alter topic-transfer ownership. No URLs are generated.
+
+## 8. Rollback cost
+
+Pure code and backward-compatible record metadata: revert and ship a patch. No schema migration or state repair is required; old queue entries without a cause retain compatible fallback wording. Rolling back would re-expose false interruption and event-loop stalls during propagation.
+
+## Conclusion
+
+The first independent pass found missing session-incarnation fencing, incomplete effect-scope audit fields, and mocked-only process evidence. The implementation now binds escalation to session id/start time, records parent/role/scope/incarnation, and includes an integration test that launches the installed esbuild binary and inspects the real host process table. The repair is at the correct layers and narrows destructive authority; it is clear to ship after the confirming second pass.
+
+## Second-pass review (if required)
+
+**Reviewer:** Codex independent reviewer
+**Independent read of the artifact:** concur — the revised implementation closes the session-replacement race, records target/effect attribution, and proves against a live esbuild process tree that service descendants stay outside interruption authority.
+
+## Evidence pointers
+
+- `tests/unit/session-watchdog-attribution.test.ts`
+- `tests/integration/session-watchdog-safe-wait.test.ts`
+- `tests/integration/tmux-resilience-slow-stub.test.ts`
+- `tests/e2e/session-watchdog-continuation-lifecycle.test.ts`
+- `tests/e2e/lifeline-queue-notice-lifecycle.test.ts`
+
+## Class-Closure Declaration (display-only mirror)
+
+`defectClass: unbounded-self-action`; `closure: guard`; `guardEvidence: { enforcementType: ratchet, citation: tests/unit/SessionWatchdog-pipeline.test.ts, howCaught: the tests require exact service descendants to remain outside judgment and require every descendant intervention to use the identity-fenced targeted signal path, preventing repeated pane-wide interruption while bounded escalation and ReapAuthority remain the settling brakes }`.

package/upgrades/side-effects/inbound-delivery-unknown-terminalization.md

@@ -0,0 +1,82 @@
+# Side-Effects Review — Inbound delivery unknown terminalization
+
+**Version / slug:** `inbound-delivery-unknown-terminalization`
+**Date:** `2026-09-04`
+**Author:** `Codex`
+**Second-pass reviewer:** `Codex independent reviewer`
+
+## Summary of the change
+
+`InboundDeliveryStore.markObservationUnknown` and `markRolloutUnknown` now transition uncertain dispatched evidence to terminal `effect-unknown`, and status reporting prioritizes that transport state. This releases finite live-row capacity without replaying or deleting uncertain evidence. Unit regressions cover saturation, single-row and shared-rollout terminalization, metrics, and renewed admission.
+
+## Decision-point inventory
+
+- `InboundDeliveryStore.markObservationUnknown` — modify — completes the observer's existing deadline decision with the correct terminal transport state.
+- `InboundDeliveryStore.markRolloutUnknown` — modify — terminalizes every affected row when shared rollout parsing becomes uncertain.
+- `InboundDeliveryStore.status` — modify — reports effect uncertainty from transport truth rather than shadowing it with eligibility.
+
+## 1. Over-block
+
+No new rejection is introduced. A delivery is terminalized only where the existing observer already chose unknown, either at its fixed deadline or after a rollout-integrity failure. It cannot later be automatically recognized as consumed, but that was already true because unknown eligibility excluded further observation/recovery.
+
+## 2. Under-block
+
+Stale `prepared` rows are not changed; four exist locally but remain well below capacity and may still be eligible for dispatch. Other nonterminal states continue to count as live by design.
+
+## 3. Level-of-abstraction fit
+
+The store owns transport-state transitions and admission accounting, so it is the correct layer. The observer still owns when evidence becomes unknown; the store only makes that existing verdict internally consistent.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this is mechanical state consistency after an existing authority decision.
+
+No content or intent judgment is added. The deadline and observer already authorize the unknown result; this change ensures all state dimensions encode it consistently.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new heuristic or competing-signals decision point is added. This is an invariant: non-replayable observation-unknown evidence cannot simultaneously remain live for admission accounting.
+
+## 5. Interactions
+
+- **Shadowing:** status now exposes transport uncertainty before eligibility labels, correcting the prior shadow.
+- **Double-fire:** the guarded SQL transition only matches dispatched/open rows, so repeated observer calls are idempotent.
+- **Races:** each SQLite update is atomic; the shared-rollout transition updates all matching rows in one statement, so concurrent admission cannot see a partially terminalized rollout.
+- **Feedback loops:** terminal rows enter existing bounded GC; they cannot be replayed or re-observed.
+
+## 6. External surfaces
+
+New Telegram messages can again enter sessions after prior evidence expires. Diagnostics report a larger honest uncertain-effect count. No message text, operator action, URL, or external API schema changes.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator UI surface is changed; not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN:** each machine's journal records physical terminal effects performed on that machine. Ownership transfer already fences/export-imports live rows; terminal unknown rows do not transfer or replay. No user-facing notice, durable topic-transfer obligation, or URL is added.
+
+## 8. Rollback cost
+
+Revert and deploy a patch. The terminal state is safe and retained; no reverse migration is required. The one-time local repair has a complete SQLite backup at `.instar/state/inbound-delivery.pre-terminal-fix-20260904.sqlite`.
+
+## Conclusion
+
+The first independent pass found that shared-rollout uncertainty had the same stranded-live defect. That path now terminalizes all matching rows atomically and has a multi-row capacity regression. The change restores capacity without weakening no-duplicate delivery semantics or deleting audit evidence; it is ready after confirming review.
+
+## Second-pass review (if required)
+
+**Reviewer:** Codex independent reviewer
+**Independent read of the artifact:** concur — both single-delivery and shared-rollout uncertainty now terminalize atomically, preserve no-replay evidence, and release live capacity without adding judgment authority.
+
+## Evidence pointers
+
+- `tests/unit/InboundDeliveryStore.test.ts`
+- Live diagnosis: 500/500 rows expired; 496 were dispatched+unknown but counted live.
+- Local migration: 496 rows moved to effect-unknown; live count reduced from 500 to 4.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered action added — not applicable.

package/upgrades/side-effects/stage-b-evidence-code-binding.md

@@ -87,6 +87,7 @@ The review moved the design three times: the digest became canonical (order-stab
 - `tests/unit/stage-b-evidence-code-binding.test.ts` (19 tests)
 - `tests/unit/StageBActivationGate.test.ts`, `StageBStartupReadiness.test.ts`, `MentorStageBForensics.test.ts`, `codex-stage-b-publish-gate.test.ts` (all green)
 - Live: `node scripts/verify-codex-stage-b-release-evidence.mjs` passes on this tree; `verifyBundledStageBReleaseEvidence("9.9.9999")` returns null.
+- Fresh repair evidence: candidate `cfe468dc5` passed 50/50 deliveries over 7,213,141 ms, all required cases, 30/30 responsiveness samples, and zero forbidden outcomes; Echo signature verification and certified-set fingerprint check both pass for artifact digest `a2db23a95530681953ffa3002ab14e349ebf53d19be2a54c1f4afacc3aead997`.
 
 ## Class-Closure Declaration (display-only mirror)